File encryption method, file decryption method, and file encryption transmission system

Abstract

This specification provides one or more embodiments of a file encryption method, a file decryption method, and a file encryption transmission system. The file encryption transmission system includes an encryptor and a decryptor; the encryptor encrypts an original file according to its own determined encryption method to obtain an encrypted file corresponding to the original file; wherein, the encrypted file includes ciphertext data obtained by encrypting the file content of the original file, and metadata used to describe the encryption method; the encryptor transmits the encrypted file to the decryptor; the decryptor determines the encryption method for the original file based on the metadata included in the encrypted file, and decrypts the ciphertext data included in the encrypted file according to the decryption method corresponding to the encryption method to obtain the original file.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and more particularly to a file encryption method, apparatus, electronic device and machine-readable storage medium, a file decryption method, apparatus, electronic device and machine-readable storage medium, and a file encryption transmission system. Background Technology

[0002] In privacy computing or big data computing scenarios, in order to ensure data security and avoid the leakage of raw data during data transmission and storage, the raw data in plaintext form can be encrypted first, and then the encrypted ciphertext data can be transmitted, stored, and processed.

[0003] During the encrypted transmission of data, the encryptor and decryptor usually need to agree on the encryption method for the original file in advance. Subsequently, the encryptor usually needs to encrypt the original file according to the agreed encryption method to obtain the corresponding encrypted file, and can transmit the encrypted file corresponding to the original file to the decryptor so that the decryptor can decrypt the obtained encrypted file according to the decryption method corresponding to the agreed encryption method and recover the original file.

[0004] If the encryptor temporarily changes the encryption method and encrypts the original file according to the new encryption method, the decryptor will be unable to successfully decrypt the encrypted file according to the decryption method corresponding to the previously agreed encryption method, and thus will also be unable to successfully recover the original file, causing inconvenience to both the encryptor and the decryptor. Summary of the Invention

[0005] This application provides a file encryption method, the method comprising:

[0006] Determine the encryption method for the original file;

[0007] The original file is encrypted according to the encryption method to obtain an encrypted file corresponding to the original file; wherein, the encrypted file includes ciphertext data obtained by encrypting the file content of the original file, and metadata used to describe the encryption method.

[0008] This application also provides a file decryption method, the method comprising:

[0009] Obtain the encrypted file corresponding to the original file; wherein the encrypted file includes ciphertext data obtained by encrypting the file content of the original file, and metadata describing the encryption method for the original file;

[0010] Based on the metadata included in the encrypted file, the encryption method for the original file is determined, and the ciphertext data included in the encrypted file is decrypted according to the decryption method corresponding to the encryption method.

[0011] This application also provides a file encryption transmission system, the system comprising an encryptor and a decryptor;

[0012] The encryptor encrypts the original file according to its own determined encryption method to obtain an encrypted file corresponding to the original file; wherein, the encrypted file includes ciphertext data obtained by encrypting the file content of the original file, and metadata used to describe the encryption method;

[0013] The encrypting party transmits the encrypted file to the decrypting party;

[0014] The decryption party determines the encryption method for the original file based on the metadata included in the encrypted file, and decrypts the ciphertext data included in the encrypted file according to the decryption method corresponding to the encryption method to obtain the original file.

[0015] This application also provides a file encryption device, the device comprising:

[0016] The first determining unit is used to determine the encryption method for the original file;

[0017] An encryption unit is configured to encrypt the original file according to the encryption method to obtain an encrypted file corresponding to the original file; wherein the encrypted file includes ciphertext data obtained by encrypting the file content of the original file, and metadata for describing the encryption method.

[0018] This application also provides a file decryption device, the device comprising:

[0019] An acquisition unit is used to acquire an encrypted file corresponding to the original file; wherein, the encrypted file includes ciphertext data obtained by encrypting the file content of the original file, and metadata describing the encryption method for the original file;

[0020] The decryption unit is used to determine the encryption method for the original file based on the metadata included in the encrypted file, and to decrypt the ciphertext data included in the encrypted file according to the decryption method corresponding to the encryption method.

[0021] This application also provides an electronic device, including a communication interface, a processor, a memory, and a bus, wherein the communication interface, the processor, and the memory are interconnected via the bus;

[0022] The memory stores machine-readable instructions, and the processor executes the above-mentioned file encryption method or file decryption method by calling the machine-readable instructions.

[0023] This application also provides a machine-readable storage medium storing machine-readable instructions, which, when called and executed by a processor, implement the above-described file encryption or decryption method.

[0024] Through the above embodiments, on the one hand, by adding metadata describing the encryption method for the original file to the encrypted file, a self-interpreting encrypted file format is realized. This allows the encryptor to encrypt the original file using any encryption method without prior agreement with the decryptor. The decryptor can still successfully decrypt the ciphertext data in the encrypted file based on the metadata obtained from the encrypted file and successfully recover the original file. This improves the flexibility of file encryption and enhances the user experience for both the encryptor and the decryptor.

[0025] On the other hand, since the decryptor can determine the encryption method for the original file based on the metadata in the obtained encrypted file, and can decrypt the ciphertext data in the obtained encrypted file according to the decryption method corresponding to the determined encryption method, the decryptor can successfully decrypt encrypted files obtained with different encryption methods and successfully recover the original file based on this self-interpreting encrypted file format without having to agree on the encryption method with the encryptor in advance. This improves the flexibility of file decryption and also improves the user experience for both the encryptor and the decryptor. Attached Figure Description

[0026] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This is a schematic diagram illustrating an encrypted file as an exemplary embodiment;

[0028] Figure 2 This is a flowchart illustrating a file encryption method as an exemplary embodiment;

[0029] Figure 3 This is a flowchart illustrating a file decryption method as an exemplary embodiment;

[0030] Figure 4 This is a schematic diagram illustrating a file processing flow as an exemplary embodiment;

[0031] Figure 5 This is a schematic diagram of the structure of an electronic device containing a file encryption or decryption device, as shown in an exemplary embodiment.

