File processing method, device, computer equipment and computer program product

Abstract

The present application provides a file processing method, apparatus, computer device, and computer program product, wherein a first encrypted file is stored on a server after encrypting a target file using a first key. The first encrypted file is generated based on a trigger of a first object. The method includes: if the sharing object is a first object logged in on a second client, the first key is encrypted using the public key of the first object to obtain a first encryption key and sent to the server so that the second client can obtain the target file; if the sharing object is a second object logged in on the second client, the target file is encrypted using the second key to obtain a second encrypted file, the second key is encrypted using the public key of the second object to obtain a second encryption key, and the second encrypted file and the second encryption key are sent to the server so that the second client can obtain the target file. This method can improve the security of file sharing and the efficiency of file acquisition.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a file processing method, a file processing apparatus, a computer device, and a computer program product. Background Art

[0002] Currently, when sharing files through the cloud, one method is to directly upload the file to the cloud so that the file requesting party can directly download the file from the cloud, but this method has the problem of low file security; the other method is to only encrypt the file and upload it to the cloud so that the file requesting party can download the file from the cloud and then decrypt it. Although this method improves the security of the file to a certain extent, it is also easy to be cracked and the problem of low file security still exists. Summary of the Invention

[0003] The embodiments of the present application provide a file processing method, apparatus, computer equipment, and computer program product, which can effectively improve the security of file sharing and the efficiency of file acquisition.

[0004] In one aspect, an embodiment of the present application provides a file processing method for processing a target file, wherein a first encrypted file obtained by encrypting the target file using a first key is stored in a server, wherein the first encrypted file is generated based on a trigger of a first object logged in on a first client, and the method includes:

[0005] receiving a sharing operation on the target file;

[0006] If the object of the sharing operation is the first object logged in on the second client, obtaining the first key, encrypting the first key using the public key of the first object on the second client to obtain a first encryption key, and sending the first encryption key to the server so that the second client can obtain the target file;

[0007] If the sharing object of the sharing operation is a second object logged in on the second client, the target file is obtained, the target file is encrypted using the second key to obtain a second encrypted file, the second key is encrypted using the public key of the second object on the second client to obtain a second encryption key, and the second encrypted file and the second encryption key are sent to the server so that the second client can obtain the target file.

[0008] In one aspect, an embodiment of the present application provides another file processing method, the method being used to process a target file, wherein a first encrypted file obtained by encrypting the target file using a first key is stored in a server, wherein the first encrypted file is generated based on a trigger of a first object logged in on a first client, the method comprising:

[0009] Obtaining file decryption related information about the target file from the server;

[0010] If the file decryption related information includes the first encrypted file and a first encryption key, obtaining the target file based on the first encrypted file and the first encryption key; wherein the first encryption key is obtained by encrypting the first key using the public key of the first object on the second client when the first client performs a sharing operation on the target file and the first object is logged in on the second client, and then sending the first key to the server;

[0011] If the file decryption-related information includes a second encrypted file and a second encryption key, the target file is obtained based on the second encrypted file and the second encryption key; wherein, the second encrypted file and the second encryption key are generated and sent to the server by the first client when the sharing object of the sharing operation on the target file is the second object logged in on the second client, the second encrypted file is obtained by encrypting the target file using the second key, and the second encryption key is obtained by encrypting the second key using the public key of the second object on the second client.

[0012] In one aspect, an embodiment of the present application provides a file processing device, the device being configured to process a target file, encrypt the target file using a first key to obtain a first encrypted file, and store the resultant encrypted file in a server, wherein the first encrypted file is generated based on a trigger of a first object logged in on a first client, the device comprising:

[0013] a processing unit, configured to receive a sharing operation on the target file;

[0014] The processing unit is further configured to obtain the first key if the object of the sharing operation is the first object logged in on the second client, and encrypt the first key using the public key of the first object on the second client to obtain a first encryption key;

[0015] a communication unit, configured to send the first encryption key to the server so that the second client can obtain the target file;

[0016] The processing unit is further configured to, if the sharing object of the sharing operation is a second object logged in on the second client, obtain the target file, encrypt the target file using the second key to obtain a second encrypted file, and encrypt the second key using the public key of the second object on the second client to obtain a second encryption key;

[0017] The communication unit is further configured to send the second encrypted file and the second encryption key to the server, so that the second client can obtain the target file.

[0018] In one embodiment, when the processing unit obtains the target file, it is specifically configured to: obtain the first key and the first encrypted file from the server; and decrypt the first encrypted file using the first key to obtain the target file.

[0019] In one embodiment, the third encryption key obtained by encrypting the first key using the public key of the first object on the first client is stored in the server. When the processing unit obtains the first key, it is specifically used to: obtain the third encryption key from the server; and decrypt the third encryption key using the private key of the first object on the first client to obtain the first key.

[0020] In one embodiment, when the processing unit uses the second key to encrypt the target file to obtain a second encrypted file, it is specifically used to: obtain a first watermark identifier and add the first watermark identifier to the target file; use the second key to encrypt the target file with the first watermark identifier to obtain a second encrypted file; wherein, the first watermark identifier is used to indicate that the target file is triggered to be shared based on the first object logged in on the first client; the second client obtains the target file with the first watermark identifier.

[0021] In one embodiment, the communication unit is further configured to receive a source file sent by a third client;

[0022] The processing unit is further used to add a second watermark identifier to the source file based on the trigger of the first object logged in on the first client to obtain the target file, and to encrypt the target file using the first key to obtain the first encrypted file; and store the first encrypted file to the server; wherein the second watermark identifier is used to indicate that the target file is generated based on the trigger of the first object logged in on the first client.

[0023] In one embodiment, the source file carries a third watermark identifier, and the third watermark identifier is used to indicate that the source file is shared based on a third object logged in on the third client.

[0024] In one aspect, an embodiment of the present application provides another file processing device, the device being configured to process a target file, encrypt the target file using a first key to obtain a first encrypted file, and store the resultant encrypted file in a server, wherein the first encrypted file is generated based on a trigger of a first object logged in on a first client, the device comprising:

[0025] A communication unit, configured to obtain file decryption related information about the target file from the server;

[0026] a processing unit configured to, if the file decryption-related information includes the first encrypted file and a first encryption key, obtain the target file based on the first encrypted file and the first encryption key; wherein the first encryption key is obtained by encrypting the first key using the public key of the first object on the second client when the first client performs a sharing operation on the target file with the first object logged in on the second client, and then sending the first encryption key to the server;

[0027] The processing unit is further configured to obtain the target file based on a second encrypted file and a second encryption key if the file decryption-related information includes a second encrypted file and a second encryption key; wherein the second encrypted file and the second encryption key are generated and sent to the server by the first client when the sharing object of the sharing operation on the target file is a second object logged in on the second client, the second encrypted file is obtained by encrypting the target file using the second key, and the second encryption key is obtained by encrypting the second key using the public key of the second object on the second client.

