Data encryption and decryption method, encryption and decryption system, electronic equipment and medium

Abstract

The present application discloses a data encryption and decryption method, an encryption and decryption system, an electronic device and a medium. The encryption method comprises the following steps: receiving an encryption request from a user, wherein the encryption request comprises plaintext data to be encrypted; loading the plaintext data into a memory of the electronic device; calling an encryption device to encrypt the plaintext data based on an asymmetric encryption algorithm to obtain ciphertext data, wherein a pair of public keys and private keys are generated in the asymmetric encryption algorithm, and the public key is used to encrypt the plaintext data; determining a first storage path for the plaintext data and a second storage path for the ciphertext data; storing the ciphertext data in the second storage path; and deleting the plaintext data in the first storage path.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data encryption and decryption method, an encryption and decryption system, an electronic device and a medium. Background Art

[0002] In real-time encryption technology, disk encryption software or hardware is used to encrypt data on the hard disk when it is stored and decrypt it when it is read, which can prevent illegal access to static plaintext data on the hard disk.

[0003] Usually, in order to ensure the security of real-time encryption and decryption operations, the operating system needs to hold the key on behalf of the user, which involves many steps and is prone to errors. It is also complex to deploy, expensive and has high maintenance costs. In addition, in this real-time encryption and decryption solution, users do not have the right to choose the encrypted and decrypted files. Summary of the invention

[0004] The present application provides a data encryption and decryption method, an encryption and decryption system, an electronic device and a medium, which can not only ensure the security of instant encryption but also protect files in a targeted manner to save data resources.

[0005] The first aspect of the present application discloses a data encryption method, which is applied to an electronic device, and the method includes receiving an encryption request from a user, wherein the encryption request includes plaintext data to be encrypted; loading the plaintext data into the memory of the electronic device; calling an encryption device to encrypt the plaintext data based on an asymmetric encryption algorithm to obtain ciphertext data, wherein the asymmetric encryption algorithm generates a pair of public keys and private keys, and the public key is used to encrypt the plaintext data; determining a first storage path for the plaintext data and a second storage path for the ciphertext data; storing the ciphertext data in the second storage path; and deleting the plaintext data in the first storage path.

[0006] In a possible implementation of the first aspect above, the public key is stored in the encryption apparatus, and the private key is stored in a storage device of an external device.

[0007] In a possible implementation of the first aspect above, it also includes receiving a user's ciphertext transfer request, the ciphertext transfer request includes the ciphertext data and a second user; calling the encryption device to generate second ciphertext data based on the private key, the ciphertext data and a second public key corresponding to the second user, wherein the second public key is generated in a pair with the second private key using the asymmetric encryption algorithm; and storing the second ciphertext data to a third storage path.

[0008] In a possible implementation of the first aspect above, calling an encryption device to encrypt the plaintext data based on an asymmetric encryption algorithm to obtain ciphertext data includes, when the ciphertext data cannot be successfully obtained, deleting the plaintext data in the memory.

[0009] In a possible implementation of the first aspect above, the second storage path is generated based on the first storage path based on a predetermined rule.

[0010] In a possible implementation of the first aspect above, the plaintext data in the memory is deleted.

[0011] In a possible implementation of the first aspect above, the ciphertext data in the memory is deleted.

[0012] In a possible implementation of the first aspect, the method further includes calling the ciphertext data and the plaintext data in the form of a path. In a possible implementation of the first aspect, the path includes one or more of a shortcut, a path alias, and a soft link.

[0013] The second aspect of the present application discloses a data decryption method, which is applied to an electronic device, including receiving a decryption request from a user, wherein the encryption request includes ciphertext data to be encrypted; loading the ciphertext data into the memory of the electronic device; reading a private key and calling an encryption device to decrypt the ciphertext data based on an asymmetric encryption algorithm to obtain plaintext data, wherein the private key is generated in pairs with a public key in the asymmetric encryption algorithm, and the private key is used to decrypt the ciphertext data; determining a fourth storage path for the ciphertext data and a fifth storage path for the plaintext data; storing the plaintext data in the fifth storage path; and deleting the ciphertext data in the fourth storage path.

[0014] In a possible implementation of the second aspect above, the public key is stored in the encryption apparatus, and the private key is stored in a storage device of an external device.

[0015] In a possible implementation of the second aspect, the method further includes verifying the private key; when the private key is verified to be invalid, terminating the process and erasing all generated data.

[0016] In a possible implementation of the second aspect above, it also includes determining the file extension corresponding to the plaintext data; based on the file extension, creating a new process and opening the plaintext data in the memory; when the process ends, re-encrypting the plaintext data and importing it into the sixth storage path.

[0017] In a possible implementation of the second aspect above, the fifth storage path is generated based on the fourth storage path based on a predetermined rule.

[0018] In a possible implementation of the second aspect above, the method further includes deleting the ciphertext data in the memory.

[0019] In a possible implementation of the second aspect above, it also includes deleting the plaintext data in the memory.

[0020] In a possible implementation of the second aspect above, the storage device of the peripheral device includes one or more of a USB device, a lightning interface device, a magnetic interface device, an IC card, and a near field communication device.

