Encryption methods, decryption methods, encryption devices, and decryption devices
By generating encrypted file blocks and data mappings in a virtual machine, the problems of unknown owners and high coupling of encrypted data are solved, and the association and operation of encrypted files with their owners are decoupled.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- LENOVO (BEIJING) LTD
- Filing Date
- 2022-10-31
- Publication Date
- 2026-05-26
Smart Images
Figure CN115659371B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data encryption technology, and in particular to an encryption method, a decryption method, an encryption device, and a decryption device. Background Technology
[0002] Data privacy protection has always been a concern. Currently, with the rapid development of blockchain technology, people tend to encrypt data on their local hosts and then upload it as encrypted blocks to cloud-based storage or distributed file systems, such as the Interplanetary File System (IPFS). Pointers to these encrypted blocks are then sent to the blockchain ledger to achieve data privacy. However, in practice, this approach has several drawbacks: firstly, the owner of the encrypted data cannot be identified; secondly, when encrypting or decrypting files using this method, users must first understand the encryption / decryption scheme and then use encryption tools from a Software Development Kit (SDK) to rewrite or replicate the blockchain code. This results in high coupling between users and the encryption / decryption scheme, making data encryption and decryption very inconvenient. Summary of the Invention
[0003] In view of this, the main objective of this application is to provide an encryption method, a decryption method, an encryption device, and a decryption device that can associate a file to be encrypted with its owner and decouple the user of the encryption / decryption scheme from the encryption / decryption method itself.
[0004] To achieve the above objectives, the technical solution of this application is implemented as follows:
[0005] In a first aspect, embodiments of this application provide an encryption method applied to a first virtual machine installed on a first host, the method comprising:
[0006] Obtain the file to be encrypted;
[0007] The file to be encrypted is encrypted using a self-encryption method to obtain multiple encrypted file blocks and a first data mapping corresponding to the multiple encrypted file blocks; the first data mapping includes a first mapping relationship between each encrypted file block and its corresponding encryption key and a second mapping relationship between each encrypted file block and its address information in the first virtual machine;
[0008] The first data mapping is transmitted to the first host so that the first host can map each encrypted file block to the blockchain based on the second mapping relationship, and can decrypt the multiple encrypted file blocks through the first mapping relationship in the first data mapping.
[0009] In the above scheme, the step of encrypting the file to be encrypted using a self-encryption method to obtain multiple encrypted file blocks and a first data mapping corresponding to the multiple encrypted file blocks includes:
[0010] The encryption key and initialization vector of the file blocks contained in the file to be encrypted are determined based on the identity of the encryptor of the file to be encrypted.
[0011] Based on the encryption key and initialization vector of each file block, each file block is encrypted according to the set self-encryption method to obtain multiple encrypted file blocks and the first data mapping.
[0012] In the above scheme, the identity identifier is obtained from the blockchain linked by the first host; wherein, the identity identifier includes a universally unique identifier.
[0013] In the above scheme, determining the encryption key for the file blocks contained in the file to be encrypted based on the identity identifier of the encryptor of the file to be encrypted includes:
[0014] The file to be encrypted is divided into at least three file blocks arranged in sequence;
[0015] Obtain the first hash result of the identity identifier;
[0016] Obtain the second hash result of the preceding file block that is adjacent to the first file block among the at least three file blocks;
[0017] Perform logical operations on the first hash result and the second hash result to obtain the processing result;
[0018] The first length of data in the processing result is used as the encryption key corresponding to the first file block;
[0019] The first file block is any one of the at least three file blocks.
[0020] In the above scheme, the method further includes:
[0021] Based on the second hash result corresponding to the data of the first length in the processing result, the initialization vector corresponding to the first file block is obtained from the second hash result, wherein the second hash result corresponding to the data of the first length is a proper subset of the second hash result.
[0022] In the above scheme, each file block is encrypted using the encryption key and initialization vector based on the set self-encryption method to obtain multiple encrypted file blocks, including:
[0023] Obtain the first file block; the first file block is any one of the aforementioned file blocks.
[0024] Based on the encryption key and initialization vector corresponding to the first file block, the first file block is encrypted according to the set encryption strategy to obtain the pre-encrypted file block corresponding to the first file block;
[0025] The pre-encrypted file block is obfuscated to obtain the encrypted file block corresponding to the first file block;
[0026] Multiple encrypted file blocks are obtained based on the encrypted file block corresponding to each of the first file blocks.
[0027] In the above scheme, obfuscating the pre-encrypted file block to obtain the encrypted file block corresponding to the first file block includes:
[0028] Obtain the third hash result corresponding to the first file block, the fourth hash result corresponding to the previous file block adjacent to the first file block, and the fifth hash result corresponding to the next file block adjacent to the first file block;
[0029] The unused portion of the fourth hash result is determined based on the encryption key and initialization vector corresponding to the first file block;
[0030] The unused portion of the third hash result, the fourth hash result, and the fifth hash result are concatenated to obtain the processing result corresponding to the first file block;
[0031] The processing result is XORed with the pre-encrypted file block corresponding to the first file block to obtain the encrypted file block corresponding to the first file block.
[0032] Secondly, this application also provides a decryption method, applied to a first virtual machine installed on a first host, the method comprising:
[0033] Obtain multiple block numbers associated with the file to be decrypted and a second data mapping corresponding to the file to be decrypted from the first host; each of the multiple block numbers points to a sub-file block to be decrypted that is associated with the file to be decrypted; the second data mapping contains the mapping relationship between each sub-file block to be decrypted and the corresponding decryption key;
[0034] Use each of the plurality of block numbers to obtain the corresponding sub-file block to be decrypted;
[0035] Based on the decryption key of each of the sub-file blocks to be decrypted, the corresponding sub-file blocks to be decrypted are decrypted using the set decryption method to obtain the sub-decrypted file blocks corresponding to each sub-file block to be decrypted;
[0036] The decrypted file of the file to be decrypted is obtained based on each of the sub-decrypted file blocks.
