A method and device for encrypting and storing sensitive information blocks in files

Abstract

The present invention provides a method and device for encrypting and storing sensitive information blocks in files. The method comprises: encrypting sensitive information blocks by using a data encryption key to obtain encrypted information blocks; storing the encrypted information blocks in an idle position in a file data area to obtain information block identifiers and start information of the encrypted information blocks; storing the information block identifiers, start information and information fingerprints of the sensitive information blocks in an idle position in a file block index area; storing key encryption ciphertext and session key index information in an idle position in a file key pool area; wherein the key encryption ciphertext is a ciphertext obtained by encrypting the data encryption key by using a session key. By adopting separate encryption measures for each sensitive information block to be saved, the amount of data encrypted each time is small. The encrypted sensitive information blocks are directly stored in the file to avoid encryption of the entire file, thereby achieving fast encryption speed and low resource consumption.

Description

Technical Field

[0001] The present invention relates to the technical field of information encryption, and in particular to a method and device for encrypting and storing sensitive information blocks in a file. Background Art

[0002] In real business systems, there are a large number of sensitive information blocks, such as: the bill of a transaction, the headshot and ID card photos of people obtained when collecting demographic information, and some sensitive text files uploaded by users to the system.

[0003] For sensitive information blocks in the active period, they can be stored in a relational database that is easy to access, and their data security can be guaranteed through the database's security measures. If necessary, the information can be encrypted before being stored in the database.

[0004] However, as time goes by, the amount of such data in the system will increase, and most of the data will be rarely read after a certain period of time. At this time, putting it in the database will cause excessive database overhead and reduce the operating efficiency of the database. The existing method generally stores these information blocks in the file system. If the information blocks originally exist in the form of files, direct file system storage is more convenient.

[0005] However, if the information blocks are directly stored in the file system, data security is vulnerable. If the information blocks are encrypted before storage, each time data is added to the same file, it needs to be re-encrypted, which consumes more computing resources.

[0006] Therefore, how to better implement the storage of sensitive information blocks has become an urgent problem to be solved in the industry. Summary of the invention

[0007] The present invention provides a method and device for encrypting and storing sensitive information blocks in a file, so as to solve the problem that efficient sensitive information block storage cannot be effectively realized in the prior art.

[0008] The present invention provides a method for encrypting and storing a sensitive information block in a file, comprising:

[0009] The sensitive information block is encrypted by using a data encryption key to obtain an encrypted information block;

[0010] The encrypted information block is stored in an idle position in the file data area, and an information block identifier and start information of the encrypted information block are obtained;

[0011] The information block identifier, the start information and the information fingerprint of the sensitive information block are stored in an idle position in the file block index area;

[0012] The key encryption ciphertext and session key index information are stored in an idle location in the file key pool area;

[0013] The key-encrypted ciphertext is a ciphertext obtained by encrypting the data encryption key with a session key.

[0014] According to a method for encrypting and storing a sensitive information block in a file provided by the present invention, before the step of encrypting the sensitive information block by using the data encryption key key-d, the method further includes:

[0015] After generating the first random number, encrypting the first random number using the encryption center public key to obtain an encrypted first random number;

[0016] Sending the encrypted first random number to an encryption center, so that the encryption center decrypts the encrypted first random number, encrypts the session key pair by using the first random number, and sends the encrypted session key pair to the business system;

[0017] Decrypting the encrypted session key pair using the first random number to obtain the encrypted session key pair;

[0018] The session key pair includes a session key and a session key index of the session key.

[0019] According to a method for encrypting and storing a sensitive information block in a file provided by the present invention, before the step of storing the encrypted information block in a free position in a file data area, the method further comprises:

[0020] Get the current information block ID of the business system;

[0021] When the current information block identifier of the business system exceeds the preset recommended index number, a new file is generated, and the file block index area and the file key pool area in the new file are cleared.

[0022] According to a method for encrypting and storing a sensitive information block in a file provided by the present invention, after the step of storing the key-encrypted ciphertext and the index information of the session key in an idle position of a key pool area of ​​the file, the method further comprises:

[0023] Insert sensitive information block storage records into the business system database;

[0024] The sensitive information block storage record includes: a file identifier of the file, an information block identifier of the encrypted information block, and an information fingerprint of the sensitive information block.