[0021] The third aspect of the present application discloses an encryption and decryption system, including a ciphertext management device, a private key device, and an encryption device, wherein the private key device is used to store a private key, the encryption device is used to encrypt and decrypt operations and save a public key, and the ciphertext management device is used to execute the data encryption method of the first aspect of the present application and the data decryption method of the second aspect of the present application.

[0022] The fourth aspect of the present application discloses an electronic device, which includes a memory storing computer-executable instructions and a processor; when the instructions are executed by the processor, the device implements the methods according to the first and second aspects of the present application.

[0023] The fifth aspect of the present application discloses a computer-readable medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the methods of the first and second aspects of the present application.

[0024] The data encryption and decryption method, encryption and decryption system, electronic device and medium provided by the present application, after receiving the encryption and decryption request from the user, call the encryption device in the memory and use the asymmetric encryption algorithm for encryption and decryption. This process gives the user the right to choose encryption and decryption and places the encryption process at the application level accessible to the user. There is no need to deploy encryption in the system, which can reduce the complexity of encryption and decryption operations; and selective encryption and decryption can save resources. In addition, the use of asymmetric encryption and decryption technology can ensure the security of instant encryption and decryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A scene diagram of an embodiment of the present application which is an embodiment of the present application;

[0026] Figure 2 A flowchart of a data encryption method 200 according to an embodiment of the present application;

[0027] Figure 3a A schematic diagram of a public key-private key pair according to an embodiment of the present application;

[0028] Figure 3b An example diagram of data encryption for one embodiment of the present application;

[0029] Figure 4 This is a flow chart of a data encryption method 210 according to an embodiment of the present application;

[0030] Figure 5 A schematic diagram of a flow chart of a ciphertext transfer method 200 according to an embodiment of the present application;

[0031] Figure 6 A flowchart of a data decryption method 310 according to an embodiment of the present application;

[0032] Figure 7 A schematic diagram of changes in the display interface during the decryption process in one embodiment of the present application;

[0033] Figure 8 A flowchart of a data decryption method 320 according to an embodiment of the present application;

[0034] Fig. 9 A flowchart of a method 330 for processing plaintext data according to an embodiment of the present application;

[0035] Figure 10a-10b A schematic diagram of the flow of state switching methods 340 and 350 according to an embodiment of the present application;

[0036] Fig.11 This is a structural block diagram of an encryption and decryption system 400 according to an embodiment of the present application;

[0037] Fig.12 FIG. 5 is a block diagram of an electronic device 500 according to an embodiment of the present application. DETAILED DESCRIPTION

[0038] The present application is further described below in conjunction with specific embodiments and drawings. It is understood that the illustrative embodiments of the present disclosure include, but are not limited to, data encryption and decryption methods, encryption and decryption systems, electronic devices and media, and the specific embodiments described herein are merely for the purpose of explaining the present application, rather than limiting the present application. In addition, for ease of description, only some, but not all, structures or processes related to the present application are shown in the drawings. The acquisition, storage, use, and processing of data in the technical solution of the present application are in compliance with the relevant provisions of national laws and regulations.

[0039] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0040] Figure 1 A scenario diagram of an embodiment of the present application is shown. The encryption device 101 can automatically encrypt the data 102 stored on the hard disk to obtain the encrypted data 103, or automatically decrypt the encrypted data 103 to obtain the data 102. The encrypted data 103 may be in a form that cannot be opened or is opened as garbled code. Specifically, the encryption device 101 automatically encrypts the data 102 stored on the hard disk when storing and decrypts it when reading, so as to prevent the illegal acquisition of static plaintext data on the hard disk.

[0041] The encryption device 101 may be encryption software, encryption hardware, or a combination of the two. In order to achieve the purpose of automatic encryption during storage and automatic decryption during reading, the encryption device 101 needs to meet the following characteristics: 1) keep the data 102 in an encrypted state; 2) read and write the data 102 / encrypted data 103 at high speeds regardless of where it is stored in the hard disk; 3) the encryption and decryption process cannot cause a significant increase in the file size.

[0042] In the manual encryption solution, the user needs to find the encryption software in the computer, select the file to be encrypted / decrypted, and encrypt / decrypt it. In the encryption solution using the encryption device 101, the data can be automatically encrypted when it is saved and automatically decrypted when it is accessed in the background invisible to the user. By using the instant encryption and decryption solution, the user does not have the burden of manually encrypting and decrypting data.

[0043] Usually, in order to achieve instant encryption and decryption operations, a symmetric key scheme needs to be adopted. In some embodiments, in order to ensure the security of the symmetric key, the key can be held by the operating system or the encryption device 101 instead of the user managing the key. In order to cope with all possibilities of users using files on the operating system, the operating system or encryption device 101 that holds the key needs to be aware of and compatible with all user software during deployment, identify its legitimacy, and add it to the whitelist. This process involves many links and is prone to errors, and the deployment is complex, costly, and has high maintenance costs. In addition, in this instant encryption and decryption scheme, the user does not have the right to choose the encrypted and decrypted files, that is, the user cannot choose files according to his own wishes and encrypt and protect them in a targeted manner.

[0044] In addition, this key holding scheme needs to rely on the operating system to classify the code running level from the architecture. Most of the current schemes are based on the Windows operating system, and are rarely implemented in other operating systems, such as Linux and Mac systems.

