Data encryption and decryption method and device, electronic equipment and storage medium

Abstract

The present disclosure provides a data encryption and decryption method and device, electronic equipment and storage medium, which can be applied to the technical field of information security. The data encryption method comprises the following steps: in response to detecting that a plaintext folder exists a newly added file, determining at least one newly added plaintext file and a first storage area in the plaintext folder for storing plaintext files, and the plaintext folder is arranged in a disk; signing the plaintext files to generate a signature summary file; encrypting the signature summary file and the plaintext files to generate a ciphertext file; and storing the ciphertext file in a second storage area of a ciphertext folder according to the first storage area, the second storage area corresponds to the first storage area, and the ciphertext folder is arranged in the disk.

Description

Technical Field

[0001] This disclosure relates to the field of information security, specifically to a data encryption and decryption method, apparatus, electronic device, and storage medium. Background Technology

[0002] For data transmission scenarios in the banking industry, one approach is to use the HyperText Transfer Protocol over Secure Socket Layer (HTTPS) to transmit data over the network. Another approach utilizes third-party software, USB drives, or local area network sharing to achieve data transmission without relying on HTTPS. For the latter, encryption is typically implemented by writing encryption blocks to ensure data security.

[0003] However, the banking industry involves large data transmission volumes, diverse data types, and complex execution logic. Implementing encryption through code written by developers would result in high development and maintenance costs, and data security depends on the technical capabilities of the developers. Summary of the Invention

[0004] In view of the above problems, this disclosure provides a data encryption and decryption method, apparatus, electronic device and storage medium.

[0005] According to a first aspect of this disclosure, a data encryption method is provided, comprising:

[0006] In response to the detection of a newly added file in a plaintext folder, at least one newly added plaintext file and a first storage area in the plaintext folder for storing the plaintext file are determined, and the plaintext folder is set on the disk;

[0007] Sign the plaintext document and generate a signature summary file;

[0008] The signature summary file and the plaintext file are encrypted to generate a ciphertext file;

[0009] Based on the first storage area, the encrypted file is stored in the second storage area of ​​the encrypted folder. The second storage area corresponds to the first storage area, and the encrypted folder is set on the disk.

[0010] According to embodiments of this disclosure, signing a plaintext document to generate a signature summary file includes:

[0011] Determine the file format of the plaintext file;

[0012] Given that the file format is a compressed format, the plaintext file is decompressed to obtain M decompressed files, where M≥1;

[0013] The signature server's signing interface is called to sign M decompressed files respectively, resulting in M ​​signature messages; and

[0014] Write M signature information into the same file to generate a signature summary file.

[0015] According to embodiments of this disclosure, determining the file format of the plaintext document includes:

[0016] Scan the file extensions of plaintext files, including at least one of the following: text, table, image, and compressed file extensions;

[0017] The file format of a plaintext file is determined by its file extension.

[0018] According to embodiments of this disclosure, before calling the signature server's signature interface to sign the M decompressed files respectively and obtaining M signature information, the method further includes:

[0019] The query rules are used to query and analyze the decompressed files.

[0020] Based on the query results, generate verification information, which includes at least one of the following: data length, data volume, number of files, and user type; and

[0021] Update the decompressed file using the verification information.

[0022] According to embodiments of this disclosure, before querying the decompressed file based on query rules and obtaining query results, the process includes:

[0023] Based on the first storage area, determine the intended use of the decompressed file; and

[0024] Determine query rules that match the intended purpose of execution.

[0025] According to embodiments of this disclosure, updating the decompressed file using verification information includes:

[0026] Add at least one verification field to the decompressed file that matches the type of the verification information, and fill the verification information as a data value into the verification field to update the decompressed file.

[0027] According to embodiments of this disclosure, the plaintext folder includes multiple first storage areas, and the encrypted folder includes multiple second storage areas. Both the first and second storage areas are used to characterize the execution purpose of the file, which includes at least one of the following: asset inquiry, asset freezing, asset deduction, and asset payment on behalf of others.

[0028] According to embodiments of this disclosure, encrypting the signature summary file and the plaintext file to generate an encrypted ciphertext file includes:

[0029] Compress the signature summary file and the plaintext file into a single compressed file; and

[0030] The compressed file is encrypted using a preset encryption algorithm to obtain a ciphertext file.

[0031] According to embodiments of this disclosure, after storing the encrypted file to the second storage area of ​​the encrypted folder according to the first storage area, the process includes:

[0032] Within the plaintext folder, rename the plaintext files to the first preset format.

[0033] According to embodiments of this disclosure, before determining at least one newly added plaintext file and a first storage area in the plaintext folder for storing plaintext files in response to detecting the presence of a newly added file in the plaintext folder, the process includes:

[0034] In response to a user's preset action, add at least one plaintext file to the plaintext folder. The preset actions include creating a new file or dragging and dropping a file.

[0035] The second aspect of this disclosure provides a data decryption method, comprising:

[0036] In response to the detection of a newly added file in the ciphertext folder, at least one newly added ciphertext file and a second storage area in the ciphertext folder for storing the ciphertext file are determined, and the ciphertext folder is set on the disk;

[0037] Decrypt the encrypted file to generate a signature summary file and a plaintext file;

[0038] The plaintext file is verified using the signature summary file to obtain the verification result;

[0039] If the verification results indicate that the plaintext file is secure, the plaintext file is stored in the first storage area of ​​the plaintext folder according to the second storage area. The second storage area corresponds to the first storage area, and the plaintext folder is set on the disk.

[0040] According to embodiments of this disclosure, the verification result includes a first verification result;

[0041] The plaintext file is verified using the signature summary file, and the verification results are obtained, including:

[0042] Based on the signature summary file, determine the M signature information included in the plaintext file, where M ≥ 1;

[0043] The signature information is designed, resulting in M ​​designed messages; and

[0044] The plaintext document is verified based on the plaintext document and the decryption information to obtain the first verification result, so as to determine whether the plaintext document is secure based on the first verification result.

[0045] According to embodiments of this disclosure, the verification result further includes a second verification result; before obtaining the first verification result by verifying the plaintext file based on the plaintext file and the designing information, the method further includes:

[0046] If it is determined that the plaintext file contains verification information, the plaintext file is verified based on the verification information to obtain the verification result; and

[0047] Based on the verification result and the verification information, a second verification result is determined. The second verification result is used to characterize whether the verification result is consistent with the verification information, so as to determine whether the plaintext document is secure based on the first verification result and the second verification result.

[0048] According to embodiments of this disclosure, the process of decrypting the ciphertext file to generate a signature summary file and a plaintext file includes:

[0049] The signature verification interface of the signature server is called to decrypt the encrypted file and obtain a compressed file.

[0050] Decompress the compressed file to obtain a signature summary file and a plaintext file.

[0051] According to embodiments of this disclosure, before determining at least one newly added ciphertext file and a second storage area in the ciphertext folder for storing the ciphertext file in response to detecting the presence of a newly added file in the ciphertext folder, the process includes:

[0052] In response to the user's preset actions, add at least one encrypted file to the encrypted folder. The preset actions include creating a new file or dragging and dropping a file.

[0053] According to embodiments of this disclosure, after storing the plaintext file to the first storage area of ​​the plaintext folder according to the second storage area, the process includes:

[0054] Within the encrypted folder, rename the encrypted files to the second preset format.

[0055] A third aspect of this disclosure provides a data encryption device, comprising:

[0056] The first determining module is used to determine, in response to the detection of a newly added file in a plaintext folder, at least one newly added plaintext file and a first storage area in the plaintext folder for storing the plaintext file, wherein the plaintext folder is set on the disk;

[0057] The signature module is used to sign plaintext files and generate a signature summary file;

[0058] The encryption module is used to encrypt the signature summary file and the plaintext file to generate a ciphertext file;

[0059] The first storage module is used to store encrypted files into a second storage area of ​​the encrypted folder according to the first storage area. The second storage area corresponds to the first storage area, and the encrypted folder is set in the disk.

[0060] A fourth aspect of this disclosure provides a data decryption apparatus, comprising:

[0061] The second determining module is used to determine, in response to the detection of a newly added file in the encrypted folder, at least one newly added encrypted file and a second storage area in the encrypted folder for storing the encrypted file, wherein the encrypted folder is set on the disk;

[0062] The decryption module is used to decrypt ciphertext files and generate a signature summary file and a plaintext file.