[0025] According to a method for encrypting and storing a sensitive information block in a file provided by the present invention, the method further comprises:

[0026] Find the storage record of the sensitive information block to be read in the business system database;

[0027] Searching and opening the file according to the file identifier in the storage record of the sensitive information block to be read;

[0028] Determine the file block index area information according to the information block identifier in the storage record of the sensitive information block to be read, and determine the file data area information according to the start information in the file block index area information;

[0029] The key information of the key pool area is determined according to the key pool area start information in the file data area information.

[0030] According to a method for encrypting and storing a sensitive information block in a file provided by the present invention, the method further comprises:

[0031] When the information fingerprint stored in the file block index area information is the same as the information fingerprint in the sensitive information block to be read, determining the session key index information according to the key information in the key pool area;

[0032] Obtaining a session key corresponding to the session key index information, and decrypting the key encryption ciphertext in the file key pool area using the session key to obtain a data encryption key;

[0033] The encrypted information block stored in the file data area information is decrypted according to the data encryption key.

[0034] According to a method for encrypting and storing a sensitive information block in a file provided by the present invention, the step of obtaining a session key corresponding to the session key index information specifically includes:

[0035] Generate a second random number, and encrypt the second random number and session key index information using the encryption center public key to obtain first encrypted data information;

[0036] Sending the encrypted data information to an encryption center so that the encryption center decrypts the encrypted data information, determining a session key according to session key index information, encrypting the session key with a second random number, and sending the second encrypted data information to a business system;

[0037] The second encrypted data information is decrypted using the second random number to obtain a session key corresponding to the session key index information.

[0038] The present invention also provides an encrypted storage device for sensitive information blocks in a file, comprising:

[0039] An encryption module, used for encrypting the sensitive information block by using a data encryption key to obtain an encrypted information block;

[0040] A first storage module is used to store the encrypted information block in an idle position in the file data area, and obtain an information block identifier and start information of the encrypted information block;

[0041] A second storage module is used to store the information block identifier, the start information and the information fingerprint of the sensitive information block in an idle position of the file block index area;

[0042] A third storage module is used to store the key encryption ciphertext and session key index information in an idle position in the file key pool area;

[0043] The key-encrypted ciphertext is a ciphertext obtained by encrypting the data encryption key with a session key.

[0044] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-mentioned methods for encrypting and storing sensitive information blocks in a file are implemented.

[0045] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above-described methods for encrypting and storing sensitive information blocks in a file.

[0046] The present invention provides a method and device for encrypting and storing sensitive information blocks in files. By adopting separate encryption measures for sensitive information blocks to be saved each time, the amount of data encrypted each time is small. The encrypted sensitive information blocks are directly stored in the file to avoid encryption of the entire file, thereby achieving fast encryption speed and low resource consumption. At the same time, by storing the information block identifier, start information and the information fingerprint of the sensitive information block in the free position of the file block index area, it is possible to directly locate the specific position of a specific file through the file block index area information during the file decryption process, thereby greatly improving the response speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 It is a schematic diagram of the flow of the method for encrypting and storing sensitive information blocks in a file provided by the present invention;

[0049] Figure 2 A schematic diagram of the encrypted file storage format provided by the present invention;

[0050] Figure 3 A schematic diagram of a business system database provided by the present invention;

[0051] Figure 4 A schematic diagram of the information block encryption process provided by the present invention;

[0052] Figure 5 A schematic diagram of the information block decryption process provided by the present invention;

[0053] Figure 6 A schematic diagram of an encrypted storage device for sensitive information blocks in a file provided by the present invention;

[0054] Figure 7 A schematic diagram of the physical structure of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] Figure 1 FIG. 1 is a flow chart of a method for encrypting and storing sensitive information blocks in a file provided by the present invention. Figure 1 As shown, including:

[0057] Step S1, encrypting the sensitive information block using a data encryption key to obtain an encrypted information block;

[0058] Step S2, storing the encrypted information block in an idle position in the file data area, and obtaining the information block identifier and start information of the encrypted information block;

[0059] Step S3, storing the information block identifier, the start information and the information fingerprint of the sensitive information block in an idle position in the file block index area;

[0060] Step S4, storing the key encrypted ciphertext and session key index information in an idle location in the file key pool area;

[0061] The key-encrypted ciphertext is a ciphertext obtained by encrypting the data encryption key with a session key.