[0028] In one embodiment, when the processing unit obtains the target file based on the first encrypted file and the first encryption key, it is specifically used to: use the private key of the first object on the second client to decrypt the first encryption key to obtain the first key; use the first key to decrypt the first encrypted file to obtain the target file.

[0029] In one embodiment, when the processing unit obtains the target file based on the second encrypted file and the second encryption key, it is specifically used to: use the private key of the second object on the second client to decrypt the second encryption key to obtain the second key; use the second key to decrypt the second encrypted file to obtain the target file.

[0030] In one embodiment, the second encrypted file is obtained by the first client adding a first watermark to the target file and encrypting the target file with the first watermark using the second key; wherein the first watermark is used to indicate that the target file is shared based on the first object logged in on the first client; the second client decrypts the second encrypted file using the second key to obtain the target file with the first watermark.

[0031] In one embodiment, the target file is obtained by the first client obtaining the first key, obtaining the first encrypted file from the server, and decrypting the first encrypted file using the first key; the third encryption key obtained by encrypting the first key using the public key of the first object on the first client is stored in the server, and the first key is obtained by the first client obtaining the third encryption key from the server and decrypting the third encryption key using the private key of the first object on the first client.

[0032] In one embodiment, the first encrypted file is a source file received by the first client from a third client, the target file is obtained by adding a second watermark to the source file based on the trigger of the first object logged in on the first client, and the target file is encrypted using the first key and stored on the server; wherein the second watermark is used to indicate that the target file is generated based on the trigger of the first object logged in on the first client.

[0033] In one embodiment, the source file carries a third watermark identifier, and the third watermark identifier is used to indicate that the source file is shared based on a third object logged in on the third client.

[0034] On the one hand, an embodiment of the present application provides a computer device, comprising: a processor, a communication interface and a memory, wherein the processor, the communication interface and the memory are interconnected, wherein the memory stores executable program code, and the processor is used to call the executable program code to execute the file processing method provided by the embodiment of the present application.

[0035] Accordingly, an embodiment of the present application further provides a computer-readable storage medium, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer executes the file processing method provided by the embodiment of the present application.

[0036] Accordingly, an embodiment of the present application further provides a computer program product, which includes a computer program or computer instructions, and when the computer program or computer instructions are executed by a processor, the steps of the file processing method provided in the embodiment of the present application are implemented.

[0037] Accordingly, an embodiment of the present application also provides a computer program, which includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. The processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the file processing method provided by the embodiment of the present application.

[0038] According to the embodiment of the application, when a target file is shared, not only the target file is encrypted, but also the key used to encrypt the target file (hereinafter referred to as the file key) is encrypted. This dual encryption mechanism can effectively ensure the security of the target file. In addition, the key used to encrypt the file key is the public key corresponding to the sharing object. Only by using the private key corresponding to the sharing object can the encryption key be successfully decrypted to obtain the file key of the target file, which can further improve the security of the target file. On the other hand, the encryption key and the encrypted file can be automatically decrypted to obtain the target file, which can effectively improve the efficiency of obtaining the target file. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0040] Figure 1 This is a schematic diagram of the architecture of a file processing system provided by an embodiment of the present application;

[0041] Figure 2 This is a flowchart of a file processing method provided by an embodiment of the present application;

[0042] Figure 3 This is a flowchart of another file processing method provided by an embodiment of the present application;

[0043] Figure 4 A technical architecture applicable to the file processing method provided in the embodiment of the present application is shown;

[0044] Figure 5 It shows the encryption and decryption process of keys and files;

[0045] Figure 6 This is a structural diagram of a file processing device provided in an embodiment of the present application;

[0046] Figure 7 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0048] To better understand the embodiments of the present application, some terms involved in the embodiments of the present application are introduced below:

[0049] Public key and private key: Asymmetric cryptography requires two keys: a public key (i.e., public key) and a private key (i.e., private key). The public key is used for encryption, while the private key is used for decryption. The ciphertext generated by encrypting plaintext with the public key can only be decrypted using the corresponding private key to obtain the original plaintext. The public key used to encrypt the plaintext cannot be used to decrypt the original plaintext. The public key can be made public, but the private key cannot. If the private key is leaked, the public and private key pair must be updated to prevent confidentiality.

[0050] The embodiment of the present application provides a file processing method to effectively improve the security of file sharing and effectively improve the efficiency of file acquisition. The file processing method provided in the embodiment of the present application can be implemented based on one or more of cloud technology, artificial intelligence technology and blockchain technology. For example, it may involve one or more of cloud storage and cloud database in cloud technology. For example, at least part of the data involved in executing the file processing method (such as encrypted files, encryption keys, etc.) is stored in a cloud database. For another example, at least part of the data involved in executing the file processing method can be stored in the form of blocks on the blockchain; in addition, the computer device that executes the file processing method can be a node device in the blockchain network.

[0051] The file processing method provided in the embodiment of the present application can be applied to Figure 1The file processing system shown includes a server 10, a first client 11, and one or more second clients 12. In a feasible embodiment, the file processing system may also include a third client 13. The server 10 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It may also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The client may be a terminal device such as a smartphone, tablet computer, laptop computer, desktop computer, intelligent voice interaction device, smart home appliance, vehicle-mounted terminal, etc., but is not limited thereto.

[0052] For clients in the file processing system (including the first client 11, the second client 12, the third client 13, and so on), an object can be logged in on the client. This object can be an account or account number that identifies the client user. For each object, its private key and public key are different on different clients; and different objects on the same client also have different private keys and public keys. The public key is used for encryption, and the corresponding private key is used for decryption. While public keys can be made public, private keys cannot. The server 10 can record the public key of each object on each client to facilitate quick access to the required public key.

[0053] In the embodiment of the present application, the first client 11 shares the target file with the second client 12 through the server 10 as an example. The first client 11 needs to encrypt the target file in advance and store it in the server 10. Figure 2 In the processing flow shown, the first client 11 obtains the target file and generates a first key based on the trigger of the first object logged in on its device, encrypts the target file using the first key to obtain a first encrypted file; and then sends the first encrypted file to the server 10 for storage.

[0054] In a feasible embodiment, the target file can be a local file of the first client 11, or a source file sent by the third client 13 and received by the first client 11. The target file can also be obtained by adding a second watermark identifier to the source file after the first client 11 receives the source file sent by the third client 13. The second watermark identifier can be used to indicate that the target file is generated based on the first object logged in on the first client 11. In a feasible implementation, the source file can also carry a third watermark identifier, which is used to indicate that the source file is shared based on the third object logged in on the third client 13. Adding a watermark identifier to the file is conducive to subsequent querying the source of the file and facilitating the subsequent determination of the file transmission path. The watermark identifier can include one or more of the following: client identifier (such as a physical address), object identifier (such as the account or name indicated by the object, etc.), and the type of operation on the file (such as generating a file is indicated by the identifier "0" and sharing a file is indicated by the identifier "1"), etc.

[0055] In a feasible embodiment, the first key may be a key randomly generated by the first client 11 for encrypting files. The key needs to meet specific conditions and / or specific rules. Satisfying the specific conditions may include one or more of the following: the key has a set number of bits (e.g., 10 bits), includes at least one or more set character types (e.g., includes both numbers and letters), etc. Satisfying the specific rules includes performing a hash operation on the randomly generated key characters to obtain the final key.