[0037] Thirdly, embodiments of this application also provide an encryption device applied to a first virtual machine installed on a first host, the device comprising:
[0038] The first acquisition module is used to acquire the file to be encrypted;
[0039] An encryption module is used to encrypt the file to be encrypted using a set self-encryption method to obtain multiple encrypted file blocks and a first data mapping corresponding to the multiple encrypted file blocks; the first data mapping includes a first mapping relationship between each encrypted file block and its corresponding encryption key and a second mapping relationship between each encrypted file block and its address information in the first virtual machine;
[0040] The transmission module is used to transmit the first data mapping to the first host, so that the first host can map each of the encrypted file blocks to the blockchain based on the second mapping relationship, and can decrypt the multiple encrypted file blocks through the first mapping relationship in the first data mapping.
[0041] Fourthly, embodiments of this application also provide a decryption device, applied to a first virtual machine installed on a first host, the device comprising:
[0042] The mapping module is used to obtain from the first host a plurality of block numbers associated with the file to be decrypted and a second data mapping corresponding to the file to be decrypted; each of the plurality of block numbers points to a sub-file block to be decrypted that is associated with the file to be decrypted; the second data mapping includes the mapping relationship between each sub-file block to be decrypted and the corresponding decryption key;
[0043] The second acquisition module is used to acquire the corresponding sub-decryption file block using each of the plurality of block numbers;
[0044] The decryption module is used to decrypt the corresponding sub-decryption file block based on the decryption key of each sub-decryption file block using a set decryption method, so as to obtain the sub-decryption file block corresponding to each sub-decryption file block;
[0045] The decryption module is also used to obtain the decrypted file of the file to be decrypted based on each of the sub-decryption file blocks.
[0046] This application provides an encryption method, decryption method, encryption device, and decryption device. The encryption method includes: acquiring a file to be encrypted; encrypting the file using a self-encryption method to obtain multiple encrypted file blocks and a first data mapping corresponding to the multiple encrypted file blocks; the first data mapping includes a first mapping relationship between each encrypted file block and its corresponding encryption key, and a second mapping relationship between each encrypted file block and its address information in a first virtual machine; transmitting the first data mapping to a first host, so that the first host can map each encrypted file block to a blockchain based on the second mapping relationship, and can decrypt the multiple encrypted file blocks using the first mapping relationship in the first data mapping. In the encryption method provided by this application, the first virtual machine acquires the file to be encrypted from the first host, encrypts the file using a self-encryption method to obtain multiple encrypted file blocks and a first data mapping corresponding to the multiple encrypted file blocks, and then transmits only the first data mapping to the first host, enabling the first host to map each encrypted file to a blockchain based on the second mapping relationship in the first data mapping. In this way, during the encryption process, the host user does not need to know the specific encryption strategy. He only needs to transmit the file to be encrypted to the first virtual machine (which encrypts it according to the set encryption method). The host user only needs to map the encrypted file block to the blockchain through the address information in the feedback second mapping relationship, thereby decoupling the coupling between the host user and the encryption and decryption methods in the first virtual machine. Attached Figure Description
[0047] Figure 1 This is a schematic diagram illustrating an application scenario of the encryption method provided in the embodiments of this application;
[0048] Figures 2A-2B This is an optional flowchart illustrating the encryption method provided in the embodiments of this application;
[0049] Figure 3 This is a schematic diagram of an encryption process of the encryption method provided in the embodiments of this application;
[0050] Figure 4 This is a schematic diagram of code calls between a first virtual machine and a first host provided in an embodiment of this application;
[0051] Figure 5 This is a flowchart illustrating the encryption and decryption method provided in an embodiment of this application;
[0052] Figure 6This is a schematic diagram of the structure of an encryption device provided in an embodiment of this application;
[0053] Figure 7 This is a schematic diagram of the structure of a decryption device provided in an embodiment of this application. Detailed Implementation
[0054] To more clearly illustrate the purpose, technical solutions, and advantages of the embodiments of this application, the embodiments of this application will be described in detail below with reference to the accompanying drawings. It should be understood that the following description of the embodiments is intended to explain and illustrate the overall concept of the embodiments of this application, and should not be construed as a limitation of the embodiments of this application. In the specification and drawings, the same or similar reference numerals refer to the same or similar parts or components. For clarity, the drawings are not necessarily drawn to scale, and some well-known parts and structures may be omitted from the drawings.
[0055] In related technologies, to achieve reliable file storage, files are often stored in a blockchain. Since smart contracts are the most vulnerable component of a blockchain, an alternative method is needed to handle sensitive files when dealing with users' private files, rather than simply sending the original file to the blockchain ledger. One solution is to locally encrypt the original file before sending it to the blockchain ledger. That is, related technologies encrypt the original file on the local host, then store the encrypted block in IPFS, and finally send a pointer to the encrypted block to the blockchain ledger. However, the above solution has the following problems:
[0056] 1. The original file itself does not link to its owner in any way, making it impossible to know who encrypted it.
[0057] 2. Implementing the above solution requires using encryption tools such as SDKs to rewrite or replicate the code of the smart contracts on the blockchain connected to the local host. This is an intrusive modification to the blockchain, and those involved must first understand the encryption methods before rewriting the code, resulting in high coupling between the personnel and the encryption scheme and a lack of flexibility.