[0062] Specifically, the data encryption key (key-d) described in the present invention refers to a key that is independently generated by the business system itself and used to encrypt plain text. The key is encrypted with a session key and stored in a file.

[0063] The session key (key-s) described in the present invention refers to the session key generated by the encryption center when the business center requests the encryption center to obtain the key, and the key is used to encrypt the real "data encryption key key-d".

[0064] The information block identifier (BlockId) described in the present invention refers to the id value of the information block in the current storage file. Each time a new storage file is created, BlockId will always increase from 1. When BlockId reaches MAX, new data can no longer be written to the storage file. At this time, a new storage file needs to be created and FileId+1. Note: The self-increment operation of BlockId remains atomic.

[0065] The start information (Offset) described in the present invention refers to the starting position where the designated information block data area is stored in the file.

[0066] The encryption center described in the present invention refers to a system or device that is responsible for generating session keys and session key indexes, storing them, and providing query services to the business system.

[0067] The business system of the present invention encrypts the sensitive information block by using the data encryption key. After obtaining the encrypted information block, the business system opens the corresponding file, verifies the file header, searches for the cultural index area position of a free block, fills in BlockId, Offset, and information fingerprint; then searches for a free position in the file key pool area, saves the corresponding information (encrypts the ciphertext of key-d and the index of key-s with key-s), and then the business system writes the encrypted information block and its related information in an appended manner at the end of the file data area.

[0068] Figure 2 The encrypted file storage format provided by the present invention is shown in FIG. Figure 2 As shown in the figure, the file is divided into four blocks: file header, block index area, key pool area and data area. The specific function of each block is described below:

[0069] File header: used to save the overall information of the file.

[0070] File id: The unique id of this file.

[0071] Digest algorithm type: The digest algorithm selected for plain text digest calculation. Different digest algorithms generate different information fingerprint lengths, but the digest lengths generated by the same algorithm are the same.

[0072] Reserved space: reserved for subsequent expansion.

[0073] Block index area: This area stores a fixed number of MAX records, and the MAX value is pre-configured according to the requirements. Each index block occupies a fixed length, so that the program can easily locate the specified index block according to the length when processing.

[0074] BlockId: Specifies the unique ID of the information block in this file.

[0075] Offset: Specifies the starting position of the information block data area stored in this file.

[0076] Information fingerprint: It is the fingerprint result generated after the information block plain text is processed by the digest algorithm. Its length varies depending on the digest algorithm used, but all use the algorithm indicated by the "Digest Algorithm" field in the file header.

[0077] When a file is created, all the space required is allocated at one time and initialized to 0.

[0078] According to the pre-assessed information block size, it is generally recommended that the maximum number of index entries be controlled within the range of 5000 to 50000. If there are too many entries, the file will be too large, which will easily affect the access efficiency when reading; if the file is too small, the system will save too many encrypted files, adding more burden to operation and maintenance.

[0079] Key pool area: This area stores a fixed number of MAX records, and the MAX value is the same as the MAX value of the "block index area". This area stores the relevant information for encrypting the original data.

[0080] Session key index (ksid): An index value generated by the "encryption center" that the encryption center uses to match one-to-one with the session keys stored within the center.

[0081] Algorithm and mode: The encryption algorithm and encryption mode used to encrypt the data encryption key (key-d).

[0082] Filling method: the content required to be filled by the algorithm encrypted by the data encryption key (key-d)

[0083] Session key length: original length of the session key (key-s), auxiliary information.

[0084] Data length: The length of the ciphertext encrypted with the "Data Encryption Key (key-d)".

[0085] All required space is allocated at one time when the file is created.

[0086] Data area: stores encrypted data, as well as auxiliary information such as file index and encryption algorithm.

[0087] Key pool area Offset: The Offset of the key pool area to which this data corresponds. This data can be used to directly jump to the key pool area to read key-related information.