[0032] Figure 6 This is a block diagram illustrating a file encryption device as an exemplary embodiment;

[0033] Figure 7 This is a block diagram illustrating a file decryption apparatus as an exemplary embodiment. Detailed Implementation

[0034] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0035] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0036] In privacy computing or big data computing scenarios, in order to ensure data security and avoid the leakage of raw data during data transmission and storage, the raw data in plaintext form can be encrypted first, and then the encrypted ciphertext data can be transmitted, stored, and processed.

[0037] During the encrypted transmission of data, the encryptor and decryptor usually need to agree on the encryption method for the original file in advance. Subsequently, the encryptor usually needs to encrypt the original file according to the agreed encryption method to obtain the corresponding encrypted file, and can transmit the encrypted file corresponding to the original file to the decryptor so that the decryptor can decrypt the obtained encrypted file according to the decryption method corresponding to the agreed encryption method and recover the original file.

[0038] Therefore, in the embodiments shown above, if the encryptor temporarily adjusts the encryption method without agreeing with the decryptor and encrypts the original file according to the new encryption method, the decryptor will be unable to successfully decrypt the obtained encrypted file according to the decryption method corresponding to the previously agreed encryption method, and thus will also be unable to successfully recover the original file, causing inconvenience to both the encryptor and the decryptor.

[0039] In view of this, this specification aims to propose a self-interpreting encrypted file format, so that the encryptor and decryptor do not need to agree on the encryption method in advance, and the decryptor can directly recover the original file from the encrypted file.

[0040] First, the encryptor can encrypt the original file according to a self-interpreting encrypted file format. In implementation, the encryption method for the original file can be determined, and the original file can be encrypted according to the encryption method to obtain an encrypted file corresponding to the original file. The encrypted file may include ciphertext data obtained by encrypting the file content of the original file, and metadata describing the encryption method.

[0041] For example, the original file could be "plain.txt", meaning the original file's name is "plain" and its file format is txt. The encryptor can determine that the encryption method for the original file is the AES-GCM (Advanced Encryption Standard-Galois / Counter Mode) algorithm. Furthermore, the encryptor can encrypt the original file "plain.txt" using its own determined AES-GCM algorithm and its own encryption key to obtain the corresponding encrypted file "File Object".

[0042] Please see Figure 1 , Figure 1 This is a schematic diagram illustrating an encrypted file as an exemplary embodiment. (As shown) Figure 1 As shown, an encrypted file "File Object" can include cipher data and metadata; the cipher data can be obtained by encrypting the contents of the original file "plain.txt"; the metadata can at least describe that the encryption method for the original file "plain.txt" is the AES-GCM algorithm.

[0043] It should be noted that in related technologies, the metadata of encrypted files is usually only used to describe the file identifier, file size, modification timestamp, and other descriptive information of the encrypted file, and is not used to describe the encryption method used on the original file.

[0044] Furthermore, the encryptor can transmit the encrypted file corresponding to the original file to the decryptor; after obtaining the encrypted file, the decryptor can determine the encryption method for the original file based on the metadata included in the encrypted file, and decrypt the ciphertext data included in the encrypted file according to the decryption method corresponding to the encryption method.

[0045] For example, such as Figure 1 As shown, after obtaining the encrypted file "FileObject" corresponding to the original file "plain.txt", the decryptor can determine that the encryption method for the original file "plain.txt" is the AES-GCM algorithm based on the metadata included in the encrypted file "FileObject". The decryptor can then decrypt the ciphertext data included in the encrypted file "FileObject" according to the decryption method corresponding to the AES-GCM algorithm to obtain the file content of the original file "plain.txt", and thus recover the original file "plain.txt".

[0046] Therefore, the technical solution in this specification, on the one hand, by adding metadata to the encrypted file to describe the encryption method for the original file, implements a self-interpreting encrypted file format. This allows the encryptor to encrypt the original file using any encryption method without prior agreement with the decryptor. The decryptor can still successfully decrypt the ciphertext data in the encrypted file based on the metadata obtained from the encrypted file and successfully recover the original file. This improves the flexibility of file encryption and enhances the user experience for both the encryptor and the decryptor.

[0047] On the other hand, since the decryptor can determine the encryption method for the original file based on the metadata in the obtained encrypted file, and can decrypt the ciphertext data in the obtained encrypted file according to the decryption method corresponding to the determined encryption method, the decryptor can successfully decrypt encrypted files obtained with different encryption methods and successfully recover the original file based on this self-interpreting encrypted file format without having to agree on the encryption method with the encryptor in advance. This improves the flexibility of file decryption and also improves the user experience for both the encryptor and the decryptor.

[0048] The present application will now be described through specific embodiments and in conjunction with specific application scenarios.

[0049] Please see Figure 2 , Figure 2 This is a flowchart illustrating a file encryption method as an exemplary embodiment.

[0050] In this specification, the file encryption method described can be applied to the encrypting party. For example, in a privacy computing scenario, the file encryption method described in this specification can be executed by a privacy computing node corresponding to the encrypting party. As another example, in a big data computing scenario, the file encryption method described in this specification can be executed by a computing node corresponding to the encrypting party.

[0051] In some possible embodiments, in order to improve the security of file data and avoid the leakage of original data during the file encryption process, the file encryption method in this specification can be executed by a file encryption application running in a Trusted Execution Environment (TEE).

[0052] like Figure 2 As shown, the file encryption method can perform the following steps:

[0053] Step 202: Determine the encryption method for the original file.

[0054] For example, the original file can be "plain.txt", meaning the original file name is "plain" and the file format is txt. The encryptor can determine that the encryption method for the original file is the AES-GCM (Advanced Encryption Standard-Galois / Counter Mode) algorithm. It should be noted that in step 202, the encryption method for the original file can be entirely determined by the encryptor without prior agreement with the decryptor.

[0055] In step 202, the encryption method can be any file encryption algorithm, and this specification does not limit it. For example, the encryption method for the original file can be AES (Advanced Encryption Standard), DES (Data Encryption Standard), RSA algorithm, ECC (Elliptic Curve Cryptography), etc.

[0056] In step 202, the file format of the original file is not specifically limited in this specification. For example, the file format of the original file may include, but is not limited to, txt, csv, bin, etc.

[0057] Step 204: Encrypt the original file according to the encryption method to obtain an encrypted file corresponding to the original file; wherein, the encrypted file includes ciphertext data obtained by encrypting the file content of the original file, and metadata used to describe the encryption method.