[0058] Based on at least one of the problems existing in related technologies, this application provides an encryption method applied to a first virtual machine. The method involves obtaining a file to be encrypted; encrypting the file using a predefined self-encryption method to obtain multiple encrypted file blocks and a first data mapping corresponding to the multiple encrypted file blocks; the first data mapping includes a first mapping relationship between each encrypted file block and its corresponding encryption key, and a second mapping relationship between each encrypted file block and its address information in the first virtual machine; transmitting the first data mapping to a first host, so that the first host can map each encrypted file block to a blockchain based on the second mapping relationship, and can decrypt the multiple encrypted file blocks through the first mapping relationship in the first data mapping. The encryption method provided in this application is performed in a first virtual machine. The specific encryption process includes: the first virtual machine obtains the file to be encrypted from a first host; during encryption, the first virtual machine encrypts the file using a pre-defined self-encryption method, and then transmits the resulting multiple encrypted file blocks and a first data mapping corresponding to the multiple encrypted file blocks to the first host. The first data mapping contains a first mapping relationship between each encrypted file block and its corresponding encryption key, and the encryption key is obtained based on the encryptor's identity identifier of the file to be encrypted, thus enabling the encrypted file blocks to be linked to their owners based on the encryption key. Furthermore, the first data mapping also contains a second mapping relationship between each encrypted file block and its corresponding address information. Through the second mapping relationship, host users can access the first virtual machine to obtain the encrypted file blocks it stores. This setup allows host users to access the first virtual machine without needing to understand the specific encryption method, as the first virtual machine executes the encryption process and stores the encrypted file, decoupling the coupling between the user (host user) of the encryption / decryption scheme and the encryption / decryption method itself.
[0059] The technical solution of this application will be described in detail below with reference to the accompanying drawings.
[0060] Figure 1 This is a schematic diagram illustrating an application scenario of the encryption method provided in the embodiments of this application. For example... Figure 1 As shown, the application scenario 100 includes a first host 1001 and a first virtual machine 1002 installed on the first host 1001 using a virtual machine installation tool, wherein;
[0061] The first host 1001 can be implemented as various types of terminals such as laptops, tablets, desktop computers, and mobile devices, or it can be implemented as a server. Users can create or receive files on the first host 1001. The virtual machine installation tool can be an application (APP) used to install virtual machines. The first virtual machine 1002 can transmit data through a configured functional interface with the first host 1001. For example, it can retrieve a file to be encrypted from the first host 1001 through the functional interface; or it can map and return first data to the first host through the functional interface, etc.
[0062] Combination Figure 1 For the application scenarios shown, please refer to [link / reference]. Figure 2A , Figure 2A This is a schematic diagram of an optional encryption method provided in the embodiments of this application. (The diagram will be combined with...) Figure 2A The steps shown are explained.
[0063] Step 101: Obtain the file to be encrypted.
[0064] In some embodiments, the file to be encrypted may be as follows: Figure 1 The file to be encrypted can be any file created or received on the first host. For example, the file to be encrypted could be a file defined by the first user on the first host according to actual needs; or it could be a system configuration file of the first host.
[0065] Step 102: Encrypt the file to be encrypted using the set self-encryption method to obtain multiple encrypted file blocks and a first data mapping corresponding to the multiple encrypted file blocks; the first data mapping includes a first mapping relationship between each encrypted file block and the corresponding encryption key and a second mapping relationship between each encrypted file block and the address information of its location in the first virtual machine.
[0066] It should be noted that the self-encryption method mentioned above can refer to an identity-based self-encryption method. This self-encryption method, as a means of encrypting files, can be automatically implemented based on user settings without user intervention. Specifically, the self-encryption method converts the file into a bitstream (dividing the file into at least three file blocks), extracts a key by randomly selecting bits from the bitstream, and then uses this key to encrypt each bitstream. The key and the encrypted file are stored separately; for example, the key can be stored locally, while the encrypted file can be sent to a server.
[0067] For a more detailed explanation of step 102, see [link to relevant documentation]. Figure 2B , Figure 2AThe steps shown are: encrypting the file to be encrypted using a set self-encryption method to obtain multiple encrypted file blocks and a first data mapping corresponding to the multiple encrypted file blocks. This can be achieved through... Figure 2B To explain, Figure 2B This is an optional flowchart illustrating the encryption method provided in the embodiments of this application.
[0068] Step 1021: Determine the encryption key and initialization vector of the file blocks contained in the file to be encrypted based on the identity identifier of the encryptor to whom the file to be encrypted belongs.
[0069] In some embodiments, the identity identifier is any mark that can uniquely determine the identity of the encryptor. In practical applications, the identity identifier can be the encryptor's email address or phone number. In specific operations, the identity identifier is obtained from the blockchain linked to the first host; wherein, the identity identifier includes a universally unique identifier (UUID), which is a specific form of identifier, such as converting an email address or phone number into a specific form to obtain a universally unique identifier.
[0070] In some embodiments, determining the encryption key for the file blocks contained in the file to be encrypted based on the identity of the encryptor of the file to be encrypted may include:
[0071] The file to be encrypted is divided into at least three file blocks arranged in sequence;
[0072] Obtain the first hash result of the identity identifier;
[0073] Obtain the second hash result of the preceding file block that is adjacent to the first file block among the at least three file blocks;
[0074] Perform logical operations on the first hash result and the second hash result to obtain the processing result;
[0075] The first length of data in the processing result is used as the encryption key corresponding to the first file block;
[0076] The first file block is any one of the at least three file blocks.
[0077] For a better explanation of this process, see [link to documentation]. Figure 3 , Figure 3 This is a schematic diagram of an encryption process of the encryption method provided in the embodiments of this application.
[0078] In some embodiments, when dividing a file to be encrypted into blocks, the size of the file blocks can be set according to the size of the file to be encrypted (for example, the file block size can be set to 1 megabyte (M) in length). Then, the file to be encrypted is divided in order from beginning to end, resulting in multiple file blocks arranged in sequence. Of course, when the file blocks are large, they can be selectively compressed to reduce the memory occupied by the blocks. It should be noted that... Figure 3 Only blocks n-3, n-2, ..., n-1, n, and n+1 of at least three file blocks are shown. When encrypting each of the at least three file blocks, an identity identifier is first obtained. Then, the obtained identity identifier is hashed to obtain the first hash result corresponding to the identity identifier. The first hash result is then transmitted to the generator corresponding to each file block. This generator is used to generate the encryption key and initialization vector.
[0079] Since the encryption process for each file block is similar, this embodiment will be described in detail as an example, with block n as the first file block.