[0088] Content format: whether the plain text is in character or binary format, a block of data in the common memory or a complete file. This field is auxiliary information.

[0089] Algorithm and mode: The encryption algorithm and encryption mode used to encrypt plain text.

[0090] Filling method: the content that needs to be filled in the algorithm for encrypting plain text

[0091] Data key length: the original length of the data encryption key (key-d), auxiliary information, used to verify the key-d decrypted from the key pool area.

[0092] Ciphertext: The ciphertext of the information block encrypted with the data encryption key (key-d), variable length.

[0093] The present invention provides a method and device for encrypting and storing sensitive information blocks in files. By adopting separate encryption measures for sensitive information blocks to be saved each time, the amount of data encrypted each time is small. The encrypted sensitive information blocks are directly stored in the file to avoid encryption of the entire file, thereby achieving fast encryption speed and low resource consumption. At the same time, by storing the information block identifier, start information and the information fingerprint of the sensitive information block in the idle position of the file block index area, the specific position of the specific file can be directly located through the file block index area information during the file decryption process, greatly improving the response speed. On the other hand, the data encryption key will be encrypted by the session key, and the index of the session key is always stored in the encryption center for subsequent use; the session key index is used when searching for the session key, and the authentication and authorization mechanism of the encryption center ensures that the index will not be used maliciously, thereby ensuring the security of information block encryption.

[0094] Based on any of the above embodiments, before the step of encrypting the sensitive information block by using the data encryption key key-d, the method further includes:

[0095] After generating the first random number, encrypting the first random number using the encryption center public key to obtain an encrypted first random number;

[0096] Sending the encrypted first random number to an encryption center, so that the encryption center decrypts the encrypted first random number, encrypts the session key pair by using the first random number, and sends the encrypted session key pair to the business system;

[0097] Decrypting the encrypted session key pair using the first random number to obtain the encrypted session key pair;

[0098] The session key pair includes a session key and a session key index of the session key.

[0099] Specifically, the first random number in the present invention is generated by the business system, which may also refer to a random string. The business system uses the public key of the encryption center to encrypt the first random number to obtain the encrypted first random number, and sends the encrypted first random number to the encryption center. After receiving the encrypted first random number, the encryption center uses its own private key to decrypt it to obtain the first random number.

[0100] The encryption center then generates a session key (key-s) and a session key index (ksid) corresponding to the session key (key-s), and saves the session key pair (ksid, key-s) in the encryption center. This session key (key-s) is independently generated by the encryption center and has nothing to do with the random number.

[0101] In the present invention, the corresponding session key can be found in the encryption center through the session key index.

[0102] The encryption center uses the first random number obtained by decryption to encrypt the session key pair to obtain an encrypted session key pair. After receiving the encrypted session key pair, the business system decrypts it using the first random number to obtain a decrypted session key pair.

[0103] The session key at this time can be used to encrypt the data encryption key.

[0104] In the present invention, encryption is performed according to randomly generated random numbers in the interaction between the encryption center and the business system to ensure the reliability of data interaction. At the same time, the index of the session key is always stored in the encryption center for subsequent use. The session key index is used when searching for the session key. The authentication and authorization mechanism of the encryption center ensures that the index will not be used maliciously, thereby ensuring the security of information block encryption.

[0105] Based on any of the above embodiments, before the step of storing the encrypted information block in an idle position in the file data area, the method further includes:

[0106] Get the current information block ID of the business system;

[0107] When the current information block identifier of the business system exceeds the preset recommended index number, a new file is generated, and the file block index area and the file key pool area in the new file are cleared.

[0108] Specifically, the preset recommended index number described in the present invention specifically refers to the MAX value, which is specifically the maximum number of information blocks that can be stored in a file, and the value can be modified by configuration. Generally, it is configured before the system is deployed based on the estimated information block size that may be used in the system, and once configured, it will not be modified.

[0109] In the present invention, after the information block is encrypted with key-d and the encrypted information block is obtained, the system's unique BlockId (self-incrementing) is obtained. If the BlockId exceeds the predefined MAX, the system's unique FileId+1 is added, a new storage file is generated, the block index area and the key pool area are cleared, and the BlockId is cleared.