[0058] For example, the encryptor can encrypt the original file "plain.txt" using its own determined AES-GCM algorithm and its own encryption key, obtaining the corresponding encrypted file "File Object". Figure 1 As shown, an encrypted file "File Object" can include cipher data (cipher_data) and metadata; the cipher data (cipher_data) can be obtained by encrypting the contents of the original file "plain.txt"; the "encryption: aesgcm" field in the metadata can be used to describe that the encryption method for the original file "plain.txt" is the AES-GCM algorithm.

[0059] In one embodiment shown, since some encryption methods can only support a limited amount of file data, when the original file has a large amount of data, the original file can be split into fragments first, and then each fragment can be encrypted. This enables the original file to support a self-interpreting encrypted file format for any file size and any file format.

[0060] In this case, prior to step 204, the method may further include: determining a fragmentation threshold for fragmenting the original file; and fragmenting the original file according to the fragmentation threshold to obtain several file fragments corresponding to the original file.

[0061] In this case, encrypting the original file according to the encryption method to obtain an encrypted file corresponding to the original file may specifically include: encrypting each file segment corresponding to the original file according to the encryption method to obtain encrypted file segments, and generating an encrypted file corresponding to the original file based on the encrypted file segments; wherein, the encrypted file includes ciphertext data obtained by encrypting each file segment corresponding to the original file, and metadata for describing the encryption method and the file format of the original file.

[0062] For example, the original file "plain.txt" could be 1GB in size. The encryptor can determine that the fragmentation threshold (fixed_size) used for fragmenting the original file "plain.txt" is 8MB, and can fragment the original file "plain.txt" according to the fragmentation threshold (fixed_size) to obtain several file fragments corresponding to the original file (no less than 1024 / 8 = 128 file fragments), such as: file fragment chunk_0, file fragment chunk_1, ..., file fragment chunk_n (n≥127, n is a positive integer); further, the encryptor can encrypt each file fragment corresponding to the original file "plain.txt" according to its own determined AES-GCM algorithm and based on its own encryption key, to obtain encrypted file fragments, such as: encrypted file fragment cipher_chunk_0, encrypted file fragment cipher_chunk_1, ..., encrypted file fragment cipher_chunk_n; further, the encryptor can generate an encrypted file "File" corresponding to the original file "plain.txt" based on the encrypted file fragments. "Object". For example, Figure 1 As shown, the ciphertext data (cipher_data) included in the encrypted file "File Object" can include the encrypted file fragments; the "format: txt" field in the metadata can be used to describe that the original file "plain.txt" is in txt format.

[0063] In the embodiments shown above, the fragment identifier of each file fragment can be used to indicate the positional order of each file fragment in the original file; so that during the file decryption stage, the decryptor can perform fragment merging processing on each file fragment according to the fragment identifier of each file fragment, and can also perform integrity verification on the obtained encrypted file, thereby promptly determining whether file fragments have been transmitted incorrectly during the transmission of the encrypted file.

[0064] In some possible embodiments, the metadata included in the encrypted file can also be used to describe the number of file fragments corresponding to the original file. For example, the "chunk_num: n+1" field in the metadata can be used to describe that the number of file fragments corresponding to the original file "plain.txt" is n+1. During the file decryption stage, the decryptor can perform integrity verification on the obtained encrypted file based on the "chunk_num: n+1" field in the metadata, thereby promptly determining whether any file fragments have been lost during transmission.

[0065] In the embodiments shown above, the file fragments corresponding to the original file can maintain the data structure of the original file; the fragment sizes of each file fragment can be unequal. That is, in related technologies, the original file is usually divided into several file fragments of equal size according to a preset fragmentation specification, which may lead to the destruction of the data structure of the original file. However, in the technical solution of this specification, the fragment sizes of each file fragment can be unequal and can be flexibly adjusted during the fragmentation process of the original file, as long as the fragment size of each file fragment does not exceed the fragmentation threshold, so that each file fragment can maintain the data structure of the original file.

[0066] For example, CSV is a file format that stores tabular data in plain text. A CSV file can consist of any number of records, separated by newline characters. In related technologies, the original file is typically divided into several file fragments, each 8MB in size, according to a preset fragmentation specification (e.g., 8MB). This may result in a single record in the CSV file being split into two file fragments, thus corrupting the data structure of the original file. However, in the technical solution of this specification, a complete record can be divided into the same file fragment, thereby avoiding corruption of the original file's data structure. Therefore, in the embodiments shown above, when the original file size is 1GB and the fragmentation threshold is 8MB, the number of file fragments obtained by fragmenting the original file may be greater than 128.

[0067] In practical applications, the encryptor typically encodes the text content of the original file according to a pre-agreed file encoding method, and then encrypts the encoded original file. Therefore, if the encryptor temporarily adjusts the text encoding method without agreeing with the decryptor and encodes the text content of the original file according to the new file encoding method, the decryptor will be unable to successfully decode the decrypted text content according to the text decoding method corresponding to the previously agreed text encoding method, and thus will be unable to successfully recover the original file.

[0068] In one embodiment shown, a file format that supports self-interpreting text encoding and file encryption can be implemented, so that the encryptor and decryptor do not need to agree on the text encoding method and encryption method in advance. The decryptor can successfully decrypt and decode the ciphertext data included in the encrypted file based on the metadata included in the encrypted file, and then successfully recover the original file. This improves the flexibility of file encryption and also improves the user experience for both the encryptor and decryptor.

[0069] In this case, prior to step 204, the method may further include: determining a text encoding method for encoding the text content of the original file; and encoding the text content of the original file according to the text encoding method.

[0070] In this case, encrypting the original file according to the encryption method to obtain an encrypted file corresponding to the original file may specifically include: encrypting the encoded original file according to the encryption method to obtain an encrypted file corresponding to the original file; wherein, the encrypted file includes ciphertext data obtained by encrypting the encoded original file, and metadata used to describe the encryption method and the text encoding method.

