A file transmission method and device, electronic equipment and storage medium

Abstract

The application discloses a file transmission method and device, electronic equipment and storage medium. The method comprises the following steps: receiving the identification information of an encrypted file corresponding to a search term and a user identifier sent by a client; determining a target encrypted file in a corresponding relationship table of the identification information and the encrypted file according to the identification information; and sending the target encrypted file to the client when it is determined that the user has the right to access the target encrypted file according to the user identifier and the open level of the target encrypted file. The technical scheme of the application can receive the identification information and the user identifier sent by the client, determine whether the current user has the right to access the target encrypted file according to the open level of the target encrypted file corresponding to the identification information and the user identifier, and send the target encrypted file to the client when the user has the right to access the target encrypted file, so that the security of the transmission of the target encrypted file can be ensured.

Description

Technical Field

[0001] This invention relates to the field of data transmission technology, and in particular to a file transfer method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the development of cloud computing, data outsourcing has become a new trend. Outsourcing means that data owners entrust the management of their data to the cloud, which can create new security issues. To ensure data security and privacy, outsourced files and indexes need to be encrypted before being uploaded to the cloud.

[0003] Currently, outsourced files are generally encrypted using symmetric encryption, with all users using the same key. This presents a vulnerability where a user with privileges can retain access even after their privileges have been revoked. Furthermore, symmetric encryption requires exchanging keys with the decryption user, making the keys susceptible to leakage, cyberattacks, and tampering, thus posing security risks. Summary of the Invention

[0004] This invention provides a file transfer method, apparatus, electronic device, and storage medium that can improve the reliability of the file transfer process and achieve secure transmission of encrypted files.

[0005] According to one aspect of the present invention, a file transfer method is provided, the method comprising:

[0006] Receive the identifier information of the encrypted file corresponding to the search terms sent by the client and the user identifier;

[0007] The target encrypted file is determined based on the correspondence between the identification information and the encrypted file in the identification information and encrypted file correspondence table.

[0008] Once it is determined that a user has the right to access the target encrypted file based on the user identifier and the openness level of the target encrypted file, the target encrypted file is sent to the client.

[0009] Optionally, before receiving the identifier information of the encrypted file corresponding to the search terms sent by the client and the user identifier, the method further includes: receiving the encrypted file sent by the data owner; when the encrypted file needs to be encrypted a second time, performing secondary encryption on the encrypted file, wherein the encrypted file after secondary encryption contains a secondary encryption identifier.

[0010] Optionally, the target encrypted file is determined based on the identification information in the correspondence table between identification information and encrypted files, including: matching the identification information in the correspondence table between identification information and encrypted files, and determining the target encrypted file corresponding to the identification information based on the matching result.

[0011] Optionally, when it is determined that the user has the right to access the target encrypted file based on the user identifier and the openness level of the target encrypted file, the target encrypted file is sent to the client, including: determining the openness level of the target encrypted file; determining whether the user has the right to access the target encrypted file based on the user identifier and the openness level; and sending the target encrypted file to the client when the user has the right to access the target encrypted file.

[0012] Optionally, the openness level of the target encrypted file is determined, including: when the target encrypted file contains a secondary encryption identifier, the openness level of the target encrypted file is determined to be a semi-open level; when the target encrypted file does not contain a secondary encryption identifier, the openness level of the target encrypted file is determined to be a fully open level.

[0013] Optionally, the user's right to access the target encrypted file is determined based on the user identifier and the openness level, including: when the openness level of the target encrypted file is semi-open and the user identifier contains a secondary decryption key, the user is determined to have the right to access the target encrypted file; when the openness level of the target encrypted file is fully open, the user is determined to have the right to access the target encrypted file.

[0014] Optionally, the method further includes: when the target encrypted file contains a secondary encryption identifier and the user has the right to access the target encrypted file, decrypting the target encrypted file based on the decryption key corresponding to the encryption key of the secondary encryption.

[0015] According to another aspect of the present invention, a file transfer device is provided, the device comprising:

[0016] The acquisition module is used to receive the identification information of the encrypted file corresponding to the search terms sent by the client and the user identifier;

[0017] The determination module is used to determine the target encrypted file based on the identification information in the correspondence table between identification information and encrypted files;

[0018] The execution module is used to send the target encrypted file to the client when it is determined that the user has the right to access the target encrypted file based on the user identifier and the openness level of the target encrypted file.