[0056] In one embodiment, if Figure 2 In the processing flow shown, the first client 11 can also obtain the public key of the first object on the first client 11, use the public key of the first object on the first client 11 to encrypt the first key to obtain a third encryption key, and then send the third encryption key to the server 10; the server 10 maps and stores the third encryption key and the first encrypted file.

[0057] In a feasible embodiment, after the target file is stored on the server as a first encrypted file, the first client 11 can retrieve the target file based on the first encrypted file stored on the server. Therefore, the first client 11 no longer needs to store the target file locally. This not only saves the first client's storage space, but also prevents malicious attempts to obtain the target file directly from the first client 11, thereby improving the security of the target file. Similarly, after the first key is stored on the server as a third encrypted key, the first client can retrieve the first key based on the third encrypted key stored on the server. Therefore, the first client 11 no longer needs to store the first key locally. This prevents malicious attempts to obtain the first key directly from the first client 11 and decrypt the target file, further improving the security of the target file and further saving storage space on the first client. It should be noted that, similarly, the first client 11 does not need to store the first encrypted file and the third encryption key locally.

[0058] In the embodiment of the present application, during the process of first client 11 sharing a target file with second client 12 via server 10, first client 11 receives a sharing operation regarding the target file. Depending on the sharing object of the sharing operation, the first client 11 shares the target file with second client 12 via server 10 in different ways, including the following two ways:

[0059] In the first method, the sharing object of the sharing operation is the first object logged in on the second client 12 , that is, in this scenario, users corresponding to the same object synchronize target files on different clients.

[0060] At this point, the first client 11 obtains the first key and the public key of the first object on the second client from the server 10. It encrypts the first key using the public key of the first object on the second client to obtain a first encryption key, and then sends the first encryption key to the server 10. Correspondingly, the second client 12 obtains file decryption-related information about the target file from the server 10, which includes the first encrypted file and the first encryption key. It decrypts the first encryption key using the private key of the first object on the second client to obtain the first key, and then decrypts the first encrypted file using the first key to obtain the target file.

[0061] In the second mode, the sharing object of the sharing operation is the second object logged in on the second client 12 (the second object is different from the first object). That is, in this scenario, different users corresponding to different objects synchronize target files on different clients.

[0062] At this point, first client 11 obtains the target file and generates a second key. Similar to the first key described above, the second key can be a key randomly generated by first client 11 for encrypting files, and the second key is different from the first key described above. First client 11 encrypts the target file using the second key to obtain a second encrypted file. It then encrypts the second key using the public key of the second object on second client 12 to obtain a second encryption key, and then sends the second encrypted file and the second encryption key to server 10. Accordingly, second client 12 obtains file decryption-related information about the target file from server 10, including the second encrypted file and the second encryption key. It then decrypts the second encryption key using the private key of the second object on the second client to obtain the second key. It then decrypts the second encrypted file using the second key to obtain the target file.

[0063] Using the above-described file processing method, on the one hand, when sharing a target file, not only is the target file encrypted, but the key used to encrypt the target file (hereinafter referred to as the file key) is also encrypted. This dual encryption mechanism effectively ensures the security of the target file. Furthermore, the key used to encrypt the file key is the public key corresponding to the sharing object. Only the private key corresponding to the sharing object can successfully decrypt the encryption key to obtain the file key of the target file, which further improves the security of the target file. Furthermore, the encryption key and encrypted file can be automatically decrypted to obtain the target file, which effectively improves the efficiency of obtaining the target file.

[0064] The above briefly introduces the file processing method provided in the embodiment of the present application. The specific implementation of the file processing method is described in detail below.

[0065] See also Figure 3 , Figure 3 The file processing method described in the embodiment of the present application can be applied to Figure 1The file processing system shown. The file processing method is used to process the target file. As mentioned above, the first encrypted file obtained by encrypting the target file with the first key can be stored in the server. The first encrypted file is generated based on the trigger of the first object logged in on the first client. In a feasible embodiment, the third encryption key obtained by encrypting the first key with the public key of the first object on the first client can also be stored in the server. In addition, for each object, its private key and public key on different clients are different; and the private key and public key of different objects on the same client are also different. The public key is used for encryption, and the corresponding private key is used for decryption; and the public key can be made public, but the private key cannot be made public. The server can record the public key of each object on each client to facilitate quick acquisition of the required public key. The method includes but is not limited to the following steps:

[0066] S301: A first client receives a sharing operation on a target file.

[0067] In an embodiment of the present application, the sharing operation on the target file may be triggered by the first object logged in on the first client. For example, when the user of the first client (i.e., the user corresponding to the first object) wants to share the target file with the user of the second client, the sharing operation on the target file may be actively triggered based on the first object logged in on the first client. The sharing operation on the target file may also be triggered by an object (the object may be the above-mentioned first object or a second object different from the above-mentioned first object) logged in on the second client (the second client is different from the first client). For example, when the second client needs to request the target file from the first client, the second client sends a sharing request for the target file to the first client based on the triggering of the object logged in on the second client. After receiving the sharing request, the first client determines that it has received the sharing operation on the target file.

[0068] In a feasible embodiment, after the first client receives a sharing operation on the target file, it determines the sharing object of the sharing operation and determines whether to share the target file with the sharing object. For example, it detects whether the sharing object exists in the shareable list of the target file. If so, it is determined that the target file can be shared with the sharing object. Otherwise, it is determined that the target file cannot be shared with the sharing object. For another example, the file sharing prompt information including the identifier corresponding to the sharing object (such as an account number or account name) is output. If a confirmation sharing instruction input by the user for the sharing prompt information is received, it is determined that the target file is shared with the sharing object. If a refusal sharing instruction input by the user for the sharing prompt information is received, it is determined that the target file is not shared with the sharing object. If the first client determines to share the target file with the sharing object, steps S302 to S307 are executed; if the first client determines not to share the target file with the sharing object, the process ends.

[0069] S302: If the sharing object of the sharing operation is the first object logged in on the second client, the first client obtains a first key, and encrypts the first key using the public key of the first object on the second client to obtain a first encryption key.

[0070] In an embodiment of the present application, if the sharing object of the sharing operation is the above-mentioned first object logged in on the second client, it indicates that the application scenario at this time is that the user corresponding to the same object synchronizes the target file on different clients, for example, user A synchronizes the file on his computer to his mobile phone.

[0071] In one embodiment, a third encryption key is obtained by encrypting the first key using the public key of the first object on the first client and stored on the server. After the first key is stored on the server in the form of the third encryption key, the first client can obtain the first key based on the third encryption key stored on the server. At this time, to ensure security and save storage space, the first client may no longer store the first key and the third encryption key locally. In this case, when the first client shares the target file, it needs to first obtain the third encryption key from the server and use the private key of the first object on the first client to decrypt the third encryption key to obtain the first key. It should be noted that if the first client has the first key or the third encryption key stored locally, it can directly obtain the first key based on the locally stored key.