[0071] For example, the encryptor can determine that the original file "plain.txt" is encoded in UTF-8, and can encode the text content of the original file "plain.txt" according to UTF-8 encoding; that is, it can convert the text content of the original file "plain.txt" from UTF-8 characters to ASCII codes. Furthermore, the encryptor can encrypt the encoded original file using its own determined AES-GCM algorithm and its own encryption key, obtaining an encrypted file "File Object" corresponding to the original file "plain.txt". For example, Figure 1 As shown, the ciphertext data (cipher_data) included in the encrypted file "FileObject" can be the ciphertext data obtained by encrypting the original encoded file; the "encoding: utf-8" field in the metadata can be used to describe that the text encoding method of the original file "plain.txt" is utf-8 encoding.

[0072] The text encoding method can be any text encoding method, and this specification does not limit it. For example, the text encoding method for the original file can be UTF-8 (Unicode Transformation Format-8), UTF-16, GBK (Chinese Internal Code Specification), GB2312, etc.

[0073] In practical applications, to reduce the amount of data in file encryption or file transfer, the encryptor can first compress the original file according to a pre-agreed file compression method, and then encrypt the compressed original file. Therefore, if the encryptor temporarily adjusts the file compression method without agreeing with the decryptor and compresses the original file according to the new file compression method, the decryptor will be unable to successfully decompress the decrypted file data according to the file decompression method corresponding to the previously agreed file compression method, and thus will be unable to successfully recover the original file.

[0074] In one embodiment shown, a file format that supports self-interpreting file compression and file encryption can be implemented, so that the encryptor and decryptor do not need to agree on the file compression and encryption methods in advance. The decryptor can successfully decompress and decode the ciphertext data included in the encrypted file based on the metadata included in the encrypted file, and then successfully recover the original file. This improves the flexibility of file encryption and also improves the user experience for both the encryptor and decryptor.

[0075] In this case, prior to step 204, the method may further include: determining a file compression method to be used for compressing the original file; and compressing the original file according to the file compression method.

[0076] In this case, encrypting the original file according to the encryption method to obtain an encrypted file corresponding to the original file may specifically include: encrypting the compressed original file according to the encryption method to obtain an encrypted file corresponding to the original file; wherein, the encrypted file includes ciphertext data obtained by encrypting the compressed original file, and metadata used to describe the encryption method and the file compression method.

[0077] For example, the encryptor can determine that the original file "plain.txt" is compressed using the Snappy compression algorithm, and can compress the original file "plain.txt" according to the Snappy compression algorithm; further, the encryptor can encrypt the compressed original file using its own determined AES-GCM algorithm and its own encryption key, obtaining an encrypted file "File Object" corresponding to the original file "plain.txt". For example, Figure 1As shown, the ciphertext data (cipher_data) included in the encrypted file "File Object" can be the ciphertext data obtained by encrypting the original encoded file; the "compression: snappy" field in the metadata can be used to describe that the file compression method for the original file "plain.txt" is the snappy compression algorithm.

[0078] The file compression method can be any file compression method, and this specification does not limit it. For example, the text encoding method for the original file can be the snappy compression algorithm, the lz4 algorithm, the lz77 algorithm, etc.

[0079] In some possible embodiments, the metadata included in the encrypted file can also be used to describe the file size of the original file. For example, the "uncompressed_size: 1GB" field in the metadata can be used to describe the file size of the original file "plain.txt" as 1GB. During the file decryption and decompression stages, the decryptor can use the "uncompressed_size: 1GB" field in the metadata to determine the integrity of the recovery result corresponding to the encrypted file, thereby promptly determining whether any file data was lost during transmission.

[0080] It should be noted that, in cases such as Figure 1 The embodiment shown describes the encryption method, text encoding method, and file compression method used by the encryptor for the original file through different fields in the metadata included in the encrypted file. This is merely an exemplary embodiment.

[0081] In some other possible embodiments, the metadata included in the encrypted file can be used to describe the file processing method for the original file; wherein, the file processing method may include one or more of the following: encryption method for the original file, text encoding method for the text content of the original file, file compression method for the original file, file format of the original file, number of file fragments corresponding to the original file, and file size of the original file.

[0082] For example, a "type: chunk@1.0" field can be added to the metadata included in the encrypted file. This field can be used to indicate that the file processing method for the original file "plain.txt" is "chunk@1.0". This file processing method can indicate that: the original file "plain.txt" is in txt format; the original file "plain.txt" has been fragmented; the text encoding method for the original file is UTF-8 encoding; the file compression method for the original file "plain.txt" is the Snappy compression algorithm; and the encryption method for the original file "plain.txt" is the AES-GCM algorithm.

[0083] In the embodiments shown above, the encryptor and decryptor can agree on different file processing methods in advance, and can describe the actual file processing method used for the original file in the metadata included in the encrypted file. This improves the flexibility of file encryption while ensuring the security of the encrypted file, and prevents other users besides the encryptor and decryptor from knowing the encryption method for the original file based on the metadata included in the encrypted file, thus increasing the risk to the security of the encrypted file.

[0084] It should be noted that in one or more embodiments of this specification, since typically only the encryptor and decryptor can hold the encryption key used for file encryption and the decryption key used for file decryption, other users besides the encryptor and decryptor may be able to know the encryption method for the original file based on the metadata included in the encrypted file, but since other users do not hold the decryption key, they cannot decrypt the encrypted file, thus ensuring the security of the encrypted file.

[0085] As can be seen from the above technical solutions, by adding metadata describing the encryption method for the original file to the encrypted file, a self-interpreting encrypted file format is achieved. This allows the encryptor to encrypt the original file using any encryption method without prior agreement with the decryptor. The decryptor can still successfully decrypt the ciphertext data in the encrypted file based on the metadata obtained from the encrypted file and successfully recover the original file. This improves the flexibility of file encryption and enhances the user experience for both the encryptor and decryptor.

[0086] Please see Figure 3 , Figure 3 This is a flowchart illustrating a file decryption method as an exemplary embodiment. The file decryption method can be applied to a decryption party.

[0087] In some possible embodiments, to improve the security of file data and avoid the leakage of original data during the file decryption process, the file decryption method described in this specification can be executed by a file decryption application running in a trusted execution environment. The file decryption application and the file encryption application can be the same application or different applications; this specification does not impose any particular limitation on this.