[0080] When encrypting the first file block, the second hash result corresponding to block n-1 needs to be obtained first. Then, a logical operation, namely XOR calculation, is performed on the first and second hash results to obtain the processing result. This process can be represented as follows: Where H represents hash processing, This represents an XOR operation. Then, the first length of data in the processing result is taken as the encryption key for block n, where the first length can be set manually. For example, a 32-bit length in the processing result can be used as the encryption key.
[0081] The encryption key can be represented as
[0082] In some embodiments, after obtaining the encryption key for block n based on block n-1, it is also necessary to obtain the initialization vector required for encrypting block n. Encryption of block n can only be achieved based on both the encryption key and the initialization vector. In specific operations, the initialization vector can be obtained in the following way: based on the second hash result corresponding to the data of the first length in the processing result, the initialization vector corresponding to the first file block is obtained from the second hash result, wherein the second hash result corresponding to the data of the first length is a proper subset of the second hash result.
[0083] The above process involves generating an encryption key based on the hash result corresponding to the first length of data from the second hash result, and then taking a certain number of bits (e.g., any one or more bits from 32 to 48) of data from the remaining second hash result to obtain an initialization vector. The initialization vector can be represented as [H(Cn-1 (32 bytes to 48 bytes)
[0084] After obtaining the encryption key and initialization vector, the process of encrypting block n according to the set encryption strategy can be represented as follows: Among them, E n This represents the encryption process, and the encryption strategy can be set to AES128.
[0085] Based on this, in some embodiments, the encryption key and initialization vector of each file block are used to encrypt each file block according to the set self-encryption method to obtain multiple encrypted file blocks, including:
[0086] Obtain the first file block; the first file block is any one of the aforementioned file blocks.
[0087] Based on the encryption key and initialization vector corresponding to the first file block, the first file block is encrypted according to the set encryption strategy to obtain the pre-encrypted file block corresponding to the first file block;
[0088] The pre-encrypted file block is obfuscated to obtain the encrypted file block corresponding to the first file block;
[0089] Multiple encrypted file blocks are obtained based on the encrypted file block corresponding to each of the first file blocks.
[0090] It should be noted that the first file block can be any one of at least three file blocks, such as block n mentioned above. In other words, the process of obtaining multiple encrypted file blocks is described using the first file block. The process of obtaining multiple encrypted file blocks involves: encrypting each file block according to a set encryption strategy based on its corresponding encryption key and initialization vector, resulting in a pre-encrypted file block for each file block; then, to avoid hash collisions, obfuscating each pre-encrypted file block to obtain an encrypted file block for each file block. This process yields multiple encrypted file blocks corresponding to the file to be encrypted.
[0091] refer to Figure 3 Taking block n as the first file block as an example, when encrypting block n, the encryption key k corresponding to block n is used. n Initialization vector IV n The file is encrypted using the AES 128 encryption strategy to obtain the pre-encrypted file block corresponding to block n. To avoid hash collisions, the pre-encrypted file block needs to be obfuscated to obtain the encrypted file block corresponding to block n.
[0092] In some embodiments, obfuscating the pre-encrypted file block to obtain the encrypted file block corresponding to the first file block may include:
[0093] Obtain the third hash result corresponding to the first file block, the fourth hash result corresponding to the previous file block adjacent to the first file block, and the fifth hash result corresponding to the next file block adjacent to the first file block;
[0094] The unused portion of the fourth hash result is determined based on the encryption key and initialization vector corresponding to the first file block;
[0095] The unused portion of the third hash result, the fourth hash result, and the fifth hash result are concatenated to obtain the processing result corresponding to the first file block;
[0096] The processing result is XORed with the pre-encrypted file block corresponding to the first file block to obtain the encrypted file block corresponding to the first file block.
[0097] As an example, continue to refer to Figure 3 Let's take block n as an example again. Figure 3 In the process, after obtaining the pre-encrypted file block corresponding to block n, it is also necessary to obtain the hash result (third hash result) corresponding to block n, the hash result (fourth hash result) corresponding to block n-1, and the hash result (fifth hash result) corresponding to block n+1. Based on the encryption key and initialization vector, the unused part in the fourth hash result is determined. For example, when only 16 bits remain in the unused part of the fourth hash result, this unused part can be represented as H(C n-1 The last 16 bytes are then processed by the generator. The unused portion of the hash result corresponding to block n, the hash result corresponding to block n-1, and the hash result corresponding to block n+1 are then concatenated to obtain the concatenated result. The length of the concatenated result is adjusted as needed to obtain the final result corresponding to block n. The process of obtaining the final result through the concatenation can be represented as H(C). n )+H(C n-1 last16 bytes + H(C) n-2 )+H(C n Finally, the processing result is XORed with the pre-encrypted file block corresponding to block n, i.e. Figure 3 middle The process of representing the process yields the encrypted file block n corresponding to block n.
[0098] Step 103: Transmit the first data mapping to the first host, so that the first host can map each encrypted file block to the blockchain based on the second mapping relationship, and can decrypt the multiple encrypted file blocks through the first mapping relationship in the first data mapping.
[0099] In some embodiments, the first virtual machine transmits the first data mapping to the first host through the aforementioned functional interface. Then, the first host maps each encrypted file block to the blockchain based on the second mapping relationship. There are two possible mapping methods, which are described below.
[0100] Method 1: After the first virtual machine completes encryption, it stores the encrypted file blocks in its memory. Simultaneously, it generates the address corresponding to the storage location of each encrypted file block within the first virtual machine and writes the address information of each encrypted file block and its location within the first virtual machine into a first data mapping, thus forming a second mapping relationship. The first virtual machine transmits the first data mapping to the first host through the functional interface configured with the first host; that is, it transmits both the first and second mapping relationships to the first host. After obtaining the second mapping relationship, the first host directly transmits multiple address information to the blockchain, enabling it to map each encrypted file block to the blockchain. In other words, the first mapping method involves the first host directly transmitting each address information from the second mapping relationship to the blockchain. Since data stored in the blockchain is immutable, and address information can be securely stored on the blockchain, transmitting addresses to the blockchain ensures data security.