[0063] The verification module is used to verify plaintext files using the signature summary file and obtain the verification results.

[0064] The second storage module is used to store the plaintext file into the first storage area of ​​the plaintext folder according to the second storage area, provided that the verification result indicates that the plaintext file is secure. The second storage area corresponds to the first storage area, and the plaintext folder is set on the disk.

[0065] The fifth aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to perform the data encryption method and the data decryption method described above.

[0066] A sixth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the aforementioned data encryption and data decryption methods.

[0067] The seventh aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described data encryption method and data decryption method.

[0068] This disclosure achieves local file encryption on a terminal device by responding to the detection of a newly added file in a plaintext folder, identifying at least one new plaintext file and a first storage area within the plaintext folder for storing the plaintext file; signing the plaintext file to generate a signature summary file, with the plaintext folder located on the disk; encrypting the signature summary file and the plaintext file to generate an ciphertext file; and storing the ciphertext file in a second storage area of ​​the ciphertext folder according to the first storage area. Since both the plaintext and ciphertext folders are located on the terminal device's disk, encryption is not dependent on applications within the terminal device and can be implemented directly based on the terminal device's operating system. This enables transmission via network, third-party software, USB flash drives, and local area networks, ensuring the security of the transmission process. Furthermore, the encryption process requires no manual intervention, reducing development and maintenance costs.

[0069] Furthermore, when a terminal device detects a newly added plaintext file in a plaintext folder, it can encrypt the file and store the encrypted file in the second storage area of ​​the ciphertext folder. This allows business personnel to clearly know which files are encrypted, achieving transparent encryption and improving the user experience. Attached Figure Description

[0070] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0071] Figure 1 This illustration schematically depicts an application scenario of the data encryption method and data decryption method according to embodiments of the present disclosure;

[0072] Figure 2 A flowchart illustrating a data encryption method according to an embodiment of the present disclosure is shown schematically.

[0073] Figure 3 A flowchart illustrating a method for generating a signature summary file according to an embodiment of the present disclosure is shown schematically.

[0074] Figure 4 This illustration schematically depicts an application scenario of the method for generating encrypted files according to embodiments of the present disclosure;

[0075] Figure 5 This illustration schematically depicts an application scenario of a data encryption method according to a specific embodiment of the present disclosure;

[0076] Figure 6 A flowchart illustrating a data decryption method according to an embodiment of the present disclosure is shown schematically.

[0077] Figure 7 This illustration schematically depicts an application scenario of a data decryption method according to a specific embodiment of the present disclosure;

[0078] Figure 8 A schematic block diagram of a data encryption device according to an embodiment of the present disclosure is shown.

[0079] Figure 9 A schematic block diagram of a data decryption apparatus according to an embodiment of the present disclosure is shown; and

[0080] Figure 10 A block diagram schematically illustrates an electronic device suitable for data encryption and data decryption methods according to embodiments of the present disclosure. Detailed Implementation

[0081] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0082] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0083] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0084] When using expressions such as "at least one of A, B, and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0085] In the technical solutions disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of data (including but not limited to user personal information) comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good morals.

[0086] Data transmitted over the network, whether personal user data or network application data, faces significant risks of information leakage, tampering, and repudiation. To address these issues, data encryption and digital signature technologies are typically used to encrypt and sign transmitted data.

[0087] However, for data transmission scenarios between banking systems, the data encryption or digital signature technologies used must explicitly implement encryption or decryption, signing or verification operations in the program code. Due to the large volume, diverse types, and complex execution logic of data transmitted between systems, the development and maintenance costs for data transmission scenarios are high for enterprises.

[0088] Furthermore, when data is transferred between systems without a network connection, such as via third-party software, USB drives, or local area network sharing, the encrypted files are typically encrypted manually by developers. This further increases the company's development and maintenance costs. Moreover, because the encryption program for the encrypted files relies on the coding skills of business personnel, it leads to technical problems such as high decryption and signature error rates, high labor costs, and low development efficiency.

[0089] Embodiments of this disclosure provide a data encryption method, comprising: in response to detecting a newly added file in a plaintext folder, determining at least one newly added plaintext file and a first storage area in the plaintext folder for storing the plaintext file, the plaintext folder being located on a disk; signing the plaintext file to generate a signature summary file; encrypting the signature summary file and the plaintext file to generate a ciphertext file; and storing the ciphertext file in a second storage area of ​​the ciphertext folder according to the first storage area, the second storage area corresponding to the first storage area, the ciphertext folder being located on a disk.

[0090] Figure 1 The illustrations depict application scenarios of the data encryption and decryption methods according to embodiments of the present disclosure.

[0091] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a server 102, and a second terminal device 103. The first terminal device 101 includes a first plaintext folder 1011 and a first encrypted folder 1012, and the second terminal device 103 includes a second plaintext folder 1031 and a second encrypted folder 1032.

[0092] The first plaintext folder 1011, the first encrypted folder 1012, the second plaintext folder 1031, and the second encrypted folder 1032 can be set on the local disk of the terminal device, such as the system disk C drive or D drive.

[0093] A network is a medium used to provide a communication link between the first terminal device 101, the second terminal device 103, and the server 102. A network can include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0094] Users can interact with server 102 via a network using at least one of the first terminal device 101 and the second terminal device 103 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101 and the second terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (for example only).

[0095] The first terminal device 101 and the second terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0096] Server 102 can be a server that provides various services, such as encrypting plaintext files provided by users using the first terminal device 101 and the second terminal device 103, or decrypting provided ciphertext files. Server 102 can encrypt plaintext files in the first terminal device 101 and decrypt ciphertext files in the second terminal device 103 through an interface.

[0097] It should be noted that the data encryption and decryption methods provided in this disclosure embodiment can generally be executed by the first terminal device 101 or the second terminal device 103. Accordingly, the data encryption and decryption devices provided in this disclosure embodiment can generally be disposed in the first terminal device 101 or the second terminal device 103.

[0098] For example, the first terminal device 101 detects a newly added plaintext file in the first plaintext folder 1011, identifies at least one newly added plaintext file and a first storage area in the first plaintext folder 1011 used to store plaintext files, calls the server 102 to sign the plaintext file, and generates a signature summary file; encrypts the signature summary file and the plaintext file to generate a ciphertext file; and stores the ciphertext file in the second storage area of ​​the first ciphertext folder 1012 according to the first storage area, completing the automatic encryption of the plaintext file. The ciphertext file in the first ciphertext folder 1012 is then transferred to the second ciphertext folder 1032 via a network, third-party software, USB flash drive, or local area network.

[0099] In response to detecting a newly added file in the second encrypted folder 1032, the second terminal device 103 determines at least one newly added encrypted file and a second storage area in the second encrypted folder 1032 used to store the encrypted file; decrypts the encrypted file to generate a signature summary file and a plaintext file; verifies the plaintext file using the signature summary file to obtain a verification result; if the verification result indicates that the plaintext file is secure, it stores the plaintext file in the first storage area of ​​the second plaintext folder 1031 according to the second storage area, thus completing the automatic decryption of the encrypted file.

[0100] It should be understood that Figure 1 The number of terminal devices and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices and servers can be used.

[0101] The following will be based on Figure 1 The described scene, through Figures 2-5 The data encryption method of the disclosed embodiments is described in detail. Figures 6-7 The data decryption method of the disclosed embodiments will be described in detail.

[0102] Figure 2 A flowchart illustrating a data encryption method according to an embodiment of the present disclosure is shown schematically.

[0103] like Figure 2 As shown, the method 200 includes operations S210 to S240.

[0104] In operation S210, in response to detecting that a new file has been added to the plaintext folder, at least one new plaintext file and a first storage area in the plaintext folder for storing the plaintext file are determined, and the plaintext folder is set on the disk.

[0105] According to embodiments of this disclosure, a plaintext folder is set on the disk of a terminal device for storing plaintext files to be transmitted on the terminal device. The plaintext folder may include multiple first storage areas, each used to store plaintext files for different purposes.

[0106] For example, the plaintext folder contains three folders, which are used to store query information, transfer information, and fund deduction information, respectively. Each folder represents a primary storage area.