[0088] like Figure 3 As shown, the file decryption method can perform the following steps:

[0089] Step 302: Obtain the encrypted file corresponding to the original file; wherein the encrypted file includes ciphertext data obtained by encrypting the file content of the original file, and metadata describing the encryption method for the original file.

[0090] For example, the decryptor can obtain an encrypted file named "FileObject" that corresponds to the original file "plain.txt". Figure 1 As shown, an encrypted file "File Object" can include cipher data (cipher_data) and metadata; the cipher data (cipher_data) can be obtained by encrypting the contents of the original file "plain.txt"; the "encryption: aesgcm" field in the metadata can be used to describe that the encryption method for the original file "plain.txt" is the AES-GCM algorithm.

[0091] Step 304: Determine the encryption method for the original file based on the metadata included in the encrypted file, and decrypt the ciphertext data included in the encrypted file according to the decryption method corresponding to the encryption method.

[0092] For example, such as Figure 1 As shown, after obtaining the encrypted file "File Object", the decryptor can determine that the encryption method for the original file "plain.txt" is the AES-GCM algorithm based on the "encryption: aesgcm" field in the metadata. The decryptor can then decrypt the ciphertext data (cipher_data) included in the encrypted file "File Object" according to the decryption method corresponding to the AES-GCM algorithm to obtain the file content of the original file "plain.txt", and thus recover the original file "plain.txt".

[0093] In one embodiment shown, if the encryptor first segments the original file and then decrypts each segment, the decryptor can first decrypt the encrypted file and then merge the decrypted segments to recover the original file.

[0094] In this scenario, the encrypted file may include ciphertext data obtained by encrypting each file fragment corresponding to the original file, and metadata describing the encryption method and file format of the original file; wherein each file fragment is obtained by fragmenting the original file according to a fragmentation threshold. The step of determining the encryption method for the original file based on the metadata included in the encrypted file, and decrypting the ciphertext data included in the encrypted file according to the decryption method corresponding to the encryption method, may specifically include: determining the encryption method and file format of the original file based on the metadata included in the encrypted file, decrypting each encrypted file fragment according to the decryption method corresponding to the encryption method, and then merging the decrypted file fragments according to the file format of the original file.

[0095] For example, such as Figure 1 As shown, after obtaining the encrypted file "File Object", the decryptor can determine the encryption method of the original file "plain.txt" as the AES-GCM algorithm and the file format of the original file as txt based on the "encryption: aesgcm" and "format: txt" fields in the metadata. Furthermore, the decryptor can decrypt the encrypted file chunks (cipher_data) included in the encrypted file "File Object" according to the decryption method corresponding to the AES-GCM algorithm, i.e., encrypted file chunks cipher_chunk_0, cipher_chunk_1, ..., cipher_chunk_n, to obtain file chunks chunk_0, chunk_1, ..., chunk_n. Finally, the decryptor can merge the decrypted file chunks according to the txt file format to obtain the original file "plain.txt".

[0096] In some possible embodiments, where the metadata in the encrypted file can also be used to describe the number of file chunks corresponding to the original file, the decryptor can perform an integrity check on the obtained encrypted file based on the number of file chunks corresponding to the original file before decrypting the encrypted file chunks or before merging the decrypted file chunks. For example, the decryptor can determine that the number of file chunks corresponding to the original file "plain.txt" is n+1 based on the "chunk_num: n+1" field in the metadata. If the number of encrypted file chunks in the cipher data is n+1, the decryptor can perform an integrity check on the obtained encrypted file "File Object". If the number of encrypted file chunks in the cipher data is less than n+1, it indicates that a transmission failure may have occurred during the encrypted file transmission process, and the encrypted file needs to be retrieved again.

[0097] In one embodiment shown, if the encryptor first encodes the text content of the original file and then encrypts the encoded original file, the decryptor can first decrypt the encrypted file and then decode the decrypted file data to recover the original file.

[0098] In this case, the encrypted file may include ciphertext data obtained by encrypting the encoded original file, and metadata describing the encryption method and the text encoding method used to encode the text content of the original file. The method may further include: determining the text encoding method used to encode the text content of the original file based on the metadata included in the encrypted file, and decoding the text content in the decrypted ciphertext data according to a text decoding method corresponding to the text encoding method to obtain the text content of the original file.

[0099] For example, such as Figure 1As shown, after obtaining the encrypted file "File Object", the decryptor can determine the encryption method of the original file "plain.txt" as AES-GCM algorithm and the text encoding method of the original file "plain.txt" as UTF-8 encoding based on the "encryption: aesgcm" and "encoding: utf-8" fields in the metadata. Furthermore, the decryptor can decrypt the ciphertext data (cipher_data) included in the encrypted file "FileObject" according to the decryption method corresponding to the AES-GCM algorithm to obtain the encoded original file "plain.txt". Further, the decryptor can decode the encoded original file "plain.txt" (i.e., the text content in the decrypted ciphertext data) according to the text decoding method corresponding to UTF-8 encoding to obtain the text content of the original file "plain.txt", and thus recover the original file "plain.txt".

[0100] In one embodiment shown, if the encryptor first encodes the text content of the original file and then encrypts the encoded original file, the decryptor can first decrypt the encrypted file and then decode the decrypted file data to recover the original file.

[0101] In this case, the encrypted file may include ciphertext data obtained by encrypting the compressed original file, and metadata describing the encryption method and the file compression method used to compress the original file. The method may further include: determining the file compression method used to compress the original file based on the metadata included in the encrypted file, and decompressing the decrypted ciphertext data according to a file decompression method corresponding to the file compression method to obtain the original file.

[0102] For example, such as Figure 1As shown, after obtaining the encrypted file "File Object", the decryptor can determine, based on the "encryption: aesgcm" and "compression: snappy" fields in the metadata, that the encryption method for the original file "plain.txt" is the AES-GCM algorithm, and the compression method for the original file "plain.txt" is the snappy compression algorithm. Furthermore, the decryptor can decrypt the ciphertext data (cipher_data) included in the encrypted file "File Object" according to the decryption method corresponding to the AES-GCM algorithm to obtain the compressed original file "plain.txt". Finally, the decryptor can decompress the compressed original file "plain.txt" (i.e., the decrypted ciphertext data) according to the file decompression method corresponding to the snappy compression algorithm to obtain the original file "plain.txt".