[0072] The first client obtains the public key of the first object on the second client from the server, and encrypts the first key using the public key of the first object on the second client to obtain a first encryption key.

[0073] S303: The first client sends the first encryption key to the server.

[0074] Accordingly, the server receives and stores the first encryption key sent by the first client. In a feasible embodiment, to ensure security and save storage space, the first client may no longer store the first encryption key locally after sending the first encryption key to the server.

[0075] If the sharing operation of the target file is triggered by the first object logged in on the first client, the first client can send a forwarding request for the target file to the server when sending the first encryption key to the server; the server responds to the forwarding request and sends the first encrypted file and the first encryption key to the second client.

[0076] If the target file sharing operation is triggered by an object logged in on the second client, and the second client sends the target file sharing request to the first client through the server, then the server can automatically send the first encrypted file and the first encryption key to the second client after receiving the first encryption key. If the second client does not send the target file sharing request to the first client through the server, then the second client needs to request the target file from the server multiple times (e.g., periodically). After receiving the first encryption key, the server can respond to the second client's request and send the first encrypted file and the first encryption key to the second client.

[0077] S304: If the file decryption-related information about the target file obtained from the server includes the first encrypted file and the first encryption key, the second client obtains the target file based on the first encrypted file and the first encryption key.

[0078] In an embodiment of the present application, the second client uses the private key of the first object on the second client to decrypt the first encryption key to obtain the first key, and then uses the first key to decrypt the first encrypted file to obtain the target file.

[0079] In the file sharing method described in steps S302 to S304, the first encrypted file previously uploaded to the server by the first client is shared with the second client, as well as the first key previously used by the first client to encrypt the target file. However, the file is encrypted using the public key of the shared object on the second client. This dual encryption mechanism can effectively ensure the security of the target file. In addition, only the private key corresponding to the shared object can be used to successfully decrypt the encryption key to obtain the file key (i.e., the first key) of the target file, which can further improve the security of the target file. On the other hand, the file receiving end (i.e., the second client) can automatically decrypt the encryption key and the encrypted file to obtain the target file, which can effectively improve the efficiency of obtaining the target file.

[0080] S305. If the sharing object of the above-mentioned sharing operation is a second object logged in on the second client, the first client obtains the target file, encrypts the target file using the second key to obtain a second encrypted file, and encrypts the second key using the public key of the second object on the second client to obtain a second encryption key.

[0081] In an embodiment of the present application, if the sharing object of the sharing operation is a second object logged in on a second client (the second object is different from the first object mentioned above), it indicates that the application scenario at this time is that different users corresponding to different objects synchronize target files on different clients. For example, user A synchronizes the files on his mobile phone to the mobile phone of user B.

[0082] In one embodiment, the first encrypted file obtained by encrypting the target file using the first key is stored in the server. After the target file is stored in the server in the form of the first encrypted file, the first client can obtain the target file based on the first encrypted file stored on the server. At this time, in order to ensure security and save storage space, the first client can no longer store the target file and the first encrypted file locally. In this case, when the first client shares the target file, it needs to first obtain the first encrypted file and the first key from the server (the method for obtaining the first key can be referred to the previous description and will not be repeated here), and then use the first key to decrypt the first encrypted file to obtain the target file. It should be noted that if the first client has the target file or the first encrypted file stored locally, it can directly obtain the target file based on the locally stored file.

[0083] The first client generates a second key. The second key can be a key randomly generated by the first client 11 for encrypting files. The second key is different from the first key. The second key also needs to meet specific conditions and / or specific rules. Meeting the specific conditions may include one or more of the following: the number of key bits is a set number of bits (such as 10 bits), at least one or more set character types are included (such as the need to include both numbers and letters), etc. Meeting the specific rules includes the need to perform a hash operation on the randomly generated key characters to obtain the final key. The first client then uses the second key to encrypt the target file to obtain a second encrypted file, obtains the public key of the second object on the second client from the server, and uses the public key of the second object on the second client to encrypt the second key to obtain the second encryption key.

[0084] In a feasible embodiment, when the first client generates the second encrypted file, it can first generate a first watermark identifier and add the first watermark identifier to the target file. Adding a watermark identifier to the file is conducive to subsequent inquiries about the source of the file and to subsequent determination of the file's transmission path. The first watermark identifier can be used to indicate that the target file is shared based on the first object logged in on the first client; the watermark identifier may include one or more of the following: client identifier (such as a physical address), object identifier (such as an account or name indicated by the object, etc.), and the type of operation for the file (such as generating a file with identifier "0" and sharing a file with identifier "1"), etc. The target file with the first watermark identifier is then encrypted using the second key to obtain a second encrypted file.

[0085] S306: The first client sends the second encrypted file and the second encryption key to the server.

[0086] Accordingly, the server receives and stores the second encrypted file and the second encryption key sent by the first client. In a feasible embodiment, to ensure security and save storage space, the first client may no longer store the second encrypted file and the second encryption key locally after sending them to the server.

[0087] If the sharing operation of the target file is triggered by the first object logged in on the first client, the first client can send a forwarding request for the target file to the server when sending the second encrypted file and the second encryption key to the server; the server responds to the forwarding request and sends the second encrypted file and the second encryption key to the second client.

[0088] If the target file sharing operation is triggered by an object logged in on the second client, and the second client sends the target file sharing request to the first client through the server, then the server can automatically send the second encrypted file and the second encryption key to the second client after receiving the second encrypted file and the second encryption key. If the second client does not send the target file sharing request to the first client through the server, then the second client needs to request the target file from the server multiple times (e.g., periodically). After receiving the second encrypted file and the second encryption key, the server can respond to the second client's request and send the second encrypted file and the second encryption key to the second client.

[0089] S307: If the file decryption-related information about the target file obtained from the server includes the second encrypted file and the second encryption key, the second client obtains the target file based on the second encrypted file and the second encryption key.

[0090] In an embodiment of the present application, the second client uses the private key of the second object on the second client to decrypt the second encryption key to obtain the second key, and then uses the second key to decrypt the second encrypted file to obtain the target file. It should be noted that when the second encrypted file is obtained by encrypting the target file with the first watermark added using the second key, the second client obtains the target file with the first watermark added. Based on the first watermark, it can be determined that the obtained target file was shared based on the first object logged in on the first client, so that the file can be traced back.

[0091] In the file sharing method described in steps S305 to S307, the first encrypted file uploaded to the server in advance by the first client and the first key used in advance by the first client to encrypt the target file are not shared with the second client. Instead, the new key used to re-encrypt the target file and the target file encrypted with the new key are shared with the second client. In this way, when sharing the file with other objects (i.e., different from the first object), only the specific content of the file is shared, and the original encrypted file, file key and encryption key are not shared, which increases the file security.