[0045] In order to solve the above problems, an embodiment of the present application provides a data encryption method: the encryption selection right is given to the user and the encryption process is implemented at the application level accessible to the user. There is no need to deploy encryption in the system, which can reduce the complexity of encryption operations; and selective encryption can save resources. In addition, the use of asymmetric encryption technology can ensure the security of instant encryption.

[0046] The following combination Figure 2 , the details of the embodiment of the data encryption method according to the present application are described. Figure 2 As shown, a data encryption method 200 according to an implementation of the present application includes the following steps.

[0047] In S201, an encryption request from a user is received, where the encryption request includes plaintext data to be encrypted.

[0048] The method 200 is applied to an electronic device, which may be one or more of a desktop computer, a laptop computer, a smart phone, a tablet computer, a server, an IoT device, a chip, or a portable wearable device. The IoT device may be one or more of a smart vehicle device, a smart TV, a smart speaker, or a smart air conditioner. In some embodiments, an application may be installed in the electronic device, and the application may include one or more of an application pre-set in the operating system, an application that needs to be installed separately, and a program application that can be used without installation.

[0049] An encryption request from a user is received, wherein the encryption request includes plaintext data to be encrypted specified by the user. In some examples, the types of the plaintext data to be encrypted include, but are not limited to, one or more of documents, images, audio, and video.

[0050] In some embodiments, the user can drag or copy the plaintext data to be encrypted into the application of the electronic device. In other embodiments, the user can enter the file path of the plaintext data to be encrypted in the application or import the plaintext data to be encrypted according to the file location index. In some embodiments, the user can also right-click the data and select the corresponding encryption operation to determine the plaintext data to be encrypted.

[0051] In S202, plaintext data is loaded into the memory of the electronic device.

[0052] The plaintext data may be stored in a hard disk, and the plaintext data in the hard disk may be loaded into a memory of the electronic device, and encryption operations of the plaintext data may be performed in the memory. In some implementations, encryption operations may be performed directly on the plaintext data in the memory.

[0053] In S203, an encryption device is called to encrypt the plaintext data based on an asymmetric encryption algorithm to obtain ciphertext data, wherein a pair of public keys and private keys are generated in the asymmetric encryption algorithm, and the public key is used to encrypt the plaintext data.

[0054] The encryption device 101 is called to encrypt the plaintext data using an asymmetric encryption algorithm. In some implementations, in an asymmetric encryption algorithm, corresponding public key-private key pairs can be generated for different users or different plaintext data. The public key is used for encryption, and the private key is used for decryption.

[0055] It can be understood that the role of the encryption device here is not limited to encryption, but it can also decrypt ciphertext data based on an asymmetric encryption algorithm, which is the abbreviation of an encryption and decryption device.

[0056] Figure 3a A schematic diagram of a public key-private key pair of an embodiment of the present application is shown in . Before running encryption, the encryption device 101 can initialize and generate a pair of public key 111 and private key 112. In some examples, the encryption device 101 stores the public key 111, for example, the public key 111 is protected and stored in the core of the encryption device 101, such as a chip, software or other medium. Except for the encryption device itself, no hardware or software means can read and write the public key. In this case, the public key 111 is invisible to the user, and the encryption device can directly call the public key for encryption during the encryption process without manual operation by the user. In some examples, the encryption device 101 can provide an initialization interface so that the private key is stored on a private key device, and the private key device can be a private key storage device of an external device.

[0057] In S204, a first storage path for the plaintext data and a second storage path for the ciphertext data are determined.

[0058] Determine a first storage path for storing plaintext data and a second storage path for storing ciphertext data. In some embodiments, the second storage path is generated based on the first storage path based on a predetermined rule. For example, the plaintext data is stored in a folder A in a hard disk, and the first storage path of the plaintext data can be determined by this. The ciphertext data can also be stored in a folder A in the hard disk, that is, the first storage path of the plaintext data and the second storage path of the ciphertext data are located in the same folder. In some other examples, the ciphertext data can also be located in a subfolder of the A folder, or in a parent folder of the A folder.

[0059] It is understood that the steps in method 200 are not limited to be performed in the order of the numbers. For example, S204 may be performed before the encryption process of S203.

[0060] In S205, the encrypted data is stored in the second storage path.

[0061] After determining the second storage path for storing the ciphertext data, the ciphertext data is stored in the second storage path. In some examples, the ciphertext data in the memory can be deleted. In other examples, the ciphertext data in the memory can be processed in other ways, such as being encrypted again or modified so as to be irreproducible.

[0062] In S206, the plaintext data in the first storage path is deleted.

[0063] In some embodiments, after the plaintext data in the first storage path is deleted, the ciphertext data in the second storage path in the hard disk replaces the plaintext data in the original hard disk. In some embodiments, when the first storage path and the second storage path are consistent, the ciphertext data can be used to overwrite the plaintext data. In some embodiments, the plaintext data in the memory can also be deleted.

[0064] In method 200, after receiving an encryption request for plaintext data from a user, an encryption device is called in the memory and the plaintext data is encrypted using an asymmetric encryption algorithm to obtain ciphertext data. The plaintext data in the file path that originally stored the plaintext data is deleted, and the ciphertext data is saved in another storage path to achieve instant encryption. This process gives the user the right to choose encryption and places the encryption process at the user-accessible application level. There is no need to deploy encryption in the system, which can reduce the complexity of encryption operations; and selective encryption can save resources. In addition, the use of asymmetric encryption technology can ensure the security of instant encryption.