[0103] In some possible embodiments, where the metadata in the encrypted file can also be used to describe the file size of the original file, after decompressing the decrypted ciphertext data, the decryptor can also perform an integrity check on the decompressed original file based on its file size. For example, the decryptor determines that the original file "plain.txt" has a file size of 1GB based on the "uncompressed_size: 1GB" field in the metadata; if the decompressed original file also has a file size of 1GB, then the integrity check of the recovered encrypted file can be passed.

[0104] As can be seen from the above technical solutions, since the decryptor can determine the encryption method for the original file based on the metadata in the obtained encrypted file, and can decrypt the ciphertext data in the obtained encrypted file according to the decryption method corresponding to the determined encryption method, the decryptor can successfully decrypt encrypted files obtained with different encryption methods and successfully recover the original file without having to agree on the encryption method with the encryptor in advance based on this self-interpreting encrypted file format. This improves the flexibility of file decryption and also improves the user experience for both the encryptor and the decryptor.

[0105] It should be noted that the file encryption and decryption methods provided in this manual are not only user-friendly for file transfer and storage, but also support parallel computing, thereby shortening the time required for file encryption and decryption and improving the execution efficiency of file encryption and decryption.

[0106] For example, by combining with MapReduce frameworks such as Spark and Hadoop, the original file can be first divided into file slices. Then, each worker thread can read the file slices corresponding to the original file to perform text encoding, file compression, file encryption, and other processing. Alternatively, each encrypted file slice in the ciphertext data included in the encrypted file can be read separately to perform file decryption, file decompression, text decoding, and other processing. Then, the processed file slices can be merged to recover the original file.

[0107] To enable those skilled in the art to better understand the technical solutions in the embodiments of this specification, the following description, in conjunction with... Figure 4 The diagram illustrating the file processing flow is used to explain the embodiments described in this specification. Please refer to... Figure 4 , Figure 4 This is a schematic diagram illustrating a file processing flow as an exemplary embodiment.

[0108] like Figure 4 As shown, the original file can be "plain.txt", and its size can be 1GB. The encryption party can determine that the encryption method for the original file is AES-GCM algorithm, the text encoding method for the original file "plain.txt" is UTF-8 encoding, the file compression method for the original file "plain.txt" is Snappy compression algorithm, and the fragmentation threshold (fixed_size) used for the original file "plain.txt" is 8MB.

[0109] The encryptor can divide the original file "plain.txt" into chunks according to the 8MB chunking threshold, and obtain the file chunks chunk_0, chunk_1, ..., chunk_n (n≥127, n is a positive integer) corresponding to the original file.

[0110] Furthermore, the encryptor can perform parallel stream processing on each file chunk corresponding to the original file "plain.txt". For example, the encryptor can first encode the text content of file chunk_0 according to UTF-8 encoding, and then compress the encoded file chunk_0 according to the Snappy compression algorithm; further, the encryptor can encrypt the encoded and compressed file chunk_0 according to the AES-GCM algorithm based on its own encryption key, to obtain the encrypted file chunk_cipher_chunk_0. Based on a similar file chunk processing process, the encryptor can also obtain the encrypted file chunks cipher_chunk_1, ..., and the encrypted file chunks cipher_chunk_n, which will not be elaborated here.

[0111] After obtaining the ciphertext data corresponding to each file fragment, the encryptor can add metadata describing the relevant file processing methods to the encrypted file "File Object" corresponding to the original file "plain.txt".

[0112] Accordingly, based on such Figure 4 The reverse operation of the file processing flow shown is that after the decryptor obtains the encrypted file "File Object" corresponding to the original file "plain.txt", it can determine the encryption method of the original file as AES-GCM algorithm, the text encoding method of the original file "plain.txt" as UTF-8 encoding, and the file compression method of the original file "plain.txt" as Snappy compression algorithm based on the various fields in the metadata included in the encrypted file "File Object".

[0113] Furthermore, the decryptor can perform parallel stream processing on each encrypted file chunk within the ciphertext data (cipher_data) of the encrypted file. For example, the decryptor can first decrypt the encrypted file chunk cipher_chunk_0 using the decryption algorithm corresponding to the AES-GCM algorithm and its own decryption key. Then, it can decompress the decrypted file chunk cipher_chunk_0 using the file decompression method corresponding to the snappy compression algorithm. Finally, it can decode the decrypted file chunk cipher_chunk_0 using the text decoding method corresponding to UTF-8 encoding to obtain the original file chunk_0. Based on a similar file chunk processing process, the encryptor can also obtain the original file chunk_1, ..., and the original file chunk_n, which will not be elaborated further here.

[0114] After obtaining the original file fragments corresponding to the original file "plain.txt", the decryptor can merge the original file fragments to obtain the original file "plain.txt".

[0115] Corresponding to the embodiments of the above-described file encryption and decryption methods, this specification also provides embodiments of a file encryption transmission system, a file encryption device, and a file decryption device.

[0116] In this specification, the file encryption and transmission system may include an encryptor and a decryptor; the encryptor may execute steps 202-204 and transmit the encrypted file corresponding to the original file to the decryptor; and the decryptor may execute steps 302-304 to implement the technical solution of this specification.

[0117] Please see Figure 5 , Figure 5 This is an exemplary embodiment illustrating the hardware structure of an electronic device housing a file encryption or decryption device. At the hardware level, the device includes a processor 502, an internal bus 504, a network interface 506, memory 508, and non-volatile memory 510, and may also include other necessary hardware. One or more embodiments of this specification can be implemented in software, for example, the processor 502 reads the corresponding computer program from the non-volatile memory 510 into memory 508 and then runs it. Of course, besides software implementation, one or more embodiments of this specification do not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution entity of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0118] Please see Figure 6 , Figure 6 This is a block diagram illustrating a file encryption device as an exemplary embodiment. This file encryption device can be applied to, for example... Figure 5 The electronic device shown implements the technical solution of this specification. The file encryption device may include:

[0119] The first determining unit 602 is used to determine the encryption method for the original file;

[0120] The encryption unit 604 is used to encrypt the original file according to the encryption method to obtain an encrypted file corresponding to the original file; wherein, the encrypted file includes ciphertext data obtained by encrypting the file content of the original file, and metadata used to describe the encryption method.