[0110] In the present invention, by comparing the information block identifier exceeding the preset recommended index number, data overflow is effectively avoided, thereby ensuring the reliability of file storage.

[0111] Based on any of the above embodiments, after the step of storing the key-encrypted ciphertext and the index information of the session key in an idle position of the key pool area of ​​the file, the method further includes:

[0112] Insert sensitive information block storage records into the business system database;

[0113] The sensitive information block storage record includes: a file identifier of the file, an information block identifier of the encrypted information block, and an information fingerprint of the sensitive information block.

[0114] Figure 3 A schematic diagram of the business system database provided by the present invention, such as Figure 3 As shown, after the business system stores the information block in the file, it needs to create a sensitive information block storage record for this information in the database. The record fields of the sensitive information block storage record are as follows: Information block primary key / foreign key: The business system uses the primary key or foreign key to quickly find a record in this table. FileId: The id value of the file currently storing this information block, use this value to find the storage file. BlockId: The block id value corresponding to this information block, use this value to find the specific data value in the storage file. Information fingerprint: The fingerprint result generated after the information block plaintext is digested by the algorithm. Used to compare with the fingerprint stored in the file.

[0115] In the present invention, the corresponding sensitive information block storage record is inserted into the business system database after completing one storage, and index information is left in the database. If a search is required, the database can be searched first, and after quickly obtaining its index, the specific position of the specific file can be directly located, which greatly improves the response speed.

[0116] Based on any of the above embodiments, the method further includes:

[0117] Find the storage record of the sensitive information block to be read in the business system database;

[0118] Searching and opening the file according to the file identifier in the storage record of the sensitive information block to be read;

[0119] Determine the file block index area information according to the information block identifier in the storage record of the sensitive information block to be read, and determine the file data area information according to the start information in the file block index area information;

[0120] The key information of the key pool area is determined according to the key pool area start information in the file data area information.

[0121] In the process of decrypting the sensitive information block described in the present invention, the business system reads the business system database, finds the FileId, BlockId and information block fingerprint corresponding to the information block to be read, searches for the file according to the FileId and opens the file, determines the file block index area information according to the information block identifier BlockId, determines the file data area information according to the start information in the file block index area information, and determines the key information of the key pool area according to the start information of the key pool area in the file data area information.

[0122] Based on any of the above embodiments, when the information fingerprint stored in the file block index area information is the same as the information fingerprint in the sensitive information block to be read, determining the session key index information according to the key information in the key pool area;

[0123] Obtaining a session key corresponding to the session key index information, and decrypting the key encryption ciphertext in the file key pool area using the session key to obtain a data encryption key;

[0124] The encrypted information block stored in the file data area information is decrypted according to the data encryption key.

[0125] Specifically, the information fingerprint stored in the index area is read according to the BlockId and compared with the information fingerprint read from the database. If the fingerprints are the same, proceed to the next step; if they are different, the user is prompted that the data is destroyed.

[0126] According to the key information of the key pool area, the session key index information is determined, and the session key corresponding to the index is obtained from the encryption center through the session key index information. Then, the key encrypted ciphertext of the file key pool area is decrypted by the obtained session key, so that the decrypted data encryption key can be obtained. After obtaining the data encryption key, the encrypted information block can be decrypted, so as to obtain the sensitive information block originally stored.

[0127] The present invention adopts a separate encryption measure for each sensitive information block to be saved, so the amount of data encrypted each time is small. The encrypted sensitive information block is directly stored in the file to avoid encryption of the entire file, thereby achieving fast encryption speed and low resource consumption. At the same time, by storing the information block identifier, start information and the information fingerprint of the sensitive information block in the idle position of the file block index area, it can be made possible to directly locate the specific position of the specific file through the file block index area information during the file decryption process, thereby greatly improving the response speed.

[0128] Based on any of the above embodiments, the step of obtaining the session key corresponding to the session key index information specifically includes:

[0129] Generate a second random number, and encrypt the second random number and session key index information using the encryption center public key to obtain first encrypted data information;

[0130] Sending the encrypted data information to an encryption center so that the encryption center decrypts the encrypted data information, determining a session key according to session key index information, encrypting the session key with a second random number, and sending the second encrypted data information to a business system;

[0131] The second encrypted data information is decrypted using the second random number to obtain a session key corresponding to the session key index information.