[0065] In some embodiments, ciphertext data and plaintext data may be called in the form of a path. The path may be in the form of one or more of a shortcut, a path alias, and a soft link. In some examples, the ciphertext data / plaintext data in the path may be read into a memory, or the path may be directly input into an encryption device. In some examples, parameters may be set for a path shortcut, a path alias, or a soft link, and encrypted data may be called before the corresponding application is run.

[0066] Figure 3b An example of data encryption of an embodiment of the present application is shown. Plain text data is displayed normally in the operating system before encryption (301). When the user drags the plain text data to the ciphertext management interface 303, the plain text data is encrypted. The encrypted ciphertext data is displayed as garbled characters in the operating system (302). In the ciphertext management interface 303, the ciphertext data is displayed as a shortcut (304). Figure 3b In the example of FIG. 3 , the interface change of the ciphertext management interface 303 before and after encryption can occur in a short time, such as a few milliseconds.

[0067] Figure 4 The flowchart of a data encryption method 210 according to an embodiment of the present application is shown. The method 210 is a further refinement of the method 200, and includes the following steps.

[0068] In S211, an encryption request from a user is received. S211 is similar to S201 in method 200 and will not be described in detail herein.

[0069] In S212, a first storage path of the plaintext data and a second storage path of the ciphertext data are determined. S212 is similar to S204 in method 200 and will not be described in detail herein.

[0070] In S213, the plaintext data is loaded into the memory of the electronic device. S213 is similar to S202 in method 200 and will not be described in detail here.

[0071] In S214, the encryption device is called to encrypt the plaintext data. If the encryption is successful, the process proceeds to S216, otherwise, the process proceeds to S215. During the encryption process, if the working state of the encryption device is abnormal or the correct public key is not used, the encryption will fail.

[0072] In S215, when the encryption of the plaintext data fails, the plaintext data in the memory is deleted. After S215, the relevant process can be terminated.

[0073] In S216, the ciphertext data is saved in the memory, and the plaintext data in the memory is deleted.

[0074] In S217, the ciphertext data is written into the second storage path. If the writing is successful, the process proceeds to S218; otherwise, the process proceeds to S215.

[0075] In S218, the plaintext data in the first storage path is deleted. After the plaintext data in the first storage path is deleted, the ciphertext data in the second storage path can replace the plaintext data in the first storage path and be displayed, such as Figure 3b As shown in 302. In some implementations, when the first storage path and the second storage path are consistent, the ciphertext data may be used to overwrite the plaintext data.

[0076] In S219, the ciphertext data in the memory is deleted. After the encryption is successful, both the plaintext data and the ciphertext data in the memory can be deleted to improve security and reduce memory usage.

[0077] Back to Figure 3b In the scenario, the ciphertext data is displayed in the form of a shortcut in the ciphertext management interface 303. If you need to display the ciphertext data normally in the ciphertext management interface 303 or perform further operations, such as modification, copying, cutting, transfer, etc., you need another private key device to achieve it. For the transfer of ciphertext data, Figure 5 A flowchart of a ciphertext transfer method 200 according to an embodiment of the present application is shown, which can convert ciphertext data of one user into ciphertext data of another user without decryption, and includes the following steps.

[0078] In S221, a ciphertext transfer request from a user is received, where the ciphertext transfer request includes ciphertext data and a second user.

[0079] Or Figure 3b For example, user M can select the ciphertext data to be transferred and the receiving user N in the ciphertext management interface. After determining the ciphertext data to be transferred, the corresponding storage path can be determined. In some examples, the user can drag the ciphertext data to be transferred to the position corresponding to user N in the ciphertext management interface, or the user can right-click the ciphertext data to be transferred and select the ciphertext transfer option.

[0080] In S222, the encryption device is called to generate second ciphertext data based on the private key, the ciphertext data and a second public key corresponding to the second user, wherein the second public key is generated in pair with the second private key using an asymmetric encryption algorithm.

[0081] After detecting that the private key of user M has passed verification, the encryption device is called to encrypt the ciphertext data based on the ciphertext data and the public key of user N to generate second ciphertext data. The public key of user N is generated in pairs with the corresponding private key based on an asymmetric encryption algorithm.

[0082] In S223, the second ciphertext data is stored in the third storage path.

[0083] The ciphertext data after the ciphertext transfer is stored in the new storage path. In S221-S223, the ciphertext data of user M is not decrypted, but directly converted into the ciphertext data of user N, which improves the security of the ciphertext transfer.

[0084] In some implementations, the transfer form of the ciphertext may be copying, that is, after the ciphertext data of user N is generated based on the ciphertext data of user M, the ciphertext data of user M may still be retained. In some implementations, the transfer form of the ciphertext may be cutting, that is, after the ciphertext data of user N is generated based on the ciphertext data of user M, the ciphertext data of user M will be deleted, that is, the plaintext data in the second storage path will be deleted.

[0085] Figure 6 A flow chart of a data decryption method 310 according to an embodiment of the present application is shown, and includes the following steps.

[0086] In S311, a decryption request from a user is received, where the encryption request includes ciphertext data to be encrypted.

[0087] A decryption request from a user is received, wherein the decryption request includes ciphertext data to be decrypted specified by the user, wherein the ciphertext data can be encrypted using the data encryption method of the present application.