[0107] According to embodiments of this disclosure, when a terminal device detects the presence of newly added plaintext files in a plaintext folder, it can encrypt and sign the plaintext files. When multiple newly added plaintext files are detected, multiple plaintext files can be encrypted and signed simultaneously.

[0108] It should be noted that plaintext files can be in the form of a compressed archive containing multiple files, or they can consist of only one file.

[0109] For example, files A, B, and C are plaintext files to be transmitted. Files A, B, and C can be directly added to the plaintext folder. When the terminal device detects these three plaintext files, it simultaneously performs signature and encryption processing on all three.

[0110] Alternatively, files A, B, and C can be compressed into a single file, and the compressed file can be added to a plaintext folder. The terminal device detects the compressed file and decompresses, then adds a signature and encryption.

[0111] In operation S220, the plaintext document is signed, and a signature summary file is generated.

[0112] According to embodiments of this disclosure, when a newly added plaintext file is detected, the plaintext file is signed, generating a signature summary file corresponding to the plaintext file. The plaintext file can be digitally signed.

[0113] According to embodiments of this disclosure, digital signatures on plaintext documents can be achieved using asymmetric key encryption techniques from the field of public-key cryptography. For example, two complementary operations can be used for encryption: one for signing the plaintext document and the other for verifying the ciphertext document. A digital signature, also known as a public-key digital signature, is a unique and unforgeable string of numbers that only the sender of the information can generate. This string also serves as valid proof of the authenticity of the information sent by the sender.

[0114] According to embodiments of this disclosure, after signing a plaintext document, a signature summary file is generated. The signature summary file may include one or more signature information entries.

[0115] For example, a plaintext file may contain one or more files. Signing a single file generates a signature summary file. Signing multiple files generates signature information corresponding to each file, and this signature summary file is composed of all the signature information.

[0116] In operation S230, the signature summary file and the plaintext file are encrypted to generate a ciphertext file.

[0117] According to embodiments of this disclosure, after generating the signature summary file, the signature summary file and the plaintext file are encrypted together to generate the final ciphertext file.

[0118] According to embodiments of this disclosure, the recipient verifies the sender's identity and document integrity by utilizing a signature summary file, thereby preventing attackers from tampering with document content or impersonating the sender to send forged investigation and control documents.

[0119] According to embodiments of this disclosure, by jointly encrypting the generated signature summary file and the ciphertext file, and further encrypting based on the signature, the security of transmitted files can be guaranteed. Furthermore, simultaneously encrypting the signature summary file and the plaintext file not only improves file security but also reduces the encryption process by using a single encryption step, thereby increasing encryption efficiency.

[0120] In operation S240, the encrypted file is stored in the second storage area of ​​the encrypted folder according to the first storage area. The second storage area corresponds to the first storage area, and the encrypted folder is set in the disk.

[0121] According to embodiments of this disclosure, a ciphertext folder is located on the disk of a terminal device and is used to store encrypted files to be transmitted. The ciphertext folder may include multiple second storage areas, each used to store ciphertext files for different purposes. The ciphertext folder corresponds to the plaintext folder, and the first storage area corresponds to the second storage area.

[0122] For example, a plaintext file located in the first storage area X within a plaintext folder is encrypted and stored in the second storage area X' within a ciphertext folder. X' has the same purpose as X.

[0123] According to embodiments of this disclosure, plaintext folders and encrypted folders can be located on the same disk or on different disks. The plaintext folders and encrypted files are created based on the terminal device's operating system.

[0124] For example, based on the operating system's file system, you can create two folders by right-clicking and name them "plaintext folder" and "ciphertext folder" respectively.

[0125] According to embodiments of this disclosure, after creating plaintext folders and ciphertext folders, the terminal device determines whether there are any newly added plaintext or ciphertext files by detecting the addresses of the plaintext folders and ciphertext folders.

[0126] According to embodiments of this disclosure, the terminal device can detect in real time whether there are any newly added plaintext or ciphertext files; it can also periodically detect whether there are any newly added plaintext or ciphertext files.

[0127] This disclosure achieves local file encryption on a terminal device by responding to the detection of a newly added file in a plaintext folder, identifying at least one new plaintext file and a first storage area within the plaintext folder for storing the plaintext file; signing the plaintext file to generate a signature summary file, with the plaintext folder located on the disk; encrypting the signature summary file and the plaintext file to generate an ciphertext file; and storing the ciphertext file in a second storage area of ​​the ciphertext folder according to the first storage area. Since both the plaintext and ciphertext folders are located on the terminal device's disk, encryption is not dependent on applications within the terminal device and can be implemented directly based on the terminal device's operating system. This enables transmission via network, third-party software, USB flash drives, and local area networks, ensuring the security of the transmission process. Furthermore, the encryption process requires no manual intervention, reducing development and maintenance costs.

[0128] Furthermore, when a terminal device detects a newly added plaintext file in a plaintext folder, it can encrypt the file and store the encrypted file in the second storage area of ​​the ciphertext folder. This allows business personnel to clearly know which files are encrypted, achieving transparent encryption and improving the user experience.

[0129] According to embodiments of this disclosure, after storing the encrypted file in the second storage area of ​​the encrypted folder, the terminal device can respond to a transmission request from the server and transmit the encrypted file in the encrypted folder to the recipient via a network; or transmit the encrypted file in the encrypted folder to the recipient via a local area network.

[0130] The terminal device can also respond to preset operations from the user by transmitting encrypted files to an intermediate device / application, and then the intermediate device / application transmits the encrypted files to the recipient. The intermediate device / application includes third-party software, USB flash drives, and other offline devices to enable data transmission via physical means.

[0131] According to embodiments of this disclosure, after receiving a ciphertext file, the receiving terminal device stores the received ciphertext file in a ciphertext folder, so that the terminal device can decrypt the ciphertext file and store it in a plaintext folder. The receiving terminal device may also store the ciphertext file in a third storage area that is the same as the second storage area of ​​the sending terminal.

[0132] Figure 3 A flowchart illustrating a method for generating a signature summary file according to an embodiment of the present disclosure is shown schematically.

[0133] like Figure 3 As shown, the signature summary file generation method 300 of this embodiment includes operations S321 to S324, which can be used as a specific embodiment of operation S220.

[0134] In operation S321, the file format of the plaintext file is determined.

[0135] In operation S322, when it is determined that the file format is a compressed format, the plaintext file is decompressed to obtain M decompressed files, where M≥1.

[0136] In operation S323, the signing interface of the signature server is invoked to sign each of the M decompressed files separately, thereby obtaining M signature information.

[0137] In operation S324, the M pieces of signature information are written into the same file to generate a signature summary file.

[0138] According to embodiments of the present disclosure, a plaintext file may include one file, or include multiple files in the form of a compressed package. After determining one or more newly added plaintext files, the file format of each plaintext file is determined. The file formats include compressed format and non-compressed format.

[0139] For any plaintext file, when it is determined that the plaintext file is in a non-compressed format, the signing interface of the signature server is directly invoked to sign the plaintext file to obtain signature information, and the signature information forms a signature summary file.

[0140] When it is determined that the file format of the plaintext file is a compressed format, the plaintext file is decompressed to obtain M decompressed files. Wherein, the M decompressed files are files for the same execution purpose.

[0141] According to embodiments of the present disclosure, with the user's permission, the off-site execution control application system generates plaintext files for querying or controlling user data. For example, the files include information for querying or controlling the user's bank cards and execution requirements, and are transmitted to the banking system, so that the banking system can perform operations such as querying, freezing, and deducting funds.

[0142] According to embodiments of the present disclosure, due to the huge amount of data, various types of data, and complex execution logic in the system, the off-site execution control application system generally generates plaintext files in compressed form, so as to avoid excessive data volume of plaintext folders in the disk from affecting the execution speed and execution efficiency.

[0143] According to embodiments of the present disclosure, since the plaintext file includes M decompressed files, each decompressed file needs to be signed to ensure the security of each file. Therefore, after obtaining the M decompressed files, the signing interface of the signature server is invoked to sign each of the M decompressed files separately, obtaining M pieces of signature information. Then, the M pieces of signature information are written into the same file to obtain the signature summary file.