[0132] Specifically, the second random number described in the present invention refers to a random number generated by the business system, which may also refer to a random string generated by the business system. The business system encrypts the second random number and session key index information through the public key of the encryption center, and after obtaining the first encrypted data information, the first encrypted data information is sent to the encryption center. The encryption center decrypts the first encrypted data information according to its own private key to obtain the session key index information, and then finds the corresponding session key according to the session key index information. After encrypting the session key with the second random number, the second encrypted data information is obtained.

[0133] After receiving the second encrypted data information, the business system decrypts the second encrypted data information using the second random number to obtain the session key, and can thus decrypt the key-encrypted ciphertext using the session key.

[0134] During the interaction process, the business system and the encryption center in the present invention always encrypt with random numbers to ensure the reliability of the interaction, and the data encryption key will be encrypted by the session key, and the index of the session key will be stored in the encryption center for subsequent use; the session key index is used when searching for the session key, and the authentication and authorization mechanism of the encryption center ensures that the index will not be used maliciously, thereby ensuring the security of information block encryption.

[0135] Figure 4 The information block encryption process diagram provided by the present invention is as follows: Figure 4 As shown, including:

[0136] The business system generates a random number (or random string), encrypts it using the public key published by the encryption center, and sends it to the encryption center;

[0137] After receiving the random number, the encryption center uses the private key to decrypt it, and then generates a session key index (ksid) and a session key (key-s), and saves the (ksid, key-s) pair in the encryption center. This key is generated independently by the encryption center and has nothing to do with the random number.

[0138] The encryption center uses the random number as the key to encrypt the session key index and session key and returns them;

[0139] After receiving the data, the business system uses the random number to decrypt the session key index and session key, and then independently generates the data encryption key key-d (random string);

[0140] The business system generates information block fingerprints using a predefined algorithm; encrypts the information block using key-d; and then obtains the system's unique BlockId (self-incrementing). If the BlockId exceeds the predefined MAX, the system's unique FileId+1 is added, a new storage file is generated, the block index area and key pool area are cleared, and the BlockId is cleared.

[0141] The business system opens the corresponding file, verifies the file header, finds a free block index area, fills in BlockId, Offset, and information fingerprint; then finds a free key pool area and saves the corresponding information (encrypts the ciphertext of key-d and the index of key-s with key-s). The business system writes the ciphertext of the information block and related information in an appended manner at the end of the file.

[0142] After the above operations are successful, a new record is inserted into the business system database: FileId, BlockId, information block fingerprint;

[0143] The process ends.

[0144] Figure 5The information block decryption process diagram provided by the present invention is as follows: Figure 5 As shown, including:

[0145] The business system reads the database, finds the FileId, BlockId, and information block fingerprint corresponding to the information block to be read, searches for the file according to the FileId and opens it, reads the information block fingerprint saved in the index area according to the BlockId, and compares it with the fingerprint data read from the database. If the fingerprints are the same, proceed to the next step; if they are different, the user is prompted that the data is destroyed.

[0146] The business system finds the file record in the data area according to the index area Offset, finds the key information in the key pool area according to the key pool area Offset saved in the data area, and reads the session key index (ksid).

[0147] The business system generates a random number (or random string) and encrypts it with the public key of the encryption center (random number + session key index) and sends it to

[0148] After receiving the message, the encryption center uses the private key to decrypt the message, searches for the session key (key-s) according to the session key index (ksid), uses the random number as the key, encrypts the session key and returns it;

[0149] After receiving the data, the business system uses the random number to decrypt the session key, and then uses key-s to decrypt the data encryption key key-d.

[0150] The business system uses key-d to decrypt the encrypted information block, and calculates the information block fingerprint again, and compares it with the database and block index area fingerprint.

[0151] If the fingerprints are the same, the process ends normally. If the fingerprints are different, the process ends after an error is reported.