[0019] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0020] At least one processor; and a memory communicatively connected to the at least one processor; wherein,

[0021] The memory stores a computer program that can be executed by at least one processor, such that the at least one processor is able to perform the file transfer method described in any embodiment of the present invention.

[0022] According to another aspect of the present invention, a computer-readable storage medium is provided that stores computer instructions for causing a processor to execute and implement the file transfer method described in any embodiment of the present invention.

[0023] The technical solution of this invention involves receiving the identifier information of the encrypted file corresponding to the search terms sent by the client, and the user identifier; determining the target encrypted file based on the identifier information in a correspondence table between identifier information and encrypted files; and sending the target encrypted file to the client when it is determined that the user has permission to access the target encrypted file based on the user identifier and the access level of the target encrypted file. This method ensures the security of the target encrypted file transmission and improves the reliability of the file transmission process by determining whether the current user has permission to access the target encrypted file based on the access level of the target encrypted file corresponding to the identifier information and the user identifier.

[0024] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a flowchart illustrating a file transfer method provided in Embodiment 1 of the present invention;

[0027] Figure 2 This is a flowchart illustrating a file transfer method provided in Embodiment 2 of the present invention;

[0028] Figure 3 This is a schematic diagram of the structure of a file transfer device provided in Embodiment 3 of the present invention;

[0029] Figure 4 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. Detailed Implementation

[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] Example 1

[0033] Figure 1 This is a flowchart illustrating a file transfer method according to Embodiment 1 of the present invention. This embodiment is applicable to situations such as file acquisition. The method can be executed by the file transfer device provided in this embodiment, which can be implemented in hardware and / or software. In a specific embodiment, the device can be integrated into an electronic device. The following embodiments will illustrate this using the integration of the device into an electronic device as an example. (Refer to...) Figure 1 The method specifically includes the following steps:

[0034] S101. Receive the identifier information of the encrypted file corresponding to the search term sent by the client and the user identifier.

[0035] The client can be understood as a device for determining key information, such as identifying encrypted files based on search terms or generating user identifiers based on user information. Specifically, the client stores a mapping table between search terms and encrypted file identifiers. When the client receives a search term from a user, it can determine the identifier of the corresponding encrypted file by looking up the mapping table. The client also stores the method for determining user authentication information. After receiving the user's authentication information, it can determine the user identifier based on this method.

[0036] To enhance data transmission security, special algorithms are used to transform the data. An encrypted file can be understood as ciphertext generated after transforming the original data. The identification information of an encrypted file can be understood as its attribute information, such as its index, storage location, and number. Specifically, the identification information for each encrypted file is unique. A user identifier can be understood as the user's identity information, such as a token used to prove the user's identity or other user identity attribute information. Search terms can be understood as the search terms entered by the user; however, this embodiment of the invention does not limit the specific search terms used.

[0037] Specifically, the identification information of encrypted files is also encrypted, reducing the probability of information leakage during file searching and transmission, and improving the security of file transmission. This embodiment of the invention can use asymmetric encryption to process encrypted files and their identification information. The advantage of this setup is that different keys are used for encryption and decryption, which solves the problem of users still being able to access files after their permissions are revoked, and also ensures that files cannot be tampered with during transmission, improving the reliability of the file transmission process.

[0038] S102. Determine the target encrypted file in the correspondence table between the identification information and the encrypted file based on the identification information.

[0039] The target encrypted file can be understood as the encrypted file corresponding to the identification information of the encrypted file sent by the client.

[0040] In this application, the remote server can be a cloud data terminal. Specifically, the cloud data terminal stores a mapping table between identification information and encrypted files. After receiving the identification information of the encrypted file sent by the client, the encrypted file corresponding to the identification information can be determined by looking up the mapping table.

[0041] In this application, the local server can be the data owner. For example, the mapping table between identification information and encrypted files, and the mapping table between search terms and the identification information of encrypted files, are determined at the data owner's location. The data owner can process the data, for example, encrypting all data files based on the encryption key, determining the index (identification information) and search terms for each encrypted file, generating mapping tables between identification information and encrypted files, and generating mapping tables between search terms and the identification information of encrypted files. The data owner encrypts the generated mapping tables between identification information and encrypted files, and between search terms and the identification information of encrypted files, and then sends the mapping tables between search terms and the identification information of encrypted files to the client and to the cloud data terminal, so that the client can determine the identification information of the encrypted file based on the search terms entered by the user, and the cloud data terminal can determine the target encrypted file based on the identification information sent by the client.