[0101] Method 2: After the first virtual machine transmits the first data mapping to the first host, the first host will obtain multiple encrypted file blocks in the first virtual machine based on the second mapping, and then upload the multiple encrypted file blocks to IPFS. IPFS allocates a storage address for each encrypted file block and stores each encrypted file block, and feeds back the unique identifier corresponding to each encrypted file block to the blockchain, so as to realize the mapping of each encrypted file block to the blockchain. That is, the second mapping method is as follows: the first host first obtains each corresponding encrypted file block through each address information in the second mapping relationship, and then transmits each encrypted file block to IPFS. Finally, IPFS transmits the unique identifier corresponding to each encrypted file block to the blockchain, where the unique identifier is used to locate the corresponding encrypted file block in IPFS.
[0102] It should be noted that the first data mapping also includes a first mapping relationship, which is the mapping relationship between each encrypted file block and its corresponding encryption key. In some embodiments, the encryption key and decryption key can be the same, so multiple encrypted file blocks can be decrypted based on the first data mapping relationship.
[0103] To illustrate the former mapping method in this application, the following is based on... Figure 4 The interaction between the first virtual machine and the first host is explained. Figure 4This is a schematic diagram illustrating code calls between a first virtual machine and a first host, provided in an embodiment of this application. It should be noted that the arrows in the diagram represent a calling relationship between software functional units; the modules or units in the diagram do not represent any hardware-based implementation, but only illustrate mutual calls between software modules or units. It is easy to understand that an interface defines the parameters required by a functional function, or the data it can return; that is, an interface is also a function implementation method. The interfaces described in the embodiments of this application can all be implemented as a method in software, and the interface includes method units.
[0104] In some embodiments, a first virtual machine is installed on the first host, and the encryption method provided in the embodiments of this application can run in the first virtual machine. The first host can also run a computer program (code implementing unit calls) that interacts with the data of the first virtual machine. In practice, the code running on the first host can also be used to upload local data to the blockchain.
[0105] When the first host performs an encryption operation based on the instruction of the calling unit, the calling unit can invoke the encryption unit in the first virtual machine. The encryption unit obtains the file to be encrypted and encrypts it (obtaining multiple encrypted file blocks based on the above encryption method). Then, the first virtual machine allocates address information for storage to the multiple encrypted file blocks through the allocation unit, and writes the multiple encrypted file blocks into the memory of the first virtual machine according to the allocated address information. The first virtual machine also generates a second mapping relationship between the encrypted file blocks and the corresponding address information, so that the first host or the first virtual machine can quickly locate the encrypted file blocks. The process of storing the encrypted file blocks can be as follows: After the first virtual machine completes encryption through the encryption unit, it allocates a storage area for each encrypted file block through the allocation unit; the address corresponding to each storage area is the address information of the encrypted file block stored in that storage area; after obtaining multiple address information, a buffer area is allocated through the allocation unit, which is used to cache multiple address information; then, the multiple address information is transferred to the memory of the first host through the allocation unit. In this way, the first host can locate the stored encrypted file blocks in the first virtual machine through the address information. When the transmission ends or the local application in the first host is closed, the shutdown unit in the first host calls the release unit of the first virtual machine to release the originally allocated buffer area.
[0106] To ensure data security, after obtaining multiple address information, the first host, based on code written in its local application, can transmit the address information to the blockchain for storage, ensuring that each address cannot be tampered with. It should be noted that the blockchain achieves interoperability with data outside the blockchain based on calling units. Because the blockchain has its fixed interface usage specifications, a converter must be used to transform the interface usage methods to ensure that the new interface is compatible with the existing blockchain interface usage methods.
[0107] The encryption method provided in this application is applied to a first virtual machine. It obtains a file to be encrypted from a first host, encrypts the file using a self-encryption method, and obtains multiple encrypted file blocks and a first data mapping corresponding to each encrypted file block. The first data mapping is then transmitted to the first host, enabling the first host to obtain the address of each encrypted file block within the first virtual machine. Each address is then transmitted to a blockchain, allowing the first host to map each encrypted file block to the blockchain. Thus, during the encryption process, since the encryption key in the first data mapping is obtained based on the identity of the owner of the file to be encrypted, the encrypted file blocks can be linked to their owners based on the encryption key. Furthermore, the first host can obtain each encrypted file block based on a second mapping relationship, allowing host users to obtain the encrypted file without explicitly specifying the encryption method, thus decoupling the user from the encryption method itself.
[0108] Based on a similar inventive concept, this application also provides a decryption method, applied to a first virtual machine installed on a first host, the method comprising:
[0109] Obtain multiple block numbers associated with the file to be decrypted and a second data mapping corresponding to the file to be decrypted from the first host; each of the multiple block numbers points to a sub-file block to be decrypted that is associated with the file to be decrypted; the second data mapping contains the mapping relationship between each sub-file block to be decrypted and the corresponding decryption key;
[0110] Use each of the plurality of block numbers to obtain the corresponding sub-file block to be decrypted;
[0111] Based on the decryption key of each of the sub-file blocks to be decrypted, the corresponding sub-file blocks to be decrypted are decrypted using the set decryption method to obtain the sub-decrypted file blocks corresponding to each sub-file block to be decrypted;
[0112] The decrypted file of the file to be decrypted is obtained based on each of the sub-decrypted file blocks.
[0113] The decryption method provided in this application embodiment uses a block number to correspond to a block in the blockchain. This block includes address information corresponding to the encrypted file block or a unique identifier returned by IPFS. Based on the address information or unique identifier returned by IPFS in each block number, each sub-file block to be decrypted can be obtained in the first virtual machine or the InterPlanetary File System. The decryption key in the second data mapping is then used to decrypt each sub-file block to be decrypted, thereby enabling convenient decryption of the file to be decrypted.