[0144] According to embodiments of this disclosure, the signature server uses digital signature technology to sign the decompressed files. The signature information for each decompressed file is different from the signature information for other decompressed files.

[0145] After obtaining M signature information, the M signature information is written into the same file according to the order of the M decompressed files in the plaintext file, resulting in a signature summary file, which the receiving end can use for verification.

[0146] For example, after decompressing a plaintext file, you get decompressed file A, decompressed file B, decompressed file C, and decompressed file D. Calling a signature server to sign each of these four decompressed files yields signature information A', signature information B', signature information C', and signature information D'. After writing these four signatures into a signature summary file, the signature order within the summary file is "A'—B'—C'—D'".

[0147] It should be noted that when the receiving end verifies the signature summary file, if signature information A', B', and C' are all verified correctly, but signature information D' is verified incorrectly, it indicates that the signature information within the signature summary file may have been leaked. Even if signature information A', B', and C' are all verified correctly, decompressed files A, B, and C still pose a security risk.

[0148] The embodiments of this disclosure process plaintext files into a compressed format, which can reduce the amount of data occupied by the plaintext folder on the disk. By writing signatures into the same file, omissions or errors in transmission are avoided. Furthermore, if one signature is at risk, it can be determined that all signatures in the signature summary file may also be at risk, thus improving the security of data transmission.

[0149] According to embodiments of this disclosure, determining the file format of a plaintext document includes the following steps:

[0150] Scan the file extensions of plaintext files, including at least one of the following: text, table, image, and compressed file extensions.

[0151] The file format of a plaintext file is determined by its file extension.

[0152] According to embodiments of this disclosure, since plaintext folders and encrypted folders rely on the operating system's file system, the plaintext files are in a format allowed by the terminal device's operating system. Therefore, the file format can be quickly determined by scanning the file extensions of the plaintext files and based on the scanned file extensions.

[0153] For example, plaintext file formats include text, table, image, and compressed file formats. Correspondingly, file extensions include text, table, image, and compressed file extensions.

[0154] For example, Word documents have the extension .doc or .docx, while compressed files have the extension .zip. It should be noted that, depending on the specific needs, compressed file extensions may also include .zip, .arj, etc.

[0155] The embodiments of this disclosure can determine the file format simply and quickly by scanning the file extension based on the computer file system, thereby improving execution efficiency.

[0156] According to embodiments of this disclosure, business fields can be processed on plaintext documents before signing to improve document security.

[0157] According to embodiments of this disclosure, before calling the signature server's signature interface to sign M decompressed files respectively and obtaining M signature information, the following steps are also included:

[0158] The query rules are used to query and analyze the decompressed files.

[0159] Based on the query results, generate verification information, which includes at least one of the following: data length, data volume, number of files, and user type; update the decompressed file using the verification information.

[0160] According to embodiments of this disclosure, query rules are used to query and statistically analyze decompressed or plaintext files. For example, query rules can be used to query and filter target types of users, control monetary ranges, query data lengths, number of files, etc.

[0161] According to embodiments of this disclosure, different plaintext files correspond to different query rules. Specifically, plaintext files located in the same first storage area are subject to the same query rule; multiple decompressed files belonging to the same plaintext file are subject to the same query rule.

[0162] According to embodiments of this disclosure, after querying the decompressed file based on query rules and obtaining query results, verification information can be generated based on the query results.

[0163] For example, the query rules include: querying VIP users, data length, and number of files. After querying the decompressed files based on the query results, the query results are 100, 100, and 1, which respectively represent 100 VIP users, 100 data units in each decompressed file, and 1 file.

[0164] According to embodiments of this disclosure, after determining the query results, one or more query results can be randomly selected from the query results as verification information.

[0165] According to embodiments of this disclosure, after determining the verification information, updating the decompressed file using the verification information includes: adding the verification information as new information to the decompressed file to obtain an updated decompressed file. The difference between the updated decompressed file and the original decompressed file lies solely in the verification information.

[0166] According to embodiments of this disclosure, updating a decompressed file using verification information includes: adding at least one verification field to the decompressed file that matches the type of verification information, and filling the verification information as a data value into the verification field to update the decompressed file.

[0167] The embodiments of this disclosure achieve the addition of verification information by adding a verification field, which is simple, convenient and conducive to verification during decryption.

[0168] According to embodiments of this disclosure, multiple decompressed files can correspond to multiple verification information. For example, taking the above query rule as an example again, the verification information for decompressed file A is data length, and the verification information for decompressed file B is VIP user, obtained by random selection based on the query rule.

[0169] According to embodiments of this disclosure, when the plaintext file is in an uncompressed format, the method for adding verification information to the plaintext file is similar to the decompressed file described above, and will not be repeated here.

[0170] The embodiments disclosed herein add verification information before signing, thereby further improving system security through dual protection of signing encryption and verification information.

[0171] According to embodiments of this disclosure, before querying the decompressed file based on query rules and obtaining query results, the following steps are included.

[0172] Based on the first storage area, determine the intended use of the decompressed file.

[0173] Determine query rules that match the intended purpose of execution.

[0174] According to embodiments of this disclosure, plaintext files can be used to notify the banking system to perform operations such as fund inquiries, freezing, and deductions. Depending on the intended use, plaintext files can be stored in partitions within a plaintext folder, and encrypted files can also be stored in partitions within an encrypted folder.

[0175] Therefore, based on the first storage area within the plaintext folder used to store plaintext files, the purpose of executing the plaintext files and the decompressed files can be determined.

[0176] According to embodiments of this disclosure, after determining the execution purpose of a plaintext file based on a first storage area, query rules matching that execution purpose can be determined. For example, for a plaintext file used for fund deduction, the query rules include user type and fund range.

[0177] According to embodiments of this disclosure, the plaintext folder includes multiple first storage areas, and the encrypted folder includes multiple second storage areas. Both the first and second storage areas are used to characterize the execution purpose of the file, which includes at least one of the following: asset query, asset freezing, asset deduction, and asset payment on behalf of others.

[0178] According to embodiments of this disclosure, the rules for partitioning and storing plaintext and encrypted folders are similar, with each encrypted folder containing a corresponding storage area within the plaintext folder. The number and purpose of the second storage area within the encrypted folder are the same as those of the first storage area.

[0179] For example, the plaintext folder contains three first storage areas, used to store files intended for asset inquiry, asset freezing, and asset deduction, respectively. Correspondingly, the encrypted folder also contains three second storage areas, used to store files intended for asset inquiry, asset freezing, and asset deduction, respectively.

[0180] According to embodiments of this disclosure, encrypting the signature summary file and the plaintext file to generate the encrypted ciphertext file includes the following steps:

[0181] Compress the signature summary file and the plaintext file into a single compressed file.

[0182] The compressed file is encrypted using a preset encryption algorithm to obtain a ciphertext file.

[0183] According to embodiments of this disclosure, after signing the plaintext file to obtain a signature summary file, the signature summary file and the plaintext file are compressed into the same compressed file, and then the compressed file is encrypted using the national cryptographic algorithm to obtain a ciphertext file including the signature summary file and the original file.

[0184] According to embodiments of this disclosure, compressed files can be encrypted using the SM2 algorithm, which has a key length and block length of 128 bits. SM2 is an asymmetric encryption algorithm based on Error Correcting Code (ECC), and its signature and key generation speeds are faster than other asymmetric encryption algorithms.

[0185] Furthermore, the SM2 algorithm is based on the discrete logarithm problem of point groups on elliptic curves. Compared to other asymmetric encryption algorithms, the 256-bit SM2 cryptographic strength is higher than that of other 2048-bit algorithms.

[0186] According to embodiments of this disclosure, other algorithms of the national cryptographic algorithm can also be used to encrypt compressed files.

[0187] According to embodiments of this disclosure, since the banking industry transmits large amounts of data, has many types of transmitted data, and complex execution logic, the method of first compressing and then encrypting can effectively reduce the amount of transmitted data and increase the transmission speed; then, encrypting the compressed file can improve transmission security.

[0188] Figure 4 The illustration depicts an application scenario of the method for generating encrypted files according to embodiments of the present disclosure.