[0042] The advantage of this setting is that it allows for quick retrieval of encrypted files corresponding to the identification information, thereby improving the speed of finding encrypted files and increasing the transmission efficiency of encrypted files.

[0043] The client stores a mapping table between search terms sent by the data owner and the identifier information of encrypted files. When the client receives a search term sent by the user, it only needs to retrieve the identifier information corresponding to the search term from the mapping table, without needing to interact with the data owner. This can reduce network latency and improve access efficiency.

[0044] S103. When it is determined that the user has the right to access the target encrypted file based on the user identifier and the openness level of the target encrypted file, the target encrypted file is sent to the client.

[0045] The openness level of the target encrypted file can be understood as the degree of openness of the target encrypted file. For example, the target encrypted file may be accessible to some users or to all users. The user identifier carries the user's identity information, and based on the user identifier and the openness level of the target encrypted file, it can be determined whether the user can access the target encrypted file.

[0046] For example, when the target encrypted file is accessible to all users, it is assumed that the user has the right to access the target encrypted file; when the target encrypted file is accessible to some users, the user's identifier will be used to determine whether the user has access rights to the target encrypted file, and the target encrypted file will only be sent to the client if the user has access rights.

[0047] The advantage of this setting is that the target encrypted file is only sent to the client when the user has the necessary access permissions, which prevents unauthorized access and ensures that the target encrypted file is not leaked.

[0048] The technical solution of this invention involves receiving the identifier information of the encrypted file corresponding to the search terms sent by the client, and the user identifier; determining the target encrypted file based on the identifier information in a correspondence table between identifier information and encrypted files; and sending the target encrypted file to the client when it is determined that the user has permission to access the target encrypted file based on the user identifier and the access level of the target encrypted file. This method ensures the security of the target encrypted file transmission and improves the reliability of the file transmission process by determining whether the current user has permission to access the target encrypted file based on the access level of the target encrypted file corresponding to the identifier information and the user identifier.

[0049] Example 2

[0050] Figure 2 This is a flowchart illustrating a file transfer method according to Embodiment 2 of the present invention. This embodiment is applicable to situations such as file acquisition. The method can be executed by the file transfer device provided in this embodiment, which can be implemented in hardware and / or software. In a specific embodiment, the device can be integrated into an electronic device. The following embodiments will illustrate this using the integration of the device into an electronic device as an example. (Refer to...) Figure 2 The method specifically includes the following steps:

[0051] S201. Receive the identifier information and user identifier of the encrypted file corresponding to the search terms sent by the client.

[0052] Optionally, before receiving the identifier information of the encrypted file corresponding to the search terms sent by the client and the user identifier, the method further includes: receiving the encrypted file sent by the data owner; when the encrypted file needs to be encrypted a second time, performing secondary encryption on the encrypted file, wherein the encrypted file after secondary encryption contains a secondary encryption identifier.

[0053] The data owner can operate on and query the file. Specifically, after encrypting the file, the data owner sends it to the cloud data terminal. A secondary encryption identifier is used to indicate the encryption status of the encrypted file, such as whether the encrypted file has undergone two encryption operations or has a high encryption level. This embodiment of the invention does not limit this specific behavior.

[0054] The cloud data terminal has a secondary encryption device. When the encrypted file is determined to require special protection based on its confidentiality level, it will be encrypted again to better protect the data carried by the encrypted file.

[0055] The data owner can also encrypt all data files based on the encryption key, determine the index (identification information) and search terms for each encrypted file, generate a correspondence table between identification information and encrypted files, and generate a correspondence table between search terms and the identification information of encrypted files, etc.

[0056] Specifically, the data owner's work includes three parts: initialization, generating a mapping table of identifier information for encrypted files, and generating a mapping table of search terms and identifier information for encrypted files.

[0057] In the initialization section, the data owner sets a set W containing m search terms and randomly generates a key K = (S, M1, M2), where K represents the key, S represents an (m+1)-dimensional binary vector, M1 and M2 represent two (m+1)*(m+1) invertible matrices, and m represents the number of search terms. The data owner then sends (K, sk) to the authenticated user, where K represents the key and sk represents the encryption key for the encrypted file.