[0088] In some embodiments, the user can drag or copy the ciphertext data to be decrypted into the application of the electronic device. In other embodiments, the user can enter the file path of the ciphertext data to be decrypted in the application or import the ciphertext data to be decrypted according to the file location index. In some embodiments, the user can also right-click the data and select the corresponding decryption operation to determine the ciphertext data to be decrypted.

[0089] In S312, the encrypted data is loaded into the memory of the electronic device.

[0090] The ciphertext data may be stored in a hard disk, and the ciphertext data in the hard disk may be loaded into a memory of the electronic device, and a decryption operation of the ciphertext data may be performed in the memory. In some implementations, the decryption operation may be performed directly on the ciphertext data in the memory.

[0091] In S313, the private key is read and the encryption device is called to decrypt the ciphertext data based on the asymmetric encryption algorithm to obtain the plaintext data, wherein the private key is generated in pairs with the public key in the asymmetric encryption algorithm, and the private key is used to decrypt the ciphertext data.

[0092] The encryption device is called to encrypt the plaintext data using an asymmetric encryption algorithm and a public key, and the ciphertext data is decrypted using a private key generated in pair with the public key. In some embodiments, in an asymmetric encryption algorithm, corresponding public key-private key pairs can be generated for different users or different plaintext data. In some embodiments, the public key device is stored in the encryption device, and the private key device is stored in a storage device of an external device.

[0093] In S314, a fourth storage path for the ciphertext data and a fifth storage path for the plaintext data are determined.

[0094] Determine a fourth storage path for storing ciphertext data and a fifth storage path for storing plaintext data. In some embodiments, the fifth storage path is generated based on the fourth storage path based on a predetermined rule. For example, the ciphertext data is stored in a B folder in the hard disk, and the fourth storage path of the ciphertext data can be determined by this. The plaintext data can also be stored in a B folder in the hard disk, that is, the fourth storage path of the ciphertext data and the fifth storage path of the plaintext data are located in the same folder. In some other examples, the plaintext data can also be located in a subfolder of the B folder, or in a parent folder of the B folder.

[0095] It is understood that the steps in method 310 are not limited to be performed in the order of the numbers. For example, S314 may be performed before the encryption process of S313.

[0096] In S315, the plaintext data is stored in the fifth storage path.

[0097] After determining the fifth storage path for storing the plaintext data, the plaintext data is stored in the fifth storage path. In some examples, the plaintext data in the memory can be deleted. In other examples, the plaintext data in the memory can be processed in other ways, such as being encrypted again or modified so as to be irreproducible.

[0098] In S316, the ciphertext data in the fourth storage path is deleted.

[0099] In some embodiments, after the ciphertext data in the fourth storage path is deleted, the plaintext data in the fifth storage path in the hard disk replaces the ciphertext data in the original hard disk. In some embodiments, when the fourth storage path and the fifth storage path are consistent, the ciphertext data can be overwritten with the plaintext data. In some embodiments, the ciphertext data in the memory can also be deleted.

[0100] In method 310, after receiving a decryption request for ciphertext data from a user, the private key is read and the encryption device is called in the memory and the ciphertext data is decrypted using an asymmetric encryption algorithm to obtain the plaintext data. The ciphertext data in the file path that originally stored the ciphertext data is deleted, and the plaintext data is saved in another storage path to achieve instant encryption. This process gives the user the right to choose decryption and places the decryption process at the user-accessible application level. There is no need to deploy decryption in the system, which can reduce the complexity of encryption operations.

[0101] In addition, the security of data can be guaranteed through the control of private keys. Figure 7 Examples in . Figure 7 The diagram shows the changes in the display interface during the decryption process in one embodiment of the present application.

[0102] In the ciphertext management interface, the ciphertext data is displayed as a shortcut (303-1). When the ciphertext management interface receives the user's decryption request and detects that the private key device has successfully read the private key, the shortcut can be opened to display the plaintext content (302-2). The user can view the plaintext content. During this period, the status of the private key can be continuously monitored. If the private key device is disconnected midway, the ciphertext management interface will display a locked state (303-3). During this period, the user can intuitively feel the interface switching of the ciphertext manager.

[0103] In some embodiments, the private key device may be one or more of a USB device, a lightning interface device, a magnetic interface device, an IC card, and a near field communication (NFC) device. The interface version of the USB device includes but is not limited to USB Type-A, USB Type-B, or USB Type-C. In some examples, the reading of the private key may not be limited to a physical private key device, for example, the private key may be read by fingerprint recognition or facial recognition.

[0104] Figure 8 The flowchart of a data decryption method 320 according to an embodiment of the present application is shown. The method 320 is a further refinement of the method 310, and includes the following steps.

[0105] In S321, a decryption request from a user is received. S321 is similar to S311 in method 310 and will not be described in detail herein.

[0106] In S322, a fourth storage path of the ciphertext data and a fifth storage path of the plaintext data are determined. S322 is similar to S314 in method 310, and will not be described in detail herein.

[0107] In S323, the encrypted data is loaded into the memory of the electronic device. S323 is similar to S312 in method 310 and will not be described in detail here.

[0108] In S324, the private key is read.

[0109] The private key is read according to the device where the private key is stored or the user's characteristic identification device.