[0152] The session key in the present invention is always stored in the encryption center for subsequent use; the session key index is used when searching for the session key, and the authentication and authorization mechanism of the encryption center ensures that the index will not be used maliciously.

[0153] The scheme of the present invention introduces a digest algorithm when saving data, and a digest of the information block is stored in a database and a file. Before reading the ciphertext of the information block, the digest information stored in the database and the file must be compared first. If the comparison fails, it means that the file has been damaged and the result will be discarded. After decryption, the information block will be digested again and compared again. If the information does not match, the result will still be discarded. The introduction of the digest algorithm protects the integrity of the data well.

[0154] .The present invention supports the storage of variable-length information blocks and has no restrictions on the length of plaintext data that needs to be encrypted.

[0155] The present invention has no restrictions on the content of the information block to be encrypted and can encrypt any text or binary stream.

[0156] Figure 6 A schematic diagram of an encrypted storage device for sensitive information blocks in a file provided by the present invention, such as Figure 6 As shown, it includes: an encryption module 610, a first storage module 620, a second storage module 630 and a third storage module 640; wherein the encryption module 610 is used to encrypt the sensitive information block by using the data encryption key to obtain the encrypted information block; wherein the first storage module 620 is used to store the encrypted information block in an idle position in the file data area to obtain the information block identifier and start information of the encrypted information block; wherein the second storage module 630 is used to store the information block identifier, start information and the information fingerprint of the sensitive information block in an idle position in the file block index area; wherein the third storage module 640 is used to store the key encryption ciphertext and the session key index information in an idle position in the file key pool area; wherein the key encryption ciphertext is the ciphertext obtained by encrypting the data encryption key by using the session key.

[0157] The present invention adopts a separate encryption measure for each sensitive information block to be saved, so the amount of data encrypted each time is small. The encrypted sensitive information block is directly stored in the file to avoid encryption of the entire file, thereby achieving fast encryption speed and low resource consumption. At the same time, by storing the information block identifier, start information and the information fingerprint of the sensitive information block in the idle position of the file block index area, it can be made possible to directly locate the specific position of the specific file through the file block index area information during the file decryption process, thereby greatly improving the response speed.

[0158] Figure 7 A schematic diagram of the physical structure of the electronic device provided by the present invention, such as Figure 7As shown, the electronic device may include: a processor 710, a communication interface 720, a memory 730 and a communication bus 740, wherein the processor 710, the communication interface 720 and the memory 730 communicate with each other through the communication bus 740. The processor 710 may call the logic instructions in the memory 730 to execute the encryption storage method of the sensitive information block in the file, the method comprising: encrypting the sensitive information block by the data encryption key to obtain the encrypted information block; storing the encrypted information block in the idle position of the file data area, obtaining the information block identifier and start information of the encrypted information block; storing the information block identifier, start information and the information fingerprint of the sensitive information block in the idle position of the file block index area; storing the key encryption ciphertext and the session key index information in the idle position of the file key pool area; wherein the key encryption ciphertext is the ciphertext obtained by encrypting the data encryption key by the session key.

[0159] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0160] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the encryption storage method of the sensitive information block in the file provided by the above methods, the method including: encrypting the sensitive information block by a data encryption key to obtain an encrypted information block; storing the encrypted information block in an idle position in a file data area to obtain an information block identifier and start information of the encrypted information block; storing the information block identifier, start information and information fingerprint of the sensitive information block in an idle position in a file block index area; storing the key encrypted ciphertext and session key index information in an idle position in a file key pool area; wherein the key encrypted ciphertext is a ciphertext obtained by encrypting the data encryption key by a session key.

[0161] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the encryption storage method of the sensitive information block in the file provided in the above-mentioned embodiments, the method comprising: encrypting the sensitive information block by a data encryption key to obtain an encrypted information block; storing the encrypted information block in an idle position in a file data area to obtain an information block identifier and start information of the encrypted information block; storing the information block identifier, start information and information fingerprint of the sensitive information block in an idle position in a file block index area; storing the key-encrypted ciphertext and session key index information in an idle position in a file key pool area; wherein the key-encrypted ciphertext is a ciphertext obtained by encrypting the data encryption key by a session key.