[0092] In a feasible embodiment, if the sharing object of the above-mentioned sharing operation is the second object logged in on the second client, the first client can also obtain the target file, and add a watermark to the target file and send it to the second client. The watermark can be used to indicate that the target file is triggered to be shared based on the first object logged in on the first client. The second client generates a random key, encrypts the random key with the public key of the second object on the second client, and sends it to the server for storage. The second client adds a watermark to the target file again and encrypts it with a random key, and sends the encrypted target file to the server for storage. The watermark added again is used to indicate that the target file is triggered to be generated and stored based on the second object logged in on the second client. In this way, it is beneficial for the second client to directly obtain the target file from the server in the future, and it is also beneficial for the second client to share the target file with other clients (the sharing method can be referred to the previous description, which will not be repeated here). Compared with only being able to share the target file based on the first client, the sharing source of the target file can be increased, thereby speeding up the sharing efficiency of the target file.

[0093] Furthermore, the watermarks added to target files at each stage can be used to trace their origins, providing a basis for accountability in the event of a file leak. To facilitate querying, the watermarks added to target files at each stage can be mapped and stored on the server. The server can store the corresponding relationships between the watermark, time, file sender, and file recipient.

[0094] It should be noted that the implementation methods not fully described in this embodiment can be referred to the previous description and will not be repeated here. In addition, in the case where the sharing object is the first object logged in on the second client, a file sharing method similar to that described in steps S305 to S307 can also be used to achieve the sharing of the target file, which will not be repeated here. Similarly, in the case where the sharing object is the second object logged in on the second client, a file sharing method similar to that described in steps S302 to S304 can also be used to achieve the sharing of the target file, which will not be repeated here.

[0095] See Figure 4 , Figure 4 FIG. 1 shows a technical architecture applicable to the file processing method provided in the embodiment of the present application. Figure 4 As shown: Each object (used to identify the user of the client, which can be an account or account number) has a private key and a public key on each client (the public key is not shown in the figure), and the public key of each object on each client is also stored on the server; each encrypted file corresponds to an encryption key (obtained by encrypting the key used to encrypt the file).

[0096] Before sharing files, you need to upload the file to the server. For user 1 (the user of the first object logged in on client 1) to upload a new file to the server on client 1, there are the following steps: client 1 generates a random key A, which will not be recorded in the form of a file and will be deleted after use; the random key A is encrypted with the public key1 of the first object (or user 1) on client 1 to generate the encryption key a (this process is as follows Figure 5 The encryption key a is then uploaded to the server for storage. Client 1 adds a watermark identifier of the first object to the file file (the watermark identifier can be a random string, or can include the identifier of the first object and / or client 1), and symmetrically encrypts the watermarked file file with the random key A to generate the encrypted file a (this process is shown in Figure 5 As shown in process c in the figure), the encrypted file a is then uploaded to the server for storage, and the watermark identifier can also be uploaded to the server for recording, and the encrypted file, watermark identifier, first object and / or identifier of client 1 can be mapped and stored.

[0097] For obtaining files from the server, the following situations are included:

[0098] In case 1, user 1 downloads the file file that he just uploaded on client 1. The following steps are involved:

[0099] Client 1 downloads the encrypted file a and encryption key a from the server, and decrypts the encryption key a using the private key private key1 (corresponding to public key1) of the first object on client 1 to obtain the random key A (this process is as follows Figure 5 Similarly, random key A will not be saved to client 1, but will only exist in the memory when the program is running. Client 1 uses random key A to decrypt the encrypted file a and obtain the file file with the watermark (this process is shown in Figure 5 In a feasible embodiment, the actual content of the file does not appear in the client 1 as a file entity, but the file and the watermark are displayed to the user through the client software, and the watermark is written in the file.

[0100] If there is a subsequent file write operation, Client 1 will re-encrypt the file (this process can be referred to the previous description) and then upload it to the server. If the file is leaked during this process, the watermark can be used to identify the user who leaked the file.

[0101] In case 2, user 1 corresponding to the first object synchronizes file file on different clients. In this case, random key A and encrypted file a can be shared, but encryption key a is not shared. The following steps are involved:

[0102] When user 1 wants to synchronize file file with client 2, client 2 first requests permission to synchronize file file with client 1, which already has file file. Upon receiving the request, if client 1 determines that synchronization of file file is not permitted, the process terminates. If synchronization of file file is permitted, client 1 requests the public key public key2 of the first object on client 2 from the server. Client 1 uses the private key private key1 of the first object on client 1 to unlock encryption key a, obtaining random key A. It then encrypts random key A with public key2 to obtain encryption key b, which it then uploads to the server. Client 2 then synchronizes encrypted file a and encryption key b from the server to its local computer. Using a similar method as described in scenario 1 above, client 2 decrypts the file and can then open and view file file.

[0103] In case 3, user 1 corresponding to the first object synchronizes file file with user 2 corresponding to the second object. In this case, only the specific content of file file can be shared without sharing the encryption file a, random key A, and encryption key a). There are two ways to do this:

[0104] In method 1, when user 1 shares file file with user 2 on client 2 via client 1, client 1 first obtains the public key public key 3 of the second object on client 2 from the server. Client 1 generates a random key B corresponding to the second object, which is used to symmetrically encrypt the file. Client 1 encrypts random key B with public key 3 to generate encryption key c, which is then uploaded to the server. Client 1 obtains file file using the method described in case 1 above, adds a watermark corresponding to the second object (or user 2), encrypts file file with random key B to obtain encrypted file b, and then uploads encrypted file b to the server. Client 2 downloads encrypted file b and encryption key c from the server and decrypts the file using a similar method as described in case 1 above to open and view file file.

[0105] In a feasible embodiment, when it is unknown which client the second subject is logged in from, or the second subject is offline (or not logged in), the public keys of the second subject on each client can be obtained from the server. Then, based on each public key, the encryption key and encrypted file corresponding to each client are generated using the method described above and uploaded to the server. Regardless of which client the second subject subsequently logs in from, the file can be successfully retrieved based on the corresponding encryption key and encrypted file stored on the server. Using this method, file sharing can be achieved even when the second subject is offline.

[0106] Method 2: When user 1 shares file file with user 2 on client 2 through client 1, client 1 notifies client 2 that user 1 (or the first object) wants to share a file with user 2. Client 2 generates a random key C and encrypts the random key C with the public key of the second object on client 2 to generate an encryption key d, and then uploads the encryption key d to the server. Client 1 obtains file file using the method described in case 1 above, adds the watermark corresponding to the first object to file file, and sends it to client 2. After receiving the file, client 2 appends the watermark of the second object, encrypts the file with the random key C, and uploads it to the server. In this case, after the client uploads the encryption key and encrypted file to the server, it can no longer store file file, encryption key, encrypted file, etc. locally. When file file needs to be viewed later, the method described above can be used to obtain file file from the server.