[0189] like Figure 4 As shown, the application scenario 400 of the method for generating ciphertext files in this embodiment includes a plaintext file 401, multiple decompressed files 402_1…402_M, multiple signature information 403_1…403_M corresponding to the multiple decompressed files 402_1…402_M, a signature summary file 404, and a ciphertext file 405.

[0190] In the embodiments of this disclosure, in response to the detection of a newly added plaintext file 401 in the plaintext folder, it is determined that the plaintext file is in compressed format. Then, the plaintext file 404 is decompressed to obtain multiple decompressed files 402_1…402_M. The signing interface of the signature server is called to sign each decompressed file, resulting in multiple signature information 403_1…403_M.

[0191] After determining multiple signature information 403_1…403_M, the multiple signature information 403_1…403_M are written into the same signature summary file 404. The plaintext file 401 and the signature summary file are compressed into the same compressed file, and the compressed file is encrypted to obtain the ciphertext file 405.

[0192] According to an embodiment of this disclosure, after storing the ciphertext file to the second storage area of ​​the ciphertext folder according to the first storage area, the method includes: modifying the filename of the plaintext file to a first preset format within the plaintext folder.

[0193] According to embodiments of this disclosure, the first preset form includes adding preset characters, such as "encrypted" or "processed," to the original filename.

[0194] According to embodiments of this disclosure, after storing the ciphertext file in the second storage area of ​​the ciphertext folder according to the first storage area, the processed plaintext file can also be deleted from the plaintext folder to avoid duplicate processing.

[0195] According to embodiments of this disclosure, after encrypting a plaintext file, the ciphertext file is placed in a ciphertext folder in the partition corresponding to the plaintext file, and the processed plaintext file in the plaintext folder is renamed to avoid duplicate processing.

[0196] According to embodiments of this disclosure, before determining at least one newly added plaintext file and a first storage area in the plaintext folder for storing plaintext files in response to detecting the presence of a newly added file in the plaintext folder, the method includes: adding at least one plaintext file in the plaintext folder in response to a user's preset operation, the preset operation including a new operation or a drag-and-drop operation.

[0197] According to embodiments of this disclosure, plaintext folders and encrypted folders are implemented based on the operating system's file system, thereby allowing users to perform preset operations using devices such as a mouse and keyboard to directly add plaintext files to the plaintext folder.

[0198] For example, users can see the plaintext folder on the terminal device's display interface and add plaintext files transparently to it by dragging and dropping. After the terminal device completes encryption, the encrypted files are transparently displayed in the encrypted folder on the display interface.

[0199] The embodiments disclosed herein can realize a seamless encryption, decryption, signature, and verification mechanism based on the file system, without the need for a database or other operating system. The implementation method is simple and easy for developers to maintain.

[0200] Figure 5 The illustration depicts an application scenario of a data encryption method according to a specific embodiment of the present disclosure.

[0201] like Figure 5 As shown, the application scenario 500 of the data encryption method in this embodiment includes a plaintext folder 501 before encryption, a plaintext folder 502 after encryption, and a ciphertext folder 503 after encryption.

[0202] In the plaintext folder 501 before encryption, area A was designated for asset retrieval. Area A contained three newly added plaintext files: file1.docx, file2.txt, and file3.zip. After encrypting these three new plaintext files, ciphertext files corresponding to the aforementioned plaintext files were obtained.

[0203] After encrypting files 1.docx, 2.txt, and 3.zip, rename them as shown in the encrypted plaintext folder 502. Rename file 1.docx to Encrypted-File1.docx, file 2.txt to Encrypted-File2.txt, and file 3.zip to Encrypted-File3.zip.

[0204] Based on region A where the plaintext file was located before encryption, the three encrypted files are stored in region A of the encrypted ciphertext folder 503. The filenames of the three ciphertext files are the same as the plaintext files. However, because the files were compressed during the encryption process, all three ciphertext files have the extension .zip, such as file1.zip, file2.zip, and file3.zip.

[0205] The encrypted ciphertext folder 503 can transfer files 1.zip, 2.zip, and 3.zip to the recipient via a network or offline device.

[0206] The embodiments of this disclosure can be implemented by a separate component that does not affect the original application system and can also achieve secure file processing.

[0207] According to embodiments of this disclosure, for plaintext documents being processed, automatic business processing, data mining, artificial intelligence analysis, and other processing can be performed before encryption and signing, and after decryption and signature verification.

[0208] Figure 6 A flowchart illustrating a data decryption method according to an embodiment of the present disclosure is shown schematically.

[0209] like Figure 6 As shown, the data decryption method 600 of this embodiment includes operations S610 to S640.

[0210] In operation S610, in response to detecting that a new file has been added to the ciphertext folder, at least one new ciphertext file and a second storage area in the ciphertext folder for storing the ciphertext file are determined, and the ciphertext folder is set on the disk.

[0211] The S620 is used to decrypt the ciphertext file, generating a signature summary file and a plaintext file.

[0212] When operating the S630, the plaintext file is verified using the signature summary file to obtain the verification result.

[0213] In operation S640, if the verification result indicates that the plaintext file is secure, the plaintext file is stored in the first storage area of ​​the plaintext folder according to the second storage area. The second storage area corresponds to the first storage area, and the plaintext folder is set on the disk.

[0214] According to embodiments of this disclosure, after receiving the encrypted file from the sender, the receiving end stores it in a designated encrypted folder on the disk.

[0215] According to embodiments of this disclosure, when a terminal device detects the presence of newly added ciphertext files in a ciphertext folder, it can perform decryption and signature verification on the ciphertext files. When multiple newly added ciphertext files are detected, decryption and signature verification can be performed on multiple ciphertext files simultaneously.

[0216] According to embodiments of this disclosure, the newly added ciphertext file is first decrypted and decompressed to obtain a plaintext file and a signature summary file. Since the signature summary file includes one or more signature information, the terminal device can use the signature summary file to verify the plaintext file to obtain the verification result.

[0217] According to embodiments of this disclosure, upon detecting the presence of a newly added ciphertext file, the ciphertext file is first decrypted to obtain a signature summary file and a plaintext file, comprising the following steps:

[0218] The signature verification interface of the signature server is called to decrypt the encrypted file and obtain a compressed file.

[0219] Decompress the compressed file to obtain a signature summary file and a plaintext file.

[0220] According to embodiments of this disclosure, during encryption, the plaintext file and the signature summary file are first compressed, and then encrypted to obtain the ciphertext file. Therefore, during decryption, the ciphertext file is encrypted by calling the signature verification interface of the signature server to obtain a compressed file, and then the compressed file is decompressed to obtain the signature summary file and the plaintext file.

[0221] If the verification results indicate that the plaintext file is secure, the plaintext file is stored in the first storage area of ​​the plaintext folder according to the second storage area. The second storage area corresponds to the first storage area, and the plaintext folder is set on the disk.

[0222] If the verification result indicates that the plaintext file is insecure, an error message is returned to the sender, and the execution of the purpose corresponding to the plaintext message is rejected.

[0223] The embodiments of this disclosure, in response to the detection of a newly added file in a encrypted folder, determine at least one newly added encrypted file and a second storage area in the encrypted folder for storing the encrypted file; decrypt the encrypted file to generate a signature summary file and a plaintext file; verify the plaintext file using the signature summary file to obtain a verification result; if the verification result indicates that the plaintext file is secure, store the plaintext file in the first storage area of ​​the plaintext folder according to the second storage area. Since the encrypted folders are all located on the disk of the terminal device, they do not depend on applications within the terminal device and can be directly decrypted based on the terminal device's operating system. The decryption process requires no manual intervention, reducing development and maintenance costs.

[0224] Furthermore, since the terminal device can decrypt the newly added encrypted file when it detects it in the encrypted folder, and store the decrypted file in the first storage area of ​​the plaintext file, business personnel can clearly know which files have been decrypted, achieving transparent decryption and improving user experience.

[0225] According to embodiments of this disclosure, the verification result includes a first verification result. Verifying a plaintext file using a signature summary file to obtain a verification result includes: determining, based on the signature summary file, that the plaintext file contains M signature information, where M ≥ 1; designing the signature information to obtain M designed information; and verifying the plaintext file based on the plaintext file and the designed information to obtain a first verification result, so as to determine whether the plaintext file is secure based on the first verification result.