[0121] In this embodiment, the device further includes:

[0122] The second determining unit is used to determine the fragmentation threshold used for fragmentation processing of the original file;

[0123] The fragmentation unit is used to fragment the original file according to the fragmentation threshold to obtain several file fragments corresponding to the original file.

[0124] The encryption unit 604 is specifically used for:

[0125] According to the encryption method, each file segment corresponding to the original file is encrypted to obtain encrypted file segments, and an encrypted file corresponding to the original file is generated based on the encrypted file segments; wherein, the encrypted file includes ciphertext data obtained by encrypting each file segment corresponding to the original file, and metadata used to describe the encryption method and the file format of the original file.

[0126] In this embodiment, the device further includes:

[0127] The third determining unit is used to determine the text encoding method used to encode the text content of the original file;

[0128] An encoding unit is used to encode the text content of the original file according to the text encoding method.

[0129] The encryption unit 604 is specifically used for:

[0130] The original encoded file is encrypted according to the encryption method to obtain an encrypted file corresponding to the original file; wherein, the encrypted file includes ciphertext data obtained by encrypting the original encoded file, and metadata used to describe the encryption method and the text encoding method.

[0131] In this embodiment, the device further includes:

[0132] The fourth determining unit is used to determine the file compression method to be used for compressing the original file;

[0133] A compression unit is used to compress the original file according to the file compression method.

[0134] The encryption unit 604 is specifically used for:

[0135] The compressed original file is encrypted according to the encryption method to obtain an encrypted file corresponding to the original file; wherein, the encrypted file includes ciphertext data obtained by encrypting the compressed original file, and metadata used to describe the encryption method and the file compression method.

[0136] Please see Figure 7 , Figure 7 This is a block diagram illustrating a file decryption apparatus as an exemplary embodiment. This file decryption apparatus can be applied to, for example... Figure 5 The electronic device shown implements the technical solution of this specification. The file decryption device may include:

[0137] The acquisition unit 702 is used to acquire an encrypted file corresponding to the original file; wherein the encrypted file includes ciphertext data obtained by encrypting the file content of the original file, and metadata describing the encryption method for the original file;

[0138] The decryption unit 704 is used to determine the encryption method for the original file based on the metadata included in the encrypted file, and to decrypt the ciphertext data included in the encrypted file according to the decryption method corresponding to the encryption method.

[0139] In this embodiment, the encrypted file includes ciphertext data obtained by encrypting each file fragment corresponding to the original file, and metadata describing the encryption method and file format of the original file; wherein, each file fragment is obtained by fragmenting the original file according to a fragmentation threshold;

[0140] The decryption unit 704 is specifically used for:

[0141] Based on the metadata included in the encrypted file, the encryption method and file format of the original file are determined, and the encrypted file fragments are decrypted according to the decryption method corresponding to the encryption method. Then, the decrypted file fragments are merged according to the file format of the original file.

[0142] In this embodiment, the encrypted file includes ciphertext data obtained by encrypting the encoded original file, and metadata describing the encryption method and the text encoding method used to encode the text content of the original file.

[0143] The device further includes:

[0144] The decoding unit is used to determine the text encoding method used to encode the text content of the original file based on the metadata included in the encrypted file, and to decode the text content in the decrypted ciphertext data according to the text decoding method corresponding to the text encoding method, so as to obtain the text content of the original file.

[0145] In this embodiment, the encrypted file includes ciphertext data obtained by encrypting the compressed original file, and metadata describing the encryption method and the file compression method used to compress the original file;

[0146] The device further includes:

[0147] The decompression unit is used to determine the file compression method to be used for compressing the original file based on the metadata included in the encrypted file, and to decompress the decrypted ciphertext data according to the file decompression method corresponding to the file compression method to obtain the original file.

[0148] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0149] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the solution in this specification according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0150] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0151] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0152] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0153] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0154] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0155] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0156] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0157] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of one or more embodiments of this specification. The singular forms “a,” “described,” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0158] It should be understood that although the terms first, second, third, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of one or more embodiments of this specification, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "in response to a determination," or "when," or "in the event of a determination."

[0159] The above description is merely a preferred embodiment of one or more embodiments of this specification and is not intended to limit the scope of one or more embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments of this specification should be included within the protection scope of one or more embodiments of this specification.

Claims

1. A file encryption method, the method comprising: Determine the encryption method for the original file; The encryption method is an encryption algorithm; The original file is encrypted according to the encryption method to obtain an encrypted file corresponding to the original file; wherein, the encrypted file includes ciphertext data obtained by encrypting the file content of the original file, and metadata used to describe the encryption method; Before encrypting the original file according to the encryption method to obtain an encrypted file corresponding to the original file, the method further includes: Determine the fragmentation threshold to be used for fragmentation processing of the original file; The original file is split into several file fragments corresponding to the original file according to the fragmentation threshold. The step of encrypting the original file according to the encryption method to obtain an encrypted file corresponding to the original file includes: According to the encryption method, each file segment corresponding to the original file is encrypted to obtain encrypted file segments, and an encrypted file corresponding to the original file is generated based on the encrypted file segments; wherein, the encrypted file includes ciphertext data obtained by encrypting each file segment corresponding to the original file, and metadata for describing the encryption method and the file format of the original file; the file segments corresponding to the original file maintain the data structure of the original file.

2. The method according to claim 1, before encrypting the original file according to the encryption method to obtain an encrypted file corresponding to the original file, the method further includes: Determine the text encoding method to be used for encoding the text content of the original file; The text content of the original file is encoded according to the aforementioned text encoding method; The step of encrypting the original file according to the encryption method to obtain an encrypted file corresponding to the original file includes: The original encoded file is encrypted according to the encryption method to obtain an encrypted file corresponding to the original file; wherein, the encrypted file includes ciphertext data obtained by encrypting the original encoded file, and metadata used to describe the encryption method and the text encoding method.