[0107] By adopting the file processing method provided by the embodiment of the present application, only the encrypted file and encryption key of the target file, as well as the public key of each object on each client are saved on the server. On the server, all clients cannot obtain the original information of the target file; when the target file is shared, a watermark mark indicating the sharing information will be written in the file, which can be used to track the file sharing link and solve the tracking problem of the shared file. In addition, on the one hand, when the target file is shared, not only the target file will be encrypted, but also the key used to encrypt the target file (hereinafter referred to as the file key) will be encrypted. Such a double encryption mechanism can effectively ensure the security of the target file; in addition, the key used to encrypt the file key is the public key corresponding to the shared object. Only by using the private key corresponding to the shared object can the encryption key be successfully decrypted to obtain the file key of the target file, which can further improve the security of the target file. On the other hand, the encryption key and the encrypted file can be automatically decrypted to obtain the target file, which can effectively improve the efficiency of obtaining the target file.

[0108] It should be noted that the execution entity for executing each step in the above method embodiment may be composed of hardware, software, or a combination of hardware and software.

[0109] See also Figure 6 , Figure 6 A schematic diagram of the structure of a file processing device provided in an embodiment of the present application. The file processing device described in the embodiment of the present application is used to process a target file, encrypt the target file using a first key to obtain a first encrypted file, and store it on a server. The first encrypted file is generated based on a first object logged in on a first client. The device may correspond to the first client described above and include:

[0110] The processing unit 601 is configured to receive a sharing operation on the target file;

[0111] The processing unit 601 is further configured to obtain the first key if the object of the sharing operation is the first object logged in on the second client, and encrypt the first key using the public key of the first object on the second client to obtain a first encryption key;

[0112] a communication unit 602, configured to send the first encryption key to the server so that the second client can obtain the target file;

[0113] The processing unit 601 is further configured to, if the sharing object of the sharing operation is a second object logged in on the second client, obtain the target file, encrypt the target file using the second key to obtain a second encrypted file, and encrypt the second key using the public key of the second object on the second client to obtain a second encryption key;

[0114] The communication unit 602 is further configured to send the second encrypted file and the second encryption key to the server, so that the second client can obtain the target file.

[0115] In one embodiment, when the processing unit 601 obtains the target file, it is specifically configured to: obtain the first key and the first encrypted file from the server; and decrypt the first encrypted file using the first key to obtain the target file.

[0116] In one embodiment, the third encryption key obtained by encrypting the first key using the public key of the first object on the first client is stored in the server. When the processing unit 601 obtains the first key, it is specifically used to: obtain the third encryption key from the server; and decrypt the third encryption key using the private key of the first object on the first client to obtain the first key.

[0117] In one embodiment, when the processing unit 601 uses the second key to encrypt the target file to obtain a second encrypted file, it is specifically used to: obtain a first watermark identifier and add the first watermark identifier to the target file; use the second key to encrypt the target file with the first watermark identifier to obtain a second encrypted file; wherein, the first watermark identifier is used to indicate that the target file is triggered to be shared based on the first object logged in on the first client; the second client obtains the target file with the first watermark identifier.

[0118] In one embodiment, the communication unit 602 is further configured to receive a source file sent by a third client;

[0119] The processing unit 601 is further used to add a second watermark identifier to the source file to obtain the target file based on the trigger of the first object logged in on the first client, and to encrypt the target file using the first key to obtain the first encrypted file; and store the first encrypted file to the server; wherein the second watermark identifier is used to indicate that the target file is generated based on the trigger of the first object logged in on the first client.

[0120] In one embodiment, the source file carries a third watermark identifier, and the third watermark identifier is used to indicate that the source file is shared based on a third object logged in on the third client.

[0121] In a feasible embodiment, the file processing device provided in the embodiment of the present application may correspond to the second client described above, wherein:

[0122] A communication unit 602 is configured to obtain file decryption related information about the target file from the server;

[0123] Processing unit 601 is configured to, if the file decryption-related information includes the first encrypted file and a first encryption key, obtain the target file based on the first encrypted file and the first encryption key; wherein the first encryption key is obtained by encrypting the first key using the public key of the first object on a second client when the first client performs a sharing operation on the target file with the first object logged in on the second client, and then sending the first key to the server;

[0124] The processing unit 601 is further used to obtain the target file based on the second encrypted file and the second encryption key if the file decryption-related information includes a second encrypted file and a second encryption key; wherein the second encrypted file and the second encryption key are generated and sent to the server by the first client when the sharing object of the sharing operation on the target file is the second object logged in on the second client, the second encrypted file is obtained by encrypting the target file using the second key, and the second encryption key is obtained by encrypting the second key using the public key of the second object on the second client.

[0125] In one embodiment, when the processing unit 601 obtains the target file based on the first encrypted file and the first encryption key, it is specifically used to: use the private key of the first object on the second client to decrypt the first encryption key to obtain the first key; use the first key to decrypt the first encrypted file to obtain the target file.

[0126] In one embodiment, when the processing unit 601 obtains the target file based on the second encrypted file and the second encryption key, it is specifically used to: use the private key of the second object on the second client to decrypt the second encryption key to obtain the second key; use the second key to decrypt the second encrypted file to obtain the target file.

[0127] In one embodiment, the second encrypted file is obtained by the first client adding a first watermark to the target file and encrypting the target file with the first watermark using the second key; wherein the first watermark is used to indicate that the target file is shared based on the first object logged in on the first client; the second client decrypts the second encrypted file using the second key to obtain the target file with the first watermark.

[0128] In one embodiment, the target file is obtained by the first client obtaining the first key, obtaining the first encrypted file from the server, and decrypting the first encrypted file using the first key; the third encryption key obtained by encrypting the first key using the public key of the first object on the first client is stored in the server, and the first key is obtained by the first client obtaining the third encryption key from the server and decrypting the third encryption key using the private key of the first object on the first client.

[0129] In one embodiment, the first encrypted file is a source file received by the first client from a third client, the target file is obtained by adding a second watermark to the source file based on the trigger of the first object logged in on the first client, and the target file is encrypted using the first key and stored on the server; wherein the second watermark is used to indicate that the target file is generated based on the trigger of the first object logged in on the first client.

[0130] In one embodiment, the source file carries a third watermark identifier, and the third watermark identifier is used to indicate that the source file is shared based on a third object logged in on the third client.

[0131] It can be understood that the functions of each functional unit of the file processing device described in the embodiment of the present application can be specifically implemented according to the method in the above method embodiment. The specific implementation process can refer to the relevant description in the above method embodiment and will not be repeated here.

[0132] According to the embodiment of the application, when a target file is shared, not only the target file is encrypted, but also the key used to encrypt the target file (hereinafter referred to as the file key) is encrypted. This dual encryption mechanism can effectively ensure the security of the target file. In addition, the key used to encrypt the file key is the public key corresponding to the sharing object. Only by using the private key corresponding to the sharing object can the encryption key be successfully decrypted to obtain the file key of the target file, which can further improve the security of the target file. On the other hand, the encryption key and the encrypted file can be automatically decrypted to obtain the target file, which can effectively improve the efficiency of obtaining the target file.

[0133] In a feasible embodiment, the file processing device provided in the embodiment of the present application can be implemented in software. The file processing device can be stored in a memory. It can be software in the form of programs and plug-ins, and includes a series of units, including a processing unit and a communication unit; wherein the processing unit and the communication unit are used to implement the file processing method provided in the embodiment of the present application.