[0226] According to embodiments of this disclosure, after obtaining the signature summary file and the plaintext file, one or more signature information is obtained from the signature summary file, the public key of the sending end is used to design and verify whether the signature of each file is correct, and a first verification result is obtained.

[0227] According to an embodiment of this disclosure, when the verification result includes only the first verification result, in operation S640, if it is determined that the first verification result indicates that the plaintext file is secure, the plaintext file is stored in the first storage area of ​​the plaintext folder according to the second storage area.

[0228] As another embodiment of this disclosure, the verification results include not only the first verification result but also the second verification result.

[0229] According to embodiments of this disclosure, before verifying the plaintext file based on the plaintext file and designing information to obtain a first verification result, the method further includes: if it is determined that the plaintext file includes verification information, verifying the plaintext file according to the verification information to obtain a verification result; and determining a second verification result based on the verification result and the verification information, wherein the second verification result is used to characterize whether the verification result is consistent with the verification information, so as to determine whether the plaintext file is secure based on the first verification result and the second verification result.

[0230] According to embodiments of this disclosure, after decrypting the ciphertext file to obtain a signature summary file and a plaintext file, it is first determined whether the plaintext file includes verification information. If it is determined that the plaintext file does not contain verification information, the above-described scheme that only includes the first verification result is executed.

[0231] If the plaintext information includes verification information, the terminal device performs a verification operation on the plaintext file based on the verification information to obtain a verification result. Based on the verification result and the verification information, a second verification result is determined.

[0232] For example, the verification information includes data length and user type, specifically 100 data units and 100 VIP users. The terminal device verifies the data length and user type of the plaintext file, obtaining a verification result of 100 data units and 100 VIP users. Since the verification result and the verification information are completely consistent, the second verification result is confirmed as consistent, indicating security.

[0233] If the verification result shows that the data length is 100 and there are 101 VIP users, the data length is the same, but the user types are different, then the second verification result is inconsistent, indicating insecurity.

[0234] According to an embodiment of this disclosure, when the verification result includes a first verification result and a second verification result, if both the first verification result and the second verification result indicate security, the plaintext file is stored in the first storage area of ​​the plaintext folder according to the second storage area.

[0235] If the first verification result and / or the second verification result indicate insecurity, an error message is returned to the sender, and the execution of the purpose corresponding to the plaintext message is rejected.

[0236] According to embodiments of this disclosure, before determining at least one newly added ciphertext file and a second storage area in the ciphertext folder for storing the ciphertext file in response to detecting the presence of a newly added file in the ciphertext folder, the method includes: adding at least one ciphertext file in the ciphertext folder in response to a user's preset operation, the preset operation including a new operation or a drag-and-drop operation.

[0237] According to embodiments of this disclosure, plaintext folders and encrypted folders are implemented based on the operating system's file system, thereby allowing users to perform preset operations using devices such as a mouse and keyboard to directly add encrypted files to the encrypted folder.

[0238] For example, users can see the encrypted folder on the terminal device's display interface and add encrypted files transparently to it by dragging and dropping. After the terminal device completes decryption, the plaintext files are then transparently displayed in the plaintext folder on the display interface.

[0239] The embodiments disclosed herein can realize a seamless encryption, decryption, signature, and verification mechanism based on the file system, without the need for a database or other operating system. The implementation method is simple and easy for developers to maintain.

[0240] According to an embodiment of this disclosure, after storing the plaintext file to the first storage area of ​​the plaintext folder according to the second storage area, the method includes: modifying the filename of the ciphertext file to a second preset format within the ciphertext folder.

[0241] According to embodiments of this disclosure, the second preset form includes adding preset characters, such as "decrypted" or "processed," to the original filename.

[0242] According to embodiments of this disclosure, after storing the plaintext file in the first storage area of ​​the plaintext folder according to the second storage area, the processed ciphertext file can also be deleted from the ciphertext folder to avoid duplicate processing.

[0243] According to embodiments of this disclosure, after decrypting the ciphertext file, the decrypted plaintext file is placed in the plaintext folder of the partition corresponding to the ciphertext file, and the decrypted ciphertext file in the ciphertext folder is renamed to avoid duplicate processing.

[0244] Figure 7 The illustration depicts an application scenario of a data decryption method according to a specific embodiment of the present disclosure.

[0245] like Figure 7 As shown, the application scenario 700 of the data decryption method in this embodiment includes a ciphertext folder 701 before decryption, a ciphertext folder 702 after decryption, and a plaintext folder 703 after decryption.

[0246] In the undecrypted ciphertext folder 701, area A is designated for asset retrieval. Area A contains three newly added ciphertext files: file4.zip, file5.zip, and file6.zip. After decrypting these three new ciphertext files, the corresponding plaintext files are obtained.

[0247] After decrypting files 4.zip, 5.zip, and 6.zip, rename them as shown in the decrypted ciphertext folder 702. Rename file 4.zip to "Decrypted-File 4.zip", file 5.zip to "Decrypted-File 5.zip", and file 6.zip to "Decrypted-File 6.zip".

[0248] Based on the area A where the ciphertext file was located before decryption, store the three decrypted plaintext files in area A of the decrypted plaintext folder 703. The filenames of the three plaintext files are the same as the ciphertext files, but the extensions of the three plaintext files are restored from zip to their original extensions before encryption, such as file 4.docx, file 5.txt, and file 6.xml.

[0249] The application system can retrieve the plaintext files in the decrypted plaintext folder 703 for subsequent business processing.

[0250] Figure 8 A schematic block diagram of a data encryption device according to an embodiment of the present disclosure is shown.

[0251] like Figure 8 As shown, the data encryption device 800 of this embodiment includes a first determining module 810, a signing module 820, an encryption module 830, and a first storage module 840.

[0252] The first determining module 810 is configured to, in response to detecting a newly added file in a plaintext folder, determine at least one newly added plaintext file and a first storage area in the plaintext folder for storing the plaintext file, wherein the plaintext folder is located on a disk. In one embodiment, the first determining module 810 may be used to perform the operation S210 described above, which will not be repeated here.

[0253] The signature module 820 is used to sign plaintext documents and generate a signature summary file. In one embodiment, the signature module 820 can be used to perform the operation S220 described above, which will not be repeated here.

[0254] The encryption module 830 is used to encrypt the signature summary file and the plaintext file to generate a ciphertext file. In one embodiment, the encryption module 830 can be used to perform the operation S230 described above, which will not be repeated here.

[0255] The first storage module 840 is used to store encrypted files into a second storage area of ​​an encrypted folder according to a first storage area. The second storage area corresponds to the first storage area, and the encrypted folder is located on a disk. In one embodiment, the first storage module 840 can be used to perform the operation S240 described above, which will not be repeated here.

[0256] According to embodiments of this disclosure, the signature module 820 includes a first determining submodule, a second determining submodule, a calling submodule, and a writing submodule.

[0257] The first determining submodule is used to determine the file format of the plaintext file. In one embodiment, the first determining submodule can be used to perform the operation S321 described above, which will not be repeated here.

[0258] The second determining submodule is used to decompress the plaintext file when the file format is determined to be compressed, resulting in M ​​decompressed files, where M≥1. In one embodiment, the second determining submodule can be used to perform the operation S322 described above, which will not be repeated here.

[0259] The calling submodule is used to invoke the signature server's signing interface to sign each of the M decompressed files, obtaining M signature information. In one embodiment, the calling submodule can be used to perform the operation S323 described above, which will not be repeated here.

[0260] The write submodule is used to write M signature information to the same file to generate a signature summary file. In one embodiment, the write submodule can be used to perform the operation S324 described above, which will not be repeated here.

[0261] According to embodiments of this disclosure, the first determining submodule includes a scanning unit and a format determining unit.

[0262] The scanning unit is used to scan the file extensions of plaintext files, which include at least one of the following: text extension, table extension, image extension, and compressed file extension.

[0263] The format determination unit is used to determine the file format of a plaintext file based on its file extension.

[0264] According to embodiments of this disclosure, the signature module 820 further includes a query submodule, a first verification submodule, and an update submodule. Before calling the signature server's signature interface to sign the M decompressed files respectively and obtaining M signature information,

[0265] The query submodule is used to query the decompressed files based on query rules and obtain query results. The query rules are used to query and statistically analyze the decompressed files.