[0058] In the section generating the identification information for encrypted files, all files are encrypted based on the encryption key sk. For example, for each file D... j Here, j represents the file number. Each data owner generates a binary vector P, where each bit P[i] represents whether the file contains the search term. If it does, P[i] = 1; otherwise, P[i] = 0. Here, i represents the number of parameters in vector P. Vector P is then expanded into an (m+1)-dimensional vector P', where P'[m+1] = 1. The data owner uses vector S to divide vector P' into two (m+1)-dimensional vectors p. a and p b p a and p b The calculation method is as follows In p a [i] = random∨p b When [i] = random, p a [i]+p b [i] = P'[i], where random is a random value, ∨ represents the "OR" operation, and I is the identifier information of the encrypted file. j =(p a M1,p b M2).

[0059] In the section that generates the mapping table between search terms and the identifier information of encrypted files, the data owner will set three identical search term sets W. a W b and W c These are used to represent the "OR", "AND", and "NOT" operations, respectively. In this embodiment of the invention, the identifier for the "OR" operation is defined as ∨, the identifier for the "AND" operation as ∧, and the identifier for the "NOT" operation as... Therefore, a user's Boolean query can be represented as Select three column vectors These correspond to the search terms "OR", "AND", and "NOT", respectively. based on and Three column vectors define the initial identifier information corresponding to the search terms, and each initial identifier information is a (1*3m) vector.

[0060] Specifically, Table 1 shows the correspondence between the "OR" search term and the identifier information of the encrypted file, Table 2 shows the correspondence between the "AND" search term and the identifier information of the encrypted file, and Table 3 shows the correspondence between the "NOT" search term and the identifier information of the encrypted file.

[0061] Table 1

[0062] "or" search term Initial identification information <![CDATA[W a1 ]]> <![CDATA[Trap a1 =[a1,0......,0]]> ....... ...... <![CDATA[W am ]]> <![CDATA[Trap am =[0,...a m ...0]]]>

[0063] Table 2

[0064] "and" search terms Initial identification information <![CDATA[W b1 ]]> <![CDATA[Trap b1 =[0...b1...0]]]> ....... ...... <![CDATA[W bm ]]> <![CDATA[Trap bm =[0,...b m ...0]]]>

[0065] Table 3

[0066] "Non" search terms Initial identification information <![CDATA[W c1 ]]> <![CDATA[Trap c1 =[0...-c1...0]]]> ....... ...... <![CDATA[W cm ]]> <![CDATA[Trap cm =[0......-c m ]]]>

[0067] The corresponding identifier information for a search term can be quickly determined by using the correspondence table between search terms and the identifier information of encrypted files.

[0068] S202. Determine the target encrypted file in the correspondence table between the identification information and the encrypted file based on the identification information.

[0069] Specifically, the cloud data terminal stores a mapping table between identification information and encrypted files. After receiving the identification information of the encrypted file sent by the client, it matches the identification information with the mapping table between identification information and encrypted files. Based on the matching result, the target encrypted file corresponding to the identification information can be determined.

[0070] S203. Determine the access level of the target encrypted file; determine whether the user has the right to access the target encrypted file based on the user ID and access level; when the user has the right to access the target encrypted file, send the target encrypted file to the client.

[0071] The openness level of the target encrypted file can be understood as the degree of openness of the target encrypted file. For example, the target encrypted file can be accessed by some users (openness level is semi-open), and the target encrypted file can be accessed by all users (openness level is fully open).

[0072] When encrypted files require enhanced protection, they are encrypted a second time. This second-encrypted file is only accessible to a subset of users, not all users. Accordingly, the access level of the target encrypted file is determined as follows: if the target encrypted file contains a second-encryption identifier, its access level is determined to be semi-open; if the target encrypted file does not contain a second-encryption identifier, its access level is determined to be fully open.

[0073] Determining a user's access rights to a target encrypted file based on their user ID and openness level can be understood as determining whether the current user has the right to access the target encrypted file based on the openness level of the target encrypted file and their user ID. Specifically, determining user access rights based on user ID and openness level includes: if the target encrypted file is at a semi-open level and the user ID contains a secondary decryption key, then the user has the right to access the target encrypted file; if the target encrypted file is at a fully open level, then the user has the right to access the target encrypted file.