[0134] In other feasible embodiments, the file processing device provided in the embodiment of the present application can also be implemented in a combination of software and hardware. As an example, the file processing device provided in the embodiment of the present application can be a processor in the form of a hardware decoding processor, which is programmed to execute the file processing method provided in the embodiment of the present application. For example, the processor in the form of a hardware decoding processor can adopt one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0135] See also Figure 7 , Figure 7 Schematic diagram of the structure of a computer device provided in an embodiment of the present application. The computer device described in the embodiment of the present application includes: a processor 701, a communication interface 702, and a memory 703. The processor 701, the communication interface 702, and the memory 703 may be connected via a bus or other means. The embodiment of the present application uses a bus connection as an example.

[0136] The processor 701 (also known as the CPU (Central Processing Unit)) is the computing and control core of the computer device. It can interpret various instructions within the computer device and process various data within the computer device. For example, the CPU can interpret power on / off commands sent by the user to the computer device and control the computer device to perform power on / off operations. Another example is that the CPU can transmit various interactive data between the internal components of the computer device, etc. The communication interface 702 can optionally include a standard wired interface or a wireless interface (such as Wi-Fi or a mobile communication interface), which is controlled by the processor 701 to transmit and receive data. The communication interface 702 can also optionally enable data or signal communication between the internal devices of the computer device. The memory 703 (Memory) is a storage device within the computer device, used to store programs and data. It is understood that the memory 703 here can include both the computer device's built-in memory and, of course, the computer device's supported extended memory. The memory 703 provides storage space for the computer device's operating system, which may include but is not limited to Android, iOS, Windows Phone, etc., although this application is not limited to this.

[0137] In an embodiment of the present application, the computer device is configured to process a target file, encrypt the target file using a first key, and store the resulting first encrypted file on a server. The first encrypted file is generated based on a trigger triggered by a first object logged into a first client. In a feasible embodiment, the computer device may correspond to the first client described above. In this case, the processor 701 executes the following operations by running the executable program code in the memory 703:

[0138] receiving a sharing operation regarding the target file through the communication interface 702; if the object of the sharing operation is the first object logged in on the second client, obtaining the first key, encrypting the first key using the public key of the first object on the second client to obtain a first encryption key, and sending the first encryption key to the server through the communication interface 702, so that the second client can obtain the target file;

[0139] If the sharing object of the sharing operation is a second object logged in on the second client, the target file is obtained, the target file is encrypted using the second key to obtain a second encrypted file, the second key is encrypted using the public key of the second object on the second client to obtain a second encryption key, and the second encrypted file and the second encryption key are sent to the server through the communication interface 702, so that the second client can obtain the target file.

[0140] In one embodiment, when the processor 701 obtains the target file, it is specifically used to: obtain the first key, and obtain the first encrypted file from the server through the communication interface 702; and use the first key to decrypt the first encrypted file to obtain the target file.

[0141] In one embodiment, the third encryption key obtained by encrypting the first key using the public key of the first object on the first client is stored in the server. When the processor 701 obtains the first key, it is specifically used to: obtain the third encryption key from the server through the communication interface 702; and decrypt the third encryption key using the private key of the first object on the first client to obtain the first key.

[0142] In one embodiment, when the processor 701 uses the second key to encrypt the target file to obtain a second encrypted file, it is specifically used to: obtain a first watermark identifier and add the first watermark identifier to the target file; use the second key to encrypt the target file with the first watermark identifier to obtain a second encrypted file; wherein, the first watermark identifier is used to indicate that the target file is triggered to be shared based on the first object logged in on the first client; the second client obtains the target file with the first watermark identifier.

[0143] In one embodiment, the processor 701 is also used to: receive a source file sent by a third client through the communication interface 702; based on the trigger of the first object logged in on the first client, add a second watermark identifier to the source file to obtain the target file, and use the first key to encrypt the target file to obtain the first encrypted file; store the first encrypted file to the server through the communication interface 702; wherein, the second watermark identifier is used to indicate that the target file is generated based on the trigger of the first object logged in on the first client.

[0144] In one embodiment, the source file carries a third watermark identifier, and the third watermark identifier is used to indicate that the source file is shared based on a third object logged in on the third client.

[0145] In a feasible embodiment, the computer device may correspond to the second client described above. In this case, the processor 701 executes the following operations by running the executable program code in the memory 703:

[0146] Obtaining file decryption related information about the target file from the server via the communication interface 702;

[0147] If the file decryption related information includes the first encrypted file and a first encryption key, obtaining the target file based on the first encrypted file and the first encryption key; wherein the first encryption key is obtained by encrypting the first key using the public key of the first object on the second client when the first client performs a sharing operation on the target file and the first object is logged in on the second client, and then sending the first key to the server;

[0148] If the file decryption-related information includes a second encrypted file and a second encryption key, the target file is obtained based on the second encrypted file and the second encryption key; wherein, the second encrypted file and the second encryption key are generated and sent to the server by the first client when the sharing object of the sharing operation on the target file is the second object logged in on the second client, the second encrypted file is obtained by encrypting the target file using the second key, and the second encryption key is obtained by encrypting the second key using the public key of the second object on the second client.

[0149] In one embodiment, when the processor 701 obtains the target file based on the first encrypted file and the first encryption key, it is specifically used to: use the private key of the first object on the second client to decrypt the first encryption key to obtain the first key; use the first key to decrypt the first encrypted file to obtain the target file.

[0150] In one embodiment, when the processor 701 obtains the target file based on the second encrypted file and the second encryption key, it is specifically used to: use the private key of the second object on the second client to decrypt the second encryption key to obtain the second key; use the second key to decrypt the second encrypted file to obtain the target file.

[0151] In one embodiment, the second encrypted file is obtained by the first client adding a first watermark to the target file and encrypting the target file with the first watermark using the second key; wherein the first watermark is used to indicate that the target file is shared based on the first object logged in on the first client; the second client decrypts the second encrypted file using the second key to obtain the target file with the first watermark.

[0152] In one embodiment, the target file is obtained by the first client obtaining the first key, obtaining the first encrypted file from the server, and decrypting the first encrypted file using the first key; the third encryption key obtained by encrypting the first key using the public key of the first object on the first client is stored in the server, and the first key is obtained by the first client obtaining the third encryption key from the server and decrypting the third encryption key using the private key of the first object on the first client.

[0153] In one embodiment, the first encrypted file is a source file received by the first client from a third client, the target file is obtained by adding a second watermark to the source file based on the trigger of the first object logged in on the first client, and the target file is encrypted using the first key and stored on the server; wherein the second watermark is used to indicate that the target file is generated based on the trigger of the first object logged in on the first client.

[0154] In one embodiment, the source file carries a third watermark identifier, and the third watermark identifier is used to indicate that the source file is shared based on a third object logged in on the third client.

[0155] In a specific implementation, the processor 701, communication interface 702, and memory 703 described in the embodiment of the present application can execute the implementation of the first client or the second client described in the file processing method provided in the embodiment of the present application, and can also execute the implementation described in the file processing device provided in the embodiment of the present application, which will not be repeated here.