[0162] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0163] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0164] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for encrypting and storing sensitive information blocks in a file, characterized in that: include: The sensitive information block is encrypted by using a data encryption key to obtain an encrypted information block; The encrypted information block is stored in an idle position in the file data area, and an information block identifier and start information of the encrypted information block are obtained; The information block identifier, the start information and the information fingerprint of the sensitive information block are stored in an idle position in the file block index area; The key encryption ciphertext and session key index information are stored in an idle location in the file key pool area; The key-encrypted ciphertext is a ciphertext obtained by encrypting the data encryption key with a session key.

2. The method for encrypting and storing sensitive information blocks in a file according to claim 1, characterized in that: Before the step of encrypting the sensitive information block by using the data encryption key, the method further includes: After generating the first random number, encrypting the first random number using the encryption center public key to obtain an encrypted first random number; Sending the encrypted first random number to an encryption center, so that the encryption center decrypts the encrypted first random number, encrypts the session key pair by using the first random number, and sends the encrypted session key pair to the business system; Decrypting the encrypted session key pair using the first random number to obtain a decrypted session key pair; The session key pair includes a session key and a session key index of the session key.

3. The method for encrypting and storing sensitive information blocks in a file according to claim 1, characterized in that: Before the step of storing the encrypted information block in a free position in the file data area, the method further comprises: Get the current information block ID of the business system; When the current information block identifier of the business system exceeds the preset recommended index number, a new file is generated, and the file block index area and the file key pool area in the new file are cleared.

4. The method for encrypting and storing sensitive information blocks in a file according to claim 1, characterized in that: After the step of storing the key-encrypted ciphertext and the index information of the session key in an idle position of the key pool area of ​​the file, the method further comprises: Insert sensitive information block storage records into the business system database; The sensitive information block storage record includes: a file identifier of the file, an information block identifier of the encrypted information block, and an information fingerprint of the sensitive information block.

5. The method for encrypting and storing sensitive information blocks in a file according to claim 4, characterized in that: The method further comprises: Find the storage record of the sensitive information block to be read in the business system database; Searching and opening the file according to the file identifier in the storage record of the sensitive information block to be read; Determine the file block index area information according to the information block identifier in the storage record of the sensitive information block to be read, and determine the file data area information according to the start information in the file block index area information; The key information of the key pool area is determined according to the key pool area start information in the file data area information.

6. The method for encrypting and storing sensitive information blocks in a file according to claim 4, characterized in that: The method further comprises: When the information fingerprint stored in the file block index area information is the same as the information fingerprint in the sensitive information block to be read, determining the session key index information according to the key information in the key pool area; Obtaining a session key corresponding to the session key index information, and decrypting the key encryption ciphertext in the file key pool area using the session key to obtain a data encryption key; The encrypted information block stored in the file data area information is decrypted according to the data encryption key.

7. The method for encrypting and storing sensitive information blocks in a file according to claim 6, characterized in that: The step of obtaining the session key corresponding to the session key index information specifically includes: Generate a second random number, and encrypt the second random number and session key index information using the encryption center public key to obtain first encrypted data information; Sending the encrypted data information to an encryption center so that the encryption center decrypts the encrypted data information, determining a session key according to session key index information, encrypting the session key with a second random number, and sending the second encrypted data information to a business system; The second encrypted data information is decrypted using the second random number to obtain a session key corresponding to the session key index information.

8. A device for encrypting and storing sensitive information blocks in a file, characterized in that: include: An encryption module, used for encrypting the sensitive information block by using a data encryption key to obtain an encrypted information block; A first storage module is used to store the encrypted information block in an idle position in the file data area, and obtain an information block identifier and start information of the encrypted information block; A second storage module is used to store the information block identifier, the start information and the information fingerprint of the sensitive information block in an idle position of the file block index area; A third storage module is used to store the key encryption ciphertext and session key index information in an idle position in the file key pool area; The key-encrypted ciphertext is a ciphertext obtained by encrypting the data encryption key with a session key.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the method for encrypting and storing sensitive information blocks in a file as described in any one of claims 1 to 7 are implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for encrypting and storing sensitive information blocks in a file as claimed in any one of claims 1 to 7 are implemented.

Images