[0266] The first verification submodule is used to generate verification information based on the query results. The verification information includes at least one of the following: data length, data volume, number of files, and user type.

[0267] The update submodule is used to update the decompressed file using verification information.

[0268] According to embodiments of this disclosure, the signature module 820 further includes a purpose determination submodule and a rule determination submodule. Before querying the decompressed file based on query rules to obtain query results,

[0269] The Purpose Determination submodule is used to determine the purpose of decompressing the file based on the first storage area.

[0270] The rule determination submodule is used to determine query rules that match the intended purpose of the execution.

[0271] According to embodiments of this disclosure, the verification submodule includes a verification unit, which is used to add at least one verification field matching the type of verification information to the decompressed file, and fill the verification information as a data value into the verification field to update the decompressed file.

[0272] According to embodiments of this disclosure, the plaintext folder includes multiple first storage areas, and the encrypted folder includes multiple second storage areas. Both the first and second storage areas are used to characterize the execution purpose of the file, which includes at least one of the following: asset query, asset freezing, asset deduction, and asset payment on behalf of others.

[0273] According to embodiments of this disclosure, the encryption module 830 includes a first compression submodule and an encryption submodule.

[0274] The first compression submodule is used to compress the signature summary file and the plaintext file into a single compressed file.

[0275] The encryption submodule is used to encrypt compressed files using a preset encryption algorithm to obtain ciphertext files.

[0276] According to an embodiment of this disclosure, the data encryption device 800 includes a first modification submodule, which, after storing the ciphertext file to the second storage area of ​​the ciphertext folder according to the first storage area, is used to modify the file name of the plaintext file to a first preset form in the plaintext folder.

[0277] According to an embodiment of this disclosure, the data encryption device 800 further includes a first operation submodule, which, in response to detecting the presence of a newly added file in the plaintext folder and determining at least one newly added plaintext file and a first storage area in the plaintext folder for storing the plaintext file, is configured to add at least one plaintext file in the plaintext folder in response to a user's preset operation, the preset operation including a new operation or a drag-and-drop operation.

[0278] According to embodiments of this disclosure, any and multiple modules among the first determining module 810, signing module 820, encryption module 830, and first storage module 840 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module.

[0279] According to embodiments of this disclosure, at least one of the first determining module 810, the signature module 820, the encryption module 830, and the first storage module 840 can be at least partially implemented as a hardware circuit, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuit, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the first determining module 810, the signature module 820, the encryption module 830, and the first storage module 840 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0280] Figure 9 A schematic block diagram of a data decryption apparatus according to an embodiment of the present disclosure is shown.

[0281] like Figure 9 As shown, the data decryption device 900 of this embodiment includes a second determining module 910, a decryption module 920, a verification module 930, and a second storage module 940.

[0282] The second determining module 910 is configured to, in response to detecting a newly added file in the encrypted folder, determine at least one newly added encrypted file and a second storage area within the encrypted folder for storing the encrypted file, wherein the encrypted folder is located on a disk. In one embodiment, the second determining module 910 may be used to perform the operation S610 described above, which will not be repeated here.

[0283] The decryption module 920 is used to decrypt the ciphertext file and generate a signature summary file and a plaintext file. In one embodiment, the decryption module 920 can be used to perform the operation S620 described above, which will not be repeated here.

[0284] Verification module 930 is used to verify the plaintext file using the signature summary file and obtain the verification result. In one embodiment, verification module 930 can be used to perform the operation S630 described above, which will not be repeated here.

[0285] The second storage module 940 is used to store the plaintext file into the first storage area of ​​the plaintext folder according to the second storage area, provided that the verification result indicates the plaintext file is secure. The second storage area corresponds to the first storage area, and the plaintext folder is located on the disk. In one embodiment, the second storage module 940 can be used to perform the operation S640 described above, which will not be repeated here.

[0286] According to embodiments of this disclosure, the verification module 930 includes a third determination submodule, an unsignature submodule, and a verification submodule.

[0287] The third determination submodule is used to determine the M signature information included in the plaintext file based on the signature summary file, where M≥1.

[0288] The designing submodule is used to design the signature information and obtain M designing information.

[0289] The verification submodule is used to verify the plaintext file based on the plaintext file and the designing information, and obtain the first verification result so as to determine whether the plaintext file is secure.

[0290] According to embodiments of this disclosure, the verification module 930 further includes a second verification submodule and a third verification submodule.

[0291] The second verification submodule is used to verify the plaintext file based on the verification information, and obtain the verification result, if it is determined that the plaintext file contains verification information.

[0292] The third verification submodule is used to determine the second verification result based on the verification result and the verification information. The second verification result is used to characterize whether the verification result is consistent with the verification information, so as to determine whether the plaintext file is secure based on the first verification result and the second verification result.

[0293] According to embodiments of this disclosure, the decryption module 920 includes a decryption submodule and a second compression submodule.

[0294] The decryption submodule is used to call the signature verification interface of the signature server to decrypt the ciphertext file and obtain a compressed file.

[0295] The second compression submodule is used to decompress the compressed file to obtain a signature summary file and a plaintext file.

[0296] According to an embodiment of this disclosure, the data decryption device 900 includes a second modification submodule, which, after storing a plaintext file in a first storage area of ​​a plaintext folder according to a second storage area, modifies the filename of the ciphertext file to a second preset format within the ciphertext folder.

[0297] According to an embodiment of this disclosure, the data decryption device 900 further includes a second operation submodule, which, in response to detecting the presence of a newly added file in the encrypted folder and determining at least one newly added encrypted file and a second storage area in the encrypted folder for storing the encrypted file, is configured to add at least one encrypted file in the encrypted folder in response to a user's preset operation, the preset operation including a new operation or a drag-and-drop operation.

[0298] According to embodiments of this disclosure, any multiple modules among the second determining module 910, decryption module 920, verification module 930, and second storage module 940 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module.

[0299] According to embodiments of this disclosure, at least one of the second determining module 910, decryption module 920, verification module 930, and second storage module 940 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), programmable logic array (PLA), system-on-a-chip, system-on-a-substrate, system-on-package, application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in any one of software, hardware, and firmware methods, or in a suitable combination of any of these. Alternatively, at least one of the second determining module 910, decryption module 920, verification module 930, and second storage module 940 can be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0300] Figure 10 A block diagram schematically illustrates an electronic device suitable for data encryption and data decryption methods according to embodiments of the present disclosure.

[0301] like Figure 10 As shown, an electronic device 1000 according to an embodiment of the present disclosure includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage portion 1008 into a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1001 may also include onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0302] RAM 1003 stores various programs and data required for the operation of electronic device 1000. Processor 1001, ROM 1002, and RAM 1003 are interconnected via bus 1004. Processor 1001 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 1002 and / or RAM 1003. It should be noted that the programs may also be stored in one or more memories other than ROM 1002 and RAM 1003. Processor 1001 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0303] According to embodiments of this disclosure, the electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to a bus 1004. The electronic device 1000 may also include one or more of the following components connected to the I / O interface 1005: an input section 1006 including a keyboard, mouse, etc.; an output section 1007 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1010 as needed so that computer programs read from it can be installed into the storage section 1008 as needed.

[0304] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0305] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 1002 and / or RAM 1003 and / or one or more memories other than ROM 1002 and RAM 1003 described above.

[0306] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this disclosure.

[0307] When the computer program is executed by the processor 1001, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0308] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 1009, and / or installed from a removable medium 1011. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0309] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 1009, and / or installed from removable medium 1011. When the computer program is executed by processor 1001, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0310] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0311] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0312] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0313] The specific embodiments described above further illustrate the purpose, technical solutions, and beneficial effects of this disclosure. It should be understood that the above descriptions are merely specific embodiments of this disclosure and are not intended to limit this disclosure. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the protection scope of this disclosure.