[0074] The double-encrypted file contains a double-encryption identifier, and the cloud data terminal stores a mapping table between encrypted files and encryption identifiers. After identifying the target encrypted file, the mapping table is searched to determine if the target encrypted file contains a double-encryption identifier. If the target encrypted file does not contain a double-encryption identifier, the user is considered to have access to the target encrypted file. If the target encrypted file contains a double-encryption identifier, the user's access rights are determined by combining this identifier with the user's identifier. For example, if the user's identifier contains information related to the decryption key corresponding to the double-encryption identifier (the double-decryption key), the user is considered to have access to the target encrypted file; if the user's identifier does not contain information related to the decryption key corresponding to the double-encryption identifier, the user is considered not to have access to the target encrypted file.

[0075] For example, the user's access rights to the target encrypted file can also be verified by checking the consistency between the user's identity token and the auxiliary key sent by the data owner.

[0076] When the target encrypted file contains a secondary encryption identifier and the user has the right to access the target encrypted file, the target encrypted file will be decrypted based on the decryption key corresponding to the secondary encryption key, and the decrypted encrypted file will be sent to the client.

[0077] Decryption can be understood as the process of turning ciphertext into plaintext, and secondary decryption can be understood as decrypting the file that has been encrypted twice into the file that was encrypted initially.

[0078] After receiving the encrypted file sent by the cloud data terminal, the client will decrypt the encrypted file based on the decryption key corresponding to the encryption key of the primary encryption, aiming to securely transmit the original data.

[0079] For example, after transmitting an encrypted file, the data owner will re-determine the encryption method and synchronize the encrypted information to the client and cloud data terminal to improve the security and real-time performance of file transmission.

[0080] The technical solution of this invention involves receiving the identifier information of the encrypted file corresponding to the search terms sent by the client and the user identifier; determining the target encrypted file based on the identifier information in a correspondence table between identifier information and encrypted files; determining the access level of the target encrypted file; determining whether the user has permission to access the target encrypted file based on the user identifier and access level; and sending the target encrypted file to the client when the user has permission to access the target encrypted file. This method ensures the security of target encrypted file transmission and improves the reliability of the file transmission process by determining whether the current user has permission to access the target encrypted file based on the access level of the target encrypted file corresponding to the identifier information and the user identifier, and sending the target encrypted file to the client when the user has permission to access the target encrypted file. It also solves the problems of users still being able to access files after their permissions have been revoked and the security risks during access due to network attacks and tampering caused by key leakage.

[0081] Example 3

[0082] Figure 3 A schematic diagram of a file transfer device provided in Embodiment 3 of the present invention. (See attached diagram.) Figure 3 As shown, the device includes: an acquisition module 301, a determination module 302, and an execution module 303.

[0083] The acquisition module 301 is used to receive the identification information of the encrypted file corresponding to the search terms sent by the client and the user identifier.

[0084] The determination module 302 is used to determine the target encrypted file based on the identification information in the correspondence table between identification information and encrypted files.

[0085] Execution module 303 is used to send the target encrypted file to the client when it is determined that the user has the right to access the target encrypted file based on the user identifier and the open level of the target encrypted file.

[0086] Optionally, the acquisition module 301 is also used to receive the encrypted file sent by the data owner before receiving the identification information and user identifier of the encrypted file corresponding to the search term sent by the client; when the encrypted file needs to be encrypted a second time, the encrypted file is encrypted a second time, wherein the encrypted file after the second encryption contains a second encryption identifier.

[0087] Optionally, the determining module 302 is specifically used to match the identification information in the correspondence table between identification information and encrypted files, and determine the target encrypted file corresponding to the identification information based on the matching result.

[0088] Optionally, the execution module 303 is specifically used to determine the openness level of the target encrypted file; determine whether the user has the right to access the target encrypted file based on the user identifier and openness level; and send the target encrypted file to the client when the user has the right to access the target encrypted file.

[0089] Optionally, the execution module 303 is specifically used to determine the open level of the target encrypted file as a semi-open level when the target encrypted file contains a secondary encryption identifier, and to determine the open level of the target encrypted file as a fully open level when the target encrypted file does not contain a secondary encryption identifier.