[0114] See below. Figure 4 ,based on Figure 4 The interaction relationship between the first virtual machine and the first host illustrates an exemplary application of the decryption process when the former mapping method is used in the embodiments of this application.
[0115] When the first host performs a decryption operation based on the instructions of the calling unit, the calling unit first obtains the address of the file to be decrypted from the blockchain, then calls the decryption unit in the first virtual machine, so that the decryption unit can locate the corresponding encrypted file block based on the address, then decrypt the encrypted file block, and return the decrypted file to the first host through the calling unit.
[0116] It should be noted that in some embodiments, programmers can use any language such as C or Rust to write programs that implement encryption or decryption methods; the example in the figure uses C++. To solve the problem of incompatibility between different programming languages in the first virtual machine, programs written in various languages can be compiled into intermediate code by a compiler, so that the first virtual machine can recognize and run the encryption or decryption program without needing to know the type of the upper-level language.
[0117] To illustrate the latter mapping method in this application, after the first virtual machine completes encryption, the first host, based on the second mapping relationship, obtains the encrypted file block and then transmits the encrypted file block to a cloud-based file storage system, such as the InterPlanetary File System. Below, based on... Figure 5 This illustrates an exemplary application of the embodiments of this application in a real-world application scenario. Figure 5 This is a schematic flowchart of the encryption and decryption method provided in the embodiments of this application. The steps are described below.
[0118] The encryption process includes steps 1 to 4, wherein;
[0119] Step 1: The first host calls the following command: Claeng add[file][key_out_put_path]; to obtain the file to be encrypted; and to transfer the file to be encrypted to the first virtual machine.
[0120] Here, file is the absolute path to the file to be encrypted, and key output path is the absolute path to the location where the key is stored.
[0121] Step 2: The first virtual machine obtains its identity identifier.
[0122] It should be noted that smart contracts in blockchain allow for the definition of assets on the ledger, such as defining an asset with three fields, including identity identifier, user public key, and identifier. In practice, the identity identifier in step 2 can be obtained based on the method described in step 1021 of the embodiments of this application, and will not be elaborated here.
[0123] Step 3: The first virtual machine obtains the file to be encrypted; the first virtual machine encrypts the file to be encrypted based on the identity identifier, and obtains multiple encrypted file blocks.
[0124] It should be noted that, Figure 5 The original file obtained will be used as the file to be encrypted. In the actual acquisition operation, step 3, obtaining the file to be encrypted, can be based on the embodiments of this application. Figure 2A The method described in step 101 for obtaining the file to be encrypted is not detailed here. The encryption process in step 3 can be based on the embodiments of this application. Figure 2B The methods described in steps 1021 to 1022 obtain multiple encrypted file blocks, which will not be elaborated here.
[0125] Step 4.1: The first host uploads the encrypted file block to IPFS.
[0126] It should be noted that step 4.1 corresponds to the second mapping method described in step 103 of the embodiments of this application. The first host uploads the encrypted file blocks to IPFS, and then IPFS places each encrypted file block into an archive to retain the name of each encrypted file block, and feeds back a unique identifier (CID) corresponding to each encrypted file block to the blockchain. The unique identifier can be a content identifier or a content addressing identifier. Before step 4.1, the first virtual machine also needs to transmit the encrypted file blocks to the first host; how this transmission is carried out has already been described and will not be repeated here.
[0127] Step 4.2: The blockchain uses the unique identifier, public key, and identity identifier of the encrypted file block to create the asset corresponding to each encrypted file block, and saves each asset to each block; the block code corresponding to the block is fed back to the first host.
[0128] It should be noted that, based on assets predefined on the ledger, with two known parameters—user identity and user public key—already pre-written, a complete asset can be created by simply writing the unique identifier of the encrypted file block into that asset. Simultaneously, each unique identifier is stored in a different block, and the block number is returned to the primary host, enabling the primary host to locate each unique identifier based on the block number, thereby retrieving the encrypted file block in the InterPlanetary File System (IPS) using the unique identifier.
[0129] Step 4.3: The first virtual machine returns the first data mapping.
[0130] It should be noted that in step 3, while obtaining multiple encrypted file blocks, a first data mapping corresponding to each encrypted file block is also obtained. This first data mapping contains a first mapping relationship between each encrypted file block and its corresponding encryption key. After returning the first data mapping to the first host, since encryption and decryption are inverse processes, it can be said that the encryption key is also the decryption key. Therefore, the first host can decrypt the encrypted file blocks according to the encryption key (or decryption key) in the first mapping relationship.
[0131] The decryption process includes steps 5 to 9, wherein;
[0132] Step 5: The first host calls the following command: Claeng get[block][key][destination] to obtain the block number and the second data mapping; and transmits the block number and the second data mapping to the first virtual machine.
[0133] Here, `block` is the block of the asset in the blockchain that contains the encrypted block CID, `key` is the absolute path of the decryption key, and `destination` is the absolute path to the location where the decryption file is written. It should be noted that the second data mapping is the same as the first data mapping.
[0134] Step 6: The first virtual machine receives the block number and the second data mapping, and obtains the unique identifier and public key of each encrypted file block based on the block number, and uses the public key to determine that each unique identifier has not been tampered with.
[0135] It should be noted that, based on the assets created in step 4.2, the unique identifier and public key within the same block can be obtained through the block number. The unique identifier is used to locate the encrypted file block, and the public key is used to verify whether the data of the unique identifier has been tampered with.
[0136] Step 7: The first virtual machine retrieves encrypted file blocks from the InterPlanetary File System based on each unique identifier.
[0137] Step 8: The first virtual machine decrypts the corresponding encrypted file block using the decryption key in the second data mapping.
[0138] It should be noted that the decryption key is the encryption key corresponding to the first mapping relationship in the first data mapping.
[0139] Step 9: The first virtual machine returns the decrypted file to the first host.