[0110] In S325, the encryption device is called to decrypt the ciphertext data. If the decryption is successful, the process proceeds to S327, otherwise, the process proceeds to S326. During the decryption process, if the working state of the decryption device is abnormal or the private key reading state is abnormal, the decryption will fail.

[0111] In S326, when the decryption of the ciphertext data fails, the ciphertext data in the memory is deleted. After S326, the relevant process can be terminated.

[0112] In S327, the plaintext data is saved in the memory, and the ciphertext data in the memory is deleted.

[0113] In S328, the plaintext data is written into the fifth storage path. If the writing is successful, the process proceeds to S329; otherwise, the process proceeds to S326.

[0114] In S329, the ciphertext data in the fourth storage path is deleted. After the ciphertext data in the fourth storage path is deleted, the plaintext data in the fifth storage path can replace the ciphertext data in the fourth storage path for display, such as Figure 7 In some implementations, when the fourth storage path and the fifth storage path are consistent, the ciphertext data may be overwritten with the plaintext data.

[0115] In S330, the plaintext data in the memory is deleted. After the decryption is successful, both the plaintext data and the ciphertext data in the memory can be deleted to improve security and reduce memory usage.

[0116] Back to Figure 7 , the data in the ciphertext management interface 303-2 is in a user-available state. The user can perform all operations on the data therein that are supported by the corresponding plaintext data. Although the ciphertext data opened through the shortcut is displayed as plaintext, in some embodiments, the data in the storage path of the ciphertext data in the hard disk is still in an encrypted state. If the user needs to save the operation on the plaintext in the ciphertext management interface 303-2, it needs to be encrypted again. The user can use plaintext and store ciphertext in the ciphertext management interface. In some embodiments, if the private key device is disconnected midway, the user's modifications to the plaintext content can be saved, re-encrypted, and the new ciphertext data can be written to the corresponding storage path.

[0117] Fig. 9 A flowchart of a method 330 for processing plaintext data according to an embodiment of the present application is shown, comprising the following steps:

[0118] In S331, the file extension corresponding to the plaintext data is determined.

[0119] The plaintext data here is obtained by calling the encryption device to decrypt the ciphertext data. For example, the plaintext data is the plaintext loaded into the memory after the steps S321-S325 in the method 320.

[0120] Plain text data can be in many forms, and the format of the plain text data and the application to open it can be determined based on its file extension. For example, the file extension can be any one of ".txt", ".doc", ".pdf", ".jpg", and ".avi".

[0121] In S332, based on the file extension, a new process is created and the plaintext data in the memory is opened.

[0122] After determining the file extension, the application that opens the plaintext data can be determined. The newly created process uses the application corresponding to the file extension to open the plaintext data in the memory. It can be understood that the "process" here is a broad concept and can be a subprocess. For example, in some embodiments, a new subprocess can be created in an existing process to open the plaintext data in the memory.

[0123] For example, when the file extension is ".txt", the process of the newly created document reader opens the plain text data; when the file extension is ".pdf", the process of the newly created PDF document reader opens the plain text data.

[0124] In S333, when the process ends, the plaintext data is re-encrypted and imported into the sixth storage path.

[0125] In the newly created process, the user can perform various operations on the plaintext data, such as copying, cutting, pasting, etc. When the operation is completed and the process ends, the updated plaintext data can be re-encrypted, such as encrypting it into the second ciphertext data. And the second ciphertext data storage is imported into the sixth storage path. In some examples, the storage path of the new ciphertext data (i.e., the sixth storage path) can be consistent with the storage path of the original ciphertext (i.e., the fourth storage path). In some other examples, the sixth storage path may be inconsistent with the fourth storage path.

[0126] In method 330, during the decryption process, the user can open the decrypted data normally without hindrance. When the operation on the decrypted data is completed, the electronic device will encrypt it to obtain new encrypted data. The user can use the plaintext normally, and the electronic device will encrypt the modified plaintext again, so that the user can use the plaintext and store the ciphertext without being aware of it.

[0127] Back to Figure 7 In some implementations, the ciphertext manager interface can monitor the corresponding interface of the private key device in real time. When the monitored signal is abnormal, a private key verification request can be sent to the private key device. If the private key verification succeeds, the current process continues; if it fails, the process ends and all generated data is erased.

[0128] exist Figure 7 In the case of interface 303-2, the private key device has been connected and the private key verification is successful. If either of these two conditions is not met, interface 303 switches to another state. For the former, the electronic device is in an authorized state, and the user can perform encryption operations, ciphertext-related operations, decryption operations, and ciphertext transfer operations. Among them, ciphertext-related operations may include sharing ciphertext data and uploading ciphertext data to the cloud. For the latter, the electronic device is in a public state, and the user's authority will be limited. In some examples, in a public state, the user cannot perform any operations on the data in the ciphertext management interface, such as Figure 7 In some other examples, in the public state, the user can only perform encryption operations and ciphertext-related operations.

[0129] In some examples, a state variable can be set, and different values ​​can be assigned to the state variable in different states. For example, a state variable secretKeyAuth can be set, the type is Boolean, the value of the state variable in the public state is False, and the value of the state variable in the authorized state is True. During the operation of the electronic device or the ciphertext manager in the electronic device, the private key will be continuously monitored. Once the monitoring signal is abnormal, a private key verification request is sent to the encryption device, and the corresponding True / False value is directly assigned to the state variable according to the verification result.