3. The method according to claim 1, before encrypting the original file according to the encryption method to obtain an encrypted file corresponding to the original file, the method further includes: Determine the file compression method to be used to compress the original file; The original file is compressed according to the file compression method described above; The step of encrypting the original file according to the encryption method to obtain an encrypted file corresponding to the original file includes: The compressed original file is encrypted according to the encryption method to obtain an encrypted file corresponding to the original file; wherein, the encrypted file includes ciphertext data obtained by encrypting the compressed original file, and metadata used to describe the encryption method and the file compression method.

4. The method according to claim 1, wherein the method is applied to a privacy computing node.

5. The method according to claim 1, wherein the method is executed by a file encryption application running in a trusted execution environment.

6. A file decryption method, the method comprising: Obtain the encrypted file corresponding to the original file; wherein the encrypted file includes ciphertext data obtained by encrypting the file content of the original file, and metadata describing the encryption method for the original file; the encryption method is an encryption algorithm; Based on the metadata included in the encrypted file, the encryption method for the original file is determined, and the ciphertext data included in the encrypted file is decrypted according to the decryption method corresponding to the encryption method. The encrypted file includes ciphertext data obtained by encrypting each file segment corresponding to the original file, and metadata describing the encryption method and file format of the original file; wherein each file segment is obtained by segmenting the original file according to a segmentation threshold; and the file segments corresponding to the original file maintain the data structure of the original file. The step of determining the encryption method for the original file based on the metadata included in the encrypted file, and decrypting the ciphertext data included in the encrypted file according to the decryption method corresponding to the encryption method, includes: Based on the metadata included in the encrypted file, the encryption method and file format of the original file are determined, and the encrypted file fragments are decrypted according to the decryption method corresponding to the encryption method. Then, the decrypted file fragments are merged according to the file format of the original file.

7. The method according to claim 6, wherein the encrypted file includes ciphertext data obtained by encrypting the encoded original file, and metadata describing the encryption method and the text encoding method used to encode the text content of the original file; The method further includes: Based on the metadata included in the encrypted file, the text encoding method used to encode the text content of the original file is determined, and the text content in the decrypted ciphertext data is decoded according to the text decoding method corresponding to the text encoding method to obtain the text content of the original file.

8. The method according to claim 6, wherein the encrypted file includes ciphertext data obtained by encrypting the compressed original file, and metadata describing the encryption method and the file compression method used to compress the original file; The method further includes: Based on the metadata included in the encrypted file, the file compression method to be used for compressing the original file is determined, and the decrypted ciphertext data is decompressed according to the file decompression method corresponding to the file compression method to obtain the original file.

9. A file encryption transmission system, the system comprising an encryptor and a decryptor; The encryption party encrypts the original file according to a self-determined encryption mode to obtain an encrypted file corresponding to the original file. The encrypted file includes ciphertext data obtained by encrypting the file content of the original file, and metadata describing the encryption method; the encryption method is an encryption algorithm. The encrypting party transmits the encrypted file to the decrypting party; The decryption party determines the encryption method for the original file based on the metadata included in the encrypted file, and decrypts the ciphertext data included in the encrypted file according to the decryption method corresponding to the encryption method to obtain the original file; The encrypted file includes ciphertext data obtained by encrypting each file segment corresponding to the original file, and metadata describing the encryption method and file format of the original file; wherein each file segment is obtained by segmenting the original file according to a segmentation threshold; and the file segments corresponding to the original file maintain the data structure of the original file. The step of determining the encryption method for the original file based on the metadata included in the encrypted file, and decrypting the ciphertext data included in the encrypted file according to the decryption method corresponding to the encryption method, includes: Based on the metadata included in the encrypted file, the encryption method and file format of the original file are determined, and the encrypted file fragments are decrypted according to the decryption method corresponding to the encryption method. Then, the decrypted file fragments are merged according to the file format of the original file.

10. A file encryption device, the device comprising: The first determining unit is used to determine the encryption method for the original file; The encryption method is an encryption algorithm; An encryption unit is configured to encrypt the original file according to the encryption method to obtain an encrypted file corresponding to the original file; wherein, the encrypted file includes ciphertext data obtained by encrypting the file content of the original file, and metadata for describing the encryption method; The device further includes: The second determining unit is used to determine the fragmentation threshold used for fragmentation processing of the original file; The fragmentation unit is used to fragment the original file according to the fragmentation threshold to obtain several file fragments corresponding to the original file. The encryption unit is specifically used for: According to the encryption method, each file segment corresponding to the original file is encrypted to obtain encrypted file segments, and an encrypted file corresponding to the original file is generated based on the encrypted file segments; wherein, the encrypted file includes ciphertext data obtained by encrypting each file segment corresponding to the original file, and metadata for describing the encryption method and the file format of the original file; the file segments corresponding to the original file maintain the data structure of the original file.

11. A file decryption device, the device comprising: An acquisition unit is used to acquire an encrypted file corresponding to the original file; wherein, the encrypted file includes ciphertext data obtained by encrypting the file content of the original file, and metadata describing the encryption method for the original file; the encryption method is an encryption algorithm; The decryption unit is used to determine the encryption method for the original file based on the metadata included in the encrypted file, and to decrypt the ciphertext data included in the encrypted file according to the decryption method corresponding to the encryption method; The encrypted file includes ciphertext data obtained by encrypting each file segment corresponding to the original file, and metadata describing the encryption method and file format of the original file; wherein each file segment is obtained by segmenting the original file according to a segmentation threshold, and the data structure of the original file is maintained by several file segments corresponding to the original file. The decryption unit is specifically used for: Based on the metadata included in the encrypted file, the encryption method and file format of the original file are determined, and the encrypted file fragments are decrypted according to the decryption method corresponding to the encryption method. Then, the decrypted file fragments are merged according to the file format of the original file.

12. An electronic device, comprising a communication interface, a processor, a memory, and a bus, wherein the communication interface, the processor, and the memory are interconnected via the bus; The memory stores machine-readable instructions, and the processor executes the method of any one of claims 1-5 or 6-8 by invoking the machine-readable instructions.

13. A machine-readable storage medium storing machine-readable instructions that, when invoked and executed by a processor, implement the method of any one of claims 1-5 or 6-8.

Images