[0140] The decryption process described above involves using the block number to obtain a unique identifier, which in turn allows access to the encrypted file block in the InterPlanetary File System. The second data map contains the decryption key corresponding to each encrypted file block. Therefore, the encrypted file block can be decrypted using the decryption key to obtain the decrypted file and return it to the first host.
[0141] Based on the same inventive concept, this application also provides an encryption device, see reference. Figure 6 , Figure 6 This is a schematic diagram of an encryption device provided in an embodiment of this application. The device 60 includes: a first acquisition module 601, an encryption module 602, and a transmission module 603.
[0142] The first acquisition module 601 is used to acquire the file to be encrypted.
[0143] The encryption module 602 encrypts the file to be encrypted using a set self-encryption method to obtain multiple encrypted file blocks and a first data mapping corresponding to the multiple encrypted file blocks; the first data mapping includes a first mapping relationship between each encrypted file block and its corresponding encryption key and a second mapping relationship between each encrypted file block and its address information in the first virtual machine.
[0144] The transmission module 603 is used to transmit the first data mapping to the first host, so that the first host can map each encrypted file block to the blockchain based on the second mapping relationship, and can decrypt the multiple encrypted file blocks through the first mapping relationship in the first data mapping.
[0145] In some embodiments, the encryption module 602 is further configured to determine the encryption key and initialization vector of the file blocks contained in the file to be encrypted based on the identity identifier of the encryptor to which the file to be encrypted belongs; and to encrypt each file block according to the set self-encryption method based on the encryption key and initialization vector of each file block, thereby obtaining multiple encrypted file blocks and the first data mapping.
[0146] In some embodiments, the encryption module 602 obtains the identity identifier from the blockchain linked to the first host; wherein the identity identifier includes a universally unique identifier.
[0147] In some embodiments, the encryption module 602 is further configured to divide the file to be encrypted into at least three file blocks arranged in sequence; obtain a first hash result of the identity identifier; obtain a second hash result of the preceding file block adjacent to the first file block among the at least three file blocks; perform logical operations on the first hash result and the second hash result to obtain a processing result; and obtain data of a first length in the processing result as the encryption key corresponding to the first file block; wherein the first file block is any one of the at least three file blocks.
[0148] In some embodiments, the encryption module 602 is further configured to obtain the initialization vector corresponding to the first file block from the second hash result based on the second hash result corresponding to the data of the first length in the processing result, wherein the second hash result corresponding to the data of the first length is a proper subset of the second hash result.
[0149] In some embodiments, the encryption module 602 is further configured to obtain a first file block; the first file block is any one of the file blocks; encrypt the first file block according to a set encryption strategy based on the encryption key and initialization vector corresponding to the first file block to obtain a pre-encrypted file block corresponding to the first file block; obfuscate the pre-encrypted file block to obtain an encrypted file block corresponding to the first file block; and obtain multiple encrypted file blocks based on the encrypted file block corresponding to each of the first file blocks.
[0150] In some embodiments, the encryption module 602 is further configured to obtain a third hash result corresponding to the first file block, a fourth hash result corresponding to the preceding file block adjacent to the first file block, and a fifth hash result corresponding to the following file block adjacent to the first file block; determine the unused portion of the fourth hash result based on the encryption key and initialization vector corresponding to the first file block; perform concatenation processing on the third hash result, the unused portion of the fourth hash result, and the fifth hash result to obtain a processing result corresponding to the first file block; and perform XOR processing on the processing result and the pre-encrypted file block corresponding to the first file block to obtain the encrypted file block corresponding to the first file block.
[0151] Based on the same inventive concept, embodiments of this application also provide a solution device, referencing... Figure 7 , Figure 7 This is a schematic diagram of a decryption device provided in an embodiment of this application. The device 70 includes: a mapping module 701, a second acquisition module 702, and a decryption module 703.
[0152] The mapping module 701 is used to obtain from the first host a plurality of block numbers associated with the file to be decrypted and a second data mapping corresponding to the file to be decrypted; each of the plurality of block numbers points to a sub-file block to be decrypted that is associated with the file to be decrypted; the second data mapping includes the mapping relationship between each sub-file block to be decrypted and the corresponding decryption key.
[0153] The second acquisition module 702 is used to acquire the corresponding sub-file block to be decrypted using each of the plurality of block numbers.
[0154] The decryption module 703 is used to decrypt the corresponding sub-decryption file block based on the decryption key of each sub-decryption file block using a set decryption method, so as to obtain the sub-decryption file block corresponding to each sub-decryption file block.
[0155] The decryption module 703 is further configured to obtain the decrypted file of the file to be decrypted based on each of the sub-decryption file blocks.
[0156] It should be noted that the description of the apparatus in this application embodiment is similar to the description of the method embodiment described above, and has similar beneficial effects as the method embodiment; therefore, it will not be repeated. For technical details not disclosed in this apparatus embodiment, please refer to the description of the method embodiment of this application for understanding.
[0157] It should be noted that, in the embodiments of this application, if the above-mentioned encryption or decryption methods are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a terminal to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.
[0158] This application also provides an electronic device, which includes at least a processor and a computer-readable storage medium configured to store executable instructions, wherein the processor typically controls the overall operation of the electronic device. The computer-readable storage medium is configured to store processor-executable instructions and applications, and may also cache data to be processed or processed by the processor and various modules in the electronic device, and may be implemented using flash memory or random access memory (RAM).
[0159] This application provides a storage medium storing executable instructions. When the executable instructions are executed by a processor, the processor will execute the encryption and decryption methods provided in this application.
[0160] In some embodiments, the storage medium may be a computer-readable storage medium, such as a ferromagnetic random access memory (FRAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), flash memory, magnetic surface memory, optical disc, or a compact disk-read-only memory (CD-ROM); or it may be a device that includes one or any combination of the above-mentioned memories.
[0161] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.
[0162] As an example, executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts within a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple co-located files (e.g., files storing one or more modules, subroutines, or code sections). As an example, executable instructions may be deployed to execute on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network.