[0130] In some embodiments, when the electronic device is in an authorized state, files in the ciphertext management interface can be displayed in the form of thumbnails. For example, similar to a common browser interface, the ciphertext management interface can display pictures, PDF documents, videos and other files in the form of thumbnails to provide users with a non-perceptual usage experience.

[0131] The display of thumbnails can be implemented in a variety of ways. In some examples, when the electronic device is in an authorized state, the encryption device can be called to completely decrypt the ciphertext data on the hard disk into the memory, and the decrypted plaintext data can be displayed as a preview thumbnail. In some other examples, when the electronic device is in an authorized state, the encryption device can be called to partially decrypt the ciphertext data on the hard disk into the memory, and only the part of the plaintext data required to generate the thumbnail is obtained, and the part of the plaintext data is displayed as a preview thumbnail.

[0132] For the switching between the above two states, Figure 10a-10b The flowchart of the state switching method 340 and 350 according to an embodiment of the present application is shown. The various steps in the method 340 and the method 350 are described in detail below.

[0133] In method 340, the electronic device switches from the authorized state to the public state. In S341, the data generated in the authorized state is deleted. All decrypted plaintext data in the memory in the authorized state or part of the decrypted plaintext data can be deleted.

[0134] In S342, the preview thumbnail is deleted and the preview thumbnail disappears in the ciphertext manager interface.

[0135] In S343, the additional process in the authorized state is terminated. The other processes in the authorized state are terminated.

[0136] Correspondingly, in method 350, the electronic device switches from the public state to the authorized state. In S351, data required for the authorized state is generated, for example, all decrypted plaintext data or part of the decrypted plaintext data used to generate thumbnails is generated.

[0137] In S352, a preview thumbnail is generated and displayed. A thumbnail corresponding to the plaintext data is generated and displayed on the ciphertext manager interface.

[0138] In S353, the additional process in the authorized state is opened, and other processes except the thumbnail generation process are restored to execute the user's operation.

[0139] This application also discloses a data encryption and decryption system, see Fig.11 400 in the data encryption and decryption system 400 includes a ciphertext management device 410, an encryption device 420 and a private key device 430. The private key device 430 is used to store a private key, the encryption device 420 is used for encryption and decryption operations and to store a public key, and the ciphertext management device 410 is used to execute the above-mentioned data encryption method and data decryption method.

[0140] Reference now Fig.12 , now refer to Figure 5 , which is a block diagram of an electronic device 500 according to an embodiment of the present application. The electronic device 500 may include one or more processors 502, a system control logic 508 connected to at least one of the processors 502, a system memory 504 connected to the system control logic 508, a non-volatile memory (NVM) 506 connected to the system control logic 508, and a network interface 510 connected to the system control logic 508.

[0141] The processor 502 may include one or more single-core or multi-core processors. The processor 502 may include any combination of general-purpose processors and special-purpose processors (e.g., graphics processors, application processors, baseband processors, etc.). In the embodiments of the present invention, the processor 502 may be configured to execute the following operations: Figure 2-1 One or more embodiments of the various embodiments shown in 0.

[0142] In some embodiments, system control logic 508 may include any suitable interface controller to provide any suitable interface to at least one of processors 502 and / or any suitable device or component in communication with system control logic 508 .

[0143] In some embodiments, the system control logic 508 may include one or more memory controllers to provide an interface to the system memory 504. The system memory 504 may be used to load and store data and / or instructions. In some embodiments, the memory 504 of the device 500 may include any suitable volatile memory, such as a suitable dynamic random access memory (DRAM).

[0144] NVM / memory 506 may include one or more tangible, non-transitory computer-readable media for storing data and / or instructions. In some embodiments, NVM / memory 506 may include any suitable non-volatile memory such as flash memory and / or any suitable non-volatile storage device, such as at least one of a HDD (Hard Disk Drive), a CD (Compact Disc) drive, and a DVD (Digital Versatile Disc) drive.

[0145] NVM / storage 506 may include a portion of storage resources installed on a device of apparatus 500, or it may be accessible to the apparatus but not necessarily a part of the apparatus. For example, NVM / storage 506 may be accessed over a network via network interface 510.

[0146] In particular, system memory 504 and NVM / storage 506 may include, respectively, a temporary copy and a permanent copy of instructions 520. Instructions 520 may include instructions that, when executed by at least one of processors 502, cause device 500 to perform the following operations: Figure 2 , 4-6, 8-10b. In some embodiments, the instructions 520, hardware, firmware and / or software components thereof may be additionally / alternatively placed in the system control logic 508, the network interface 510 and / or the processor 502.

[0147] The network interface 510 may include a transceiver for providing a radio interface for the device 500, thereby communicating with any other suitable device (such as a front-end module, an antenna, etc.) through one or more networks. In some embodiments, the network interface 510 may be integrated with other components of the device 500. For example, the network interface 510 may be integrated with at least one of the processor 502, the system memory 504, the NVM / storage 506, and a firmware device (not shown) having instructions. When at least one of the processors 502 executes the instructions, the device 500 implements Figure 2-1 One or more embodiments of the various embodiments shown in 0.

[0148] The network interface 510 may further include any suitable hardware and / or firmware to provide a multiple-input multiple-output radio interface. For example, the network interface 510 may be a network adapter, a wireless network adapter, a telephone modem and / or a wireless modem.