[0090] Optionally, the execution module 303 is specifically used to determine that the user has the right to access the target encrypted file when the open level of the target encrypted file is semi-open and the user identifier contains a secondary decryption key; and to determine that the user has the right to access the target encrypted file when the open level of the target encrypted file is fully open.

[0091] Optionally, the execution module 303 is further configured to decrypt the target encrypted file based on the decryption key corresponding to the encryption key of the secondary encryption when the target encrypted file contains a secondary encryption identifier and the user has the right to access the target encrypted file.

[0092] The file transfer device provided in the embodiments of the present invention can execute the file transfer method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0093] Example 4

[0094] Figure 4 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0095] like Figure 4As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0096] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0097] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as file transfer methods.

[0098] In some embodiments, the file transfer method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the file transfer method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the file transfer method by any other suitable means (e.g., by means of firmware).

[0099] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0100] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0101] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0102] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0103] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0104] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0105] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0106] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A file transfer method, characterized in that, include: Receive encrypted files sent by the data owner; When the encrypted file needs to be encrypted a second time, the encrypted file is encrypted a second time, wherein the encrypted file after the second encryption contains a second encryption identifier; The system receives the identification information of the encrypted file corresponding to the search terms sent by the client and the user identifier. The identification information is the index of the encrypted file, the storage location of the encrypted file, or the number of the encrypted file. The encrypted file and the identification information are processed by asymmetric encryption. The target encrypted file is determined based on the correspondence between the identification information and the encrypted file in the identification information and encrypted file correspondence table. Determine the openness level of the target encrypted file; Determine whether the user has the right to access the target encrypted file based on the user identifier and the access level; When the user has permission to access the target encrypted file, the target encrypted file is sent to the client; Determining the openness level of the target encrypted file includes: When the target encrypted file contains a secondary encryption identifier, the open level of the target encrypted file is determined to be a semi-open level; When the target encrypted file does not contain a secondary encryption identifier, the open level of the target encrypted file is determined to be a fully open level; The step of determining whether a user has permission to access the target encrypted file based on the user identifier and the access level includes: When the target encrypted file is at a semi-open level and the user identifier contains a secondary decryption key, it is determined that the user has the right to access the target encrypted file. When the target encrypted file is at a fully open level, it is determined that the user has the right to access the target encrypted file.

2. The method according to claim 1, characterized in that, The step of determining the target encrypted file based on the identification information in the correspondence table between identification information and encrypted files includes: In the correspondence table between identification information and encrypted files, the identification information is matched, and the target encrypted file corresponding to the identification information is determined based on the matching result.

3. The method according to claim 1, characterized in that, Also includes: When the target encrypted file contains a secondary encryption identifier and the user has the right to access the target encrypted file, the target encrypted file is decrypted based on the decryption key corresponding to the encryption key of the secondary encryption.

4. A file transfer device, characterized in that, include: The acquisition module is used to receive encrypted files sent by the data owner; When the encrypted file needs to be encrypted a second time, the encrypted file is encrypted a second time, wherein the encrypted file after the second encryption contains a second encryption identifier; The acquisition module is used to receive the identification information of the encrypted file and the user identifier corresponding to the search terms sent by the client. The identification information is the index of the encrypted file, the storage location of the encrypted file, or the number of the encrypted file. The encrypted file and the identification information are processed by asymmetric encryption. The determination module is used to determine the target encrypted file based on the identification information in the correspondence table between identification information and encrypted files; An execution module is used to determine the access level of the target encrypted file; determine whether the user has the right to access the target encrypted file based on the user identifier and the access level; and when the user has the right to access the target encrypted file, send the target encrypted file to the client. The execution module is specifically configured to: determine the open level of the target encrypted file as a semi-open level when the target encrypted file contains a secondary encryption identifier; and determine the open level of the target encrypted file as a fully open level when the target encrypted file does not contain a secondary encryption identifier. The execution module is specifically configured to: determine that the user has the right to access the target encrypted file when the open level of the target encrypted file is semi-open and the user identifier contains a secondary decryption key; and determine that the user has the right to access the target encrypted file when the open level of the target encrypted file is fully open.

5. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to said at least one processor; The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform the file transfer method according to any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the file transfer method according to any one of claims 1-3.

Images