[0156] According to the embodiment of the application, when a target file is shared, not only the target file is encrypted, but also the key used to encrypt the target file (hereinafter referred to as the file key) is encrypted. This dual encryption mechanism can effectively ensure the security of the target file. In addition, the key used to encrypt the file key is the public key corresponding to the sharing object. Only by using the private key corresponding to the sharing object can the encryption key be successfully decrypted to obtain the file key of the target file, which can further improve the security of the target file. On the other hand, the encryption key and the encrypted file can be automatically decrypted to obtain the target file, which can effectively improve the efficiency of obtaining the target file.

[0157] The present application also provides a computer-readable storage medium having a computer program stored therein. When the computer-readable storage medium is executed on a computer, the computer executes the file processing method described in the present application. The specific implementation method can be found in the above description and will not be repeated here.

[0158] The present application also provides a computer program product, comprising a computer program or computer instructions that, when executed by a processor, implement the steps of the file processing method provided in the present application. The specific implementation thereof can be found in the preceding description and will not be further elaborated here.

[0159] The present application also provides a computer program comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the file processing method described in the present application. The specific implementation method is described above and will not be repeated here.

[0160] It should be noted that for the aforementioned various method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by this application.

[0161] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0162] The above disclosure is only part of the embodiments of the present application, and certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A file processing method, characterized in that: The method is used to process a target file, encrypt the target file using a first key to obtain a first encrypted file, and store it in a server, wherein the first encrypted file is generated based on a trigger of a first object logged in on a first client, and the method includes: receiving a sharing operation on the target file; If the object of the sharing operation is the first object logged in on the second client, obtaining the first key, encrypting the first key using the public key of the first object on the second client to obtain a first encryption key, and sending the first encryption key to the server so that the second client can obtain the target file; If the sharing object of the sharing operation is a second object logged in on the second client, the target file is obtained, the target file is encrypted using the second key to obtain a second encrypted file, the second key is encrypted using the public key of the second object on the second client to obtain a second encryption key, and the second encrypted file and the second encryption key are sent to the server so that the second client can obtain the target file.

2. The method according to claim 1, wherein The obtaining of the target file comprises: Obtaining the first key, and obtaining the first encrypted file from the server; The first encrypted file is decrypted using the first key to obtain the target file.

3. The method according to claim 1 or 2, wherein: A third encryption key obtained by encrypting the first key by using the public key of the first object on the first client is stored in the server, wherein obtaining the first key includes: obtaining the third encryption key from the server; The third encryption key is decrypted using the private key of the first object on the first client to obtain the first key.

4. The method according to claim 1, wherein The step of encrypting the target file using the second key to obtain a second encrypted file includes: Obtaining a first watermark identifier, and adding the first watermark identifier to the target file; Encrypting the target file with the first watermark identifier using the second key to obtain a second encrypted file; The first watermark identifier is used to indicate that the target file is shared based on the first object logged in on the first client; the second client obtains the target file with the first watermark identifier added.

5. The method according to claim 1, wherein The method further comprises: receiving a source file sent by a third client; Based on the trigger of the first object logged in on the first client, adding a second watermark identifier to the source file to obtain the target file, and encrypting the target file using the first key to obtain the first encrypted file; storing the first encrypted file in the server; The second watermark identifier is used to indicate that the target file is generated based on the triggering of the first object logged in on the first client.

6. The method according to claim 5, wherein The source file carries a third watermark identifier, and the third watermark identifier is used to indicate that the source file is triggered to be shared based on a third object logged in on the third client.

7. A file processing method, characterized in that: The method is used to process a target file, encrypt the target file using a first key to obtain a first encrypted file, and store it in a server, wherein the first encrypted file is generated based on a trigger of a first object logged in on a first client, and the method includes: Obtaining file decryption related information about the target file from the server; If the file decryption related information includes the first encrypted file and a first encryption key, obtaining the target file based on the first encrypted file and the first encryption key; wherein the first encryption key is obtained by encrypting the first key using the public key of the first object on the second client when the first client performs a sharing operation on the target file and the first object is logged in on the second client, and then sending the first key to the server; If the file decryption-related information includes a second encrypted file and a second encryption key, the target file is obtained based on the second encrypted file and the second encryption key; wherein, the second encrypted file and the second encryption key are generated and sent to the server by the first client when the sharing object of the sharing operation on the target file is the second object logged in on the second client, the second encrypted file is obtained by encrypting the target file using the second key, and the second encryption key is obtained by encrypting the second key using the public key of the second object on the second client.

8. The method according to claim 7, wherein The obtaining the target file based on the first encrypted file and the first encryption key includes: Decrypting the first encryption key using the private key of the first object on the second client to obtain the first key; The first encrypted file is decrypted using the first key to obtain the target file.

9. The method according to claim 7, wherein The obtaining the target file based on the second encrypted file and the second encryption key includes: Decrypting the second encryption key using the private key of the second object on the second client to obtain the second key; The second encrypted file is decrypted using the second key to obtain the target file.

10. The method according to any one of claims 7 to 9, wherein The second encrypted file is obtained by the first client adding a first watermark to the target file and encrypting the target file with the first watermark using the second key; wherein the first watermark is used to indicate that the target file is triggered to be shared based on the first object logged in on the first client; the second client decrypts the second encrypted file using the second key to obtain the target file with the first watermark.

11. The method according to any one of claims 7 to 9, wherein: The target file is obtained by the first client obtaining the first key, obtaining the first encrypted file from the server, and decrypting the first encrypted file using the first key; A third encryption key obtained by encrypting the first key using the public key of the first object on the first client is stored in the server, and the first key is obtained by the first client obtaining the third encryption key from the server and decrypting the third encryption key using the private key of the first object on the first client.

12. The method according to any one of claims 7 to 9, wherein: The first encrypted file is a source file received by the first client from a third client, and the target file is obtained by adding a second watermark to the source file based on the trigger of the first object logged in on the first client, and the target file is encrypted using the first key and stored on the server; wherein the second watermark is used to indicate that the target file is generated based on the trigger of the first object logged in on the first client.

13. The method according to claim 12, wherein: The source file carries a third watermark identifier, and the third watermark identifier is used to indicate that the source file is shared based on a third object logged in on the third client.

14. A file processing device, characterized in that: The method comprises a unit for executing the file processing method according to any one of claims 1 to 6, or comprises a unit for executing the file processing method according to any one of claims 7 to 13.

15. A computer device, characterized in that: include: A processor, a communication interface, and a memory, wherein the processor, the communication interface, and the memory are interconnected, wherein the memory stores an executable program code, and the processor is used to call the executable program code to execute the file processing method according to any one of claims 1 to 6, or to execute the file processing method according to any one of claims 7 to 13.

16. A computer program product, characterized in that The computer program product includes a computer program or computer instructions, and when the computer program or computer instructions are executed by a processor, the steps of the file processing method according to any one of claims 1 to 6 are implemented, or the steps of the file processing method according to any one of claims 7 to 13 are implemented.

Images