Claims

1. A data encryption method, comprising: In response to the detection of a newly added file in a plaintext folder, at least one newly added plaintext file and a first storage area in the plaintext folder for storing the plaintext file are determined, wherein the plaintext folder is located on a disk; The off-line data retrieval and control application system generates plaintext files used for querying or controlling user data; The plaintext file is signed to generate a signature summary file; The signature summary file and the plaintext file are encrypted to generate a ciphertext file; Based on the first storage area, the encrypted file is stored in the second storage area of ​​the encrypted folder, the second storage area corresponding to the first storage area, and the encrypted folder is located on the disk; Plaintext folders and encrypted files are created based on the terminal device's operating system; The step of signing the plaintext file and generating a signature summary file includes: Determine the file format of the plaintext file; Given that the file format is a compressed format, the plaintext file is decompressed to obtain M decompressed files, where M≥1; The decompressed file is queried based on query rules to obtain query results. The query rules are used to query and statistically analyze the decompressed file. Based on the query results, verification information is generated, which includes at least one of the following: data length, data volume, number of files, and user type. The decompressed file is then updated using the verification information. The signature server's signing interface is called to sign the updated M decompressed files respectively, resulting in M ​​signature information; Following the order of the M decompressed files in the plaintext file, the M signature information is written into the same file to generate the signature summary file. If the verification of one of the M signature information fails, it is determined that all M signature information in the signature summary file are at risk.

2. The method according to claim 1, wherein, Determining the file format of the plaintext file includes: Scan the file extensions of the plaintext file, wherein the file extensions include at least one of the following: text extension, table extension, image extension, and compressed file extension; The file format of the plaintext file is determined based on its file extension.

3. The method according to claim 1, wherein, Before querying the decompressed file based on query rules and obtaining the query results, the process includes: Based on the first storage area, determine the execution purpose of the decompressed file; and Based on the stated purpose of execution, determine the query rules that match the stated purpose of execution.

4. The method according to claim 1, wherein, Updating the decompressed file using the verification information includes: At least one verification field matching the type of the verification information is added to the decompressed file, and the verification information is filled into the verification field as a data value to update the decompressed file.

5. The method according to claim 1, wherein, The plaintext folder includes multiple first storage areas, and the encrypted folder includes multiple second storage areas. Both the first and second storage areas are used to characterize the execution purpose of the file, which includes at least one of the following: asset query, asset freezing, asset deduction, and asset payment on behalf of others.

6. The method according to claim 1, wherein, The step of encrypting the signature summary file and the plaintext file to generate the encrypted ciphertext file includes: Compress the signature summary file and the plaintext file into a single compressed file; and The compressed file is encrypted using a preset encryption algorithm to obtain the ciphertext file.

7. The method according to claim 1, wherein, After storing the encrypted file to the second storage area of ​​the encrypted folder according to the first storage area, the process includes: Within the plaintext folder, the filenames of the plaintext files are modified to the first preset format.

8. The method according to claim 1, wherein, Before determining at least one newly added plaintext file and a first storage area in the plaintext folder for storing the plaintext file in response to detecting the presence of a newly added file in the plaintext folder, the process includes: In response to a user's preset operation, at least one plaintext file is added to the plaintext folder. The preset operation includes a new operation or a drag-and-drop operation.

9. A data decryption method, comprising: In response to the detection of a newly added file in the encrypted folder, at least one newly added encrypted file and a second storage area in the encrypted folder for storing the encrypted file are determined, wherein the encrypted folder is located on the disk; The encrypted file is decrypted to generate a signature summary file and a plaintext file; The plaintext file is verified using the signature summary file to obtain the verification result; If the verification result indicates that the plaintext file is secure, the plaintext file is stored in the first storage area of ​​the plaintext folder according to the second storage area, the second storage area corresponds to the first storage area, and the plaintext folder is set in the disk; Plaintext folders and encrypted files are created based on the operating system of the terminal device; the external query and control application system generates plaintext files for querying or controlling user data; The verification results include a first verification result and a second test result; The step of verifying the plaintext file using the signature summary file to obtain the verification result includes: Based on the signature summary file, determine the M signature information included in the plaintext file, where M ≥ 1; wherein, the M signature information in the signature summary file are arranged in the order of the M decompressed files in the plaintext file; The signature information is designed to obtain M designed information entries; and If it is determined that the plaintext file contains verification information, the plaintext file is verified according to the verification information to obtain a verification result; Based on the verification result and the verification information, a second verification result is determined, wherein the second verification result is used to characterize whether the verification result is consistent with the verification information; The plaintext file is verified based on the plaintext file and the designing information to obtain a first verification result. The plaintext file is then used to determine whether it is secure based on the first verification result and the second verification result. If the verification of one of the M signatures fails, it is determined that all M signatures in the signature summary file are at risk.

10. The method according to claim 9, wherein, The encrypted file is decrypted to generate a signature summary file and a plaintext file, including: The encrypted file is decrypted by calling the signature verification interface of the signature server to obtain a compressed file; The compressed file is decompressed to obtain the signature summary file and the plaintext file.

11. The method according to claim 9, wherein, Before determining at least one newly added ciphertext file and a second storage area in the ciphertext folder for storing the ciphertext file in response to detecting the presence of a newly added file in the ciphertext folder, the process includes: In response to a user's preset operation, at least one encrypted file is added to the encrypted folder. The preset operation includes a new operation or a drag-and-drop operation.

12. The method according to claim 9, wherein, After storing the plaintext file to the first storage area of ​​the plaintext folder according to the second storage area, the process includes: Within the encrypted folder, the filenames of the encrypted files are modified to a second preset format.

13. A data encryption device, comprising: The first determining module is configured to, in response to detecting that a new file has been added to a plaintext folder, determine at least one new plaintext file and a first storage area in the plaintext folder for storing the plaintext file, wherein the plaintext folder is located on a disk; The off-line data retrieval and control application system generates plaintext files used for querying or controlling user data; The signature module is used to sign the plaintext file and generate a signature summary file; The encryption module is used to encrypt the signature summary file and the plaintext file to generate a ciphertext file; The first storage module is used to store the encrypted file into a second storage area of ​​the encrypted folder according to the first storage area. The second storage area corresponds to the first storage area. The encrypted folder is located in the disk. The plaintext folder and the encrypted file are created based on the operating system of the terminal device. The signature module is further used for: Determine the file format of the plaintext file; Given that the file format is a compressed format, the plaintext file is decompressed to obtain M decompressed files, where M≥1; The decompressed file is queried based on query rules to obtain query results. The query rules are used to query and statistically analyze the decompressed file. Based on the query results, verification information is generated, which includes at least one of the following: data length, data volume, number of files, and user type. The decompressed file is then updated using the verification information. The signature server's signing interface is called to sign the updated M decompressed files respectively, resulting in M ​​signature information; Following the order of the M decompressed files in the plaintext file, the M signature information is written into the same file to generate the signature summary file. If the verification of one of the M signature information fails, it is determined that all M signature information in the signature summary file are at risk.

14. A data decryption device, comprising: The second determining module is used to determine at least one newly added ciphertext file and a second storage area in the ciphertext folder for storing the ciphertext file in response to detecting that a new file has been added in the ciphertext folder, wherein the ciphertext folder is located on the disk. The decryption module is used to decrypt the ciphertext file and generate a signature summary file and a plaintext file; The verification module is used to verify the plaintext file using the signature summary file and obtain the verification result; The verification results include a first verification result and a second test result; The second storage module is used to store the plaintext file in the first storage area of ​​the plaintext folder according to the second storage area when the verification result indicates that the plaintext file is secure. The second storage area corresponds to the first storage area, and the plaintext folder is set in the disk. Plaintext folders and encrypted files are created based on the terminal device's operating system; The off-line data retrieval and control application system generates plaintext files used for querying or controlling user data; The verification module is further configured to include: Based on the signature summary file, determine the M signature information included in the plaintext file, where M ≥ 1; wherein, the M signature information in the signature summary file are arranged in the order of the M decompressed files in the plaintext file; The signature information is designed to obtain M designed information entries; and If it is determined that the plaintext file contains verification information, the plaintext file is verified according to the verification information to obtain a verification result; Based on the verification result and the verification information, a second verification result is determined, wherein the second verification result is used to characterize whether the verification result is consistent with the verification information; The plaintext file is verified based on the plaintext file and the designing information to obtain a first verification result. The plaintext file is then used to determine whether it is secure based on the first verification result and the second verification result. If the verification of one of the M signatures fails, it is determined that all M signatures in the signature summary file are at risk.

15. An electronic device comprising: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 12.

16. A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 12.

17. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 12.

Images