[0163] It should be noted that the technical features described in the embodiments of this application can be combined arbitrarily without conflict.
[0164] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.
[0165] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components may be combined, or integrated into another system, or some features may be ignored or not performed.
[0166] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. An encryption method applied to a first virtual machine installed on a first host, the method comprising: Obtain the file to be encrypted; Based on the identity of the encryptor of the file to be encrypted, the file to be encrypted is encrypted using a set self-encryption method to obtain multiple encrypted file blocks and a first data mapping corresponding to the multiple encrypted file blocks; the first data mapping includes a first mapping relationship between each encrypted file block and the corresponding encryption key and a second mapping relationship between each encrypted file block and the address information of its location in the first virtual machine; The first data mapping is transmitted to the first host so that the first host can map each encrypted file block to the blockchain based on the second mapping relationship, and can decrypt the multiple encrypted file blocks through the first mapping relationship in the first data mapping.
2. The method according to claim 1, wherein encrypting the file to be encrypted using a set self-encryption method to obtain multiple encrypted file blocks and a first data mapping corresponding to the multiple encrypted file blocks includes: The encryption key and initialization vector of the file blocks contained in the file to be encrypted are determined based on the identity of the encryptor of the file to be encrypted. Based on the encryption key and initialization vector of each file block, each file block is encrypted according to the set self-encryption method to obtain multiple encrypted file blocks and the first data mapping.
3. The method of claim 2, obtaining the identity from a blockchain linked to the first host; wherein, The identity identifier includes a universally unique identifier.
4. The method according to claim 2, wherein determining the encryption key for the file blocks contained in the file to be encrypted based on the identity identifier of the encryptor of the file to be encrypted includes: The file to be encrypted is divided into at least three file blocks arranged in sequence; Obtain the first hash result of the identity identifier; Obtain the second hash result of the preceding file block that is adjacent to the first file block among the at least three file blocks; Perform logical operations on the first hash result and the second hash result to obtain the processing result; The first length of data in the processing result is used as the encryption key corresponding to the first file block; The first file block is any one of the at least three file blocks.
5. The method according to claim 4, further comprising: Based on the second hash result corresponding to the data of the first length in the processing result, the initialization vector corresponding to the first file block is obtained from the second hash result, wherein the second hash result corresponding to the data of the first length is a proper subset of the second hash result.
6. The method according to claim 2, wherein encrypting each file block according to the set self-encryption method based on the encryption key and initialization vector of each file block to obtain multiple encrypted file blocks includes: Get the first file block; The first file block is any one of the file blocks; Based on the encryption key and initialization vector corresponding to the first file block, the first file block is encrypted according to the set encryption strategy to obtain the pre-encrypted file block corresponding to the first file block. The pre-encrypted file block is obfuscated to obtain the encrypted file block corresponding to the first file block; Multiple encrypted file blocks are obtained based on the encrypted file block corresponding to each of the first file blocks.
7. The method according to claim 6, wherein obfuscating the pre-encrypted file block to obtain the encrypted file block corresponding to the first file block comprises: Obtain the third hash result corresponding to the first file block, the fourth hash result corresponding to the previous file block adjacent to the first file block, and the fifth hash result corresponding to the next file block adjacent to the first file block; The unused portion of the fourth hash result is determined based on the encryption key and initialization vector corresponding to the first file block; The unused portion of the third hash result, the fourth hash result, and the fifth hash result are concatenated to obtain the processing result corresponding to the first file block; The processing result is XORed with the pre-encrypted file block corresponding to the first file block to obtain the encrypted file block corresponding to the first file block.
8. A decryption method, applied to a first virtual machine installed on a first host, the method comprising: Obtain from the first host multiple block numbers associated with the file to be decrypted and a second data mapping corresponding to the file to be decrypted; Each of the plurality of block numbers points to a sub-block of the file to be decrypted that is associated with the file to be decrypted; the second data mapping includes the mapping relationship between each sub-block of the file to be decrypted and the corresponding decryption key; Use each of the plurality of block numbers to obtain the corresponding sub-block to be decrypted; Based on the decryption key of each of the sub-file blocks to be decrypted, the corresponding sub-file blocks to be decrypted are decrypted using the set decryption method to obtain the sub-decrypted file blocks corresponding to each sub-file block to be decrypted; The decrypted file of the file to be decrypted is obtained based on each of the sub-decrypted file blocks.
9. An encryption device, applied to a first virtual machine installed on a first host, the device comprising: The acquisition module is used to acquire the file to be encrypted; An encryption module is used to encrypt the file to be encrypted using a predefined self-encryption method based on the identity identifier of the encryptor of the file to be encrypted, thereby obtaining multiple encrypted file blocks and a first data mapping corresponding to the multiple encrypted file blocks; the first data mapping includes a first mapping relationship between each encrypted file block and its corresponding encryption key and a second mapping relationship between each encrypted file block and its address information in the first virtual machine; The transmission module is used to transmit the first data mapping to the first host, so that the first host can map each of the encrypted file blocks to the blockchain based on the second mapping relationship, and can decrypt the multiple encrypted file blocks through the first mapping relationship in the first data mapping.
10. A decryption device, applied to a first virtual machine installed on a first host, the device comprising: The mapping module is used to obtain from the first host multiple block numbers related to the file to be decrypted and a second data mapping corresponding to the file to be decrypted; Each of the plurality of block numbers points to a sub-block of the file to be decrypted that is associated with the file to be decrypted; the second data mapping includes the mapping relationship between each sub-block of the file to be decrypted and the corresponding decryption key; The acquisition module is used to acquire the corresponding sub-file block to be decrypted using each of the plurality of block numbers; The decryption module is used to decrypt the corresponding sub-decryption file block based on the decryption key of each sub-decryption file block using a set decryption method, so as to obtain the sub-decryption file block corresponding to each sub-decryption file block; The decryption module is also used to obtain the decrypted file of the file to be decrypted based on each of the sub-decryption file blocks.