[0149] In one embodiment, at least one of the processors 502 may be packaged together with logic for one or more controllers of the system control logic 508 to form a system in package (SiP). In one embodiment, at least one of the processors 502 may be integrated on the same die with logic for one or more controllers of the system control logic 508 to form a system on a chip (SoC).

[0150] The device 500 may further include an input / output (I / O) device 512. The I / O device 512 may include a user interface, which enables a user to interact with the device 500; and a peripheral component interface design enables peripheral components to interact with the device 500.

[0151] In some embodiments, the user interface may include, but is not limited to, a display (e.g., an LCD display, a touch screen display, etc.), a speaker, a microphone, one or more cameras (e.g., a still image camera and / or a video camera), a flashlight (e.g., an LED flash), and a keyboard.

[0152] In some embodiments, the peripheral component interface may include, but is not limited to, a non-volatile memory port, an audio jack, and a power interface.

[0153] Each method implementation mode of the present application can be implemented in the form of software, magnetic components, firmware, etc.

[0154] Program code can be applied to input instructions to perform the functions described herein and generate output information. The output information can be applied to one or more output devices in a known manner. For purposes of this application, a processing system includes any system having a processor such as, for example, a digital signal processor (DSP), a microcontroller, an application specific integrated circuit (ASIC), or a microprocessor.

[0155] Program code can be implemented with high-level programming language or object-oriented programming language to communicate with the processing system. When necessary, program code can also be implemented with assembly language or machine language. In fact, the mechanism described herein is not limited to the scope of any specific programming language. In either case, the language can be a compiled language or an interpreted language.

[0156] One or more aspects of at least one embodiment may be implemented by representative instructions stored on a computer-readable storage medium, which represent various logic in a processor, and when the instructions are read by a machine, cause the machine to fabricate logic for performing the techniques described herein. These representations, known as "IP cores," may be stored on a tangible computer-readable storage medium and supplied to multiple customers or manufacturing facilities to load into a manufacturing machine that actually manufactures the logic or processor.

[0157] An embodiment of the present application discloses a computer-readable medium storing one or more programs executable by one or more processors to implement the method of the present application.

[0158] An embodiment of the present application discloses a computer program product, including a computer program, which implements the method of the present application when executed by a processor.

[0159] The above is a description of the implementation mode of the present application by specific specific embodiments. Those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. Although the description of the present application will be introduced in conjunction with the preferred embodiment, this does not mean that the features of this invention are limited to this implementation mode. On the contrary, the purpose of introducing the invention in conjunction with the implementation mode is to cover other options or modifications that may be extended based on the claims of the present application. In order to provide an in-depth understanding of the present application, the above description contains many specific details. The present application can also be implemented without using these details. In addition, in order to avoid confusion or blurring the focus of the present application, some specific details will be omitted in the description. It should be noted that, in the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

[0160] Furthermore, various operations will be described as multiple discrete operations in a manner that is most helpful for understanding the illustrative embodiments; however, the order of description should not be construed as implying that these operations are necessarily order dependent. In particular, these operations do not need to be performed in the order presented.

[0161] Unless the context dictates otherwise, the terms "comprising," "having," and "including" are synonymous. The phrase "A / B" means "A or B." The phrase "A and / or B" means "(A and B) or (A or B)."

[0162] In some cases, the disclosed embodiments may be implemented in hardware, firmware, software, or any combination thereof. The disclosed embodiments may also be implemented as instructions carried or stored on one or more temporary or non-temporary machine-readable (e.g., computer-readable) storage media, which may be read and executed by one or more processors. For example, instructions may be distributed over a network or by other computer-readable media. Therefore, machine-readable media may include any mechanism for storing or transmitting information in a machine (e.g., computer) readable form, but not limited to, floppy disks, optical disks, optical disks, read-only memories (CD-ROMs), magneto-optical disks, read-only memories (ROMs), random access memories (RAMs), erasable programmable read-only memories (EPROMs), electrically erasable programmable read-only memories (EEPROMs), magnetic or optical cards, flash memory, or a tangible machine-readable memory for transmitting information through the Internet via electrical, optical, acoustic, or other forms of propagation signals. Therefore, machine-readable media include any type of machine-readable media suitable for storing or transmitting electronic instructions or information in a machine (e.g., computer) readable form.

[0163] In the accompanying drawings, some structural or method features are shown in a specific arrangement and / or order. However, it should be understood that such a specific arrangement and / or order may not be required. In some embodiments, these features may be arranged in a manner and / or order different from that shown in the illustrative drawings. In addition, the inclusion of structural or method features in a specific figure does not mean that such features are required in all embodiments, and in some embodiments, these features may not be included or may be combined with other features.

[0164] It should be understood that although the terms "first", "second", etc. may be used here to describe various units or data, these units or data should not be limited by these terms. These terms are used only to distinguish one feature from another. For example, without departing from the scope of the exemplary embodiment, a first feature may be referred to as a second feature, and similarly, a second feature may be referred to as a first feature.

[0165] It should be noted that in this specification, similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0166] While the present invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention.

Claims

1. A data encryption and decryption method, applied to an electronic device, characterized in that: The method comprises, The ciphertext data and the plaintext data are called in the form of a path, wherein the path includes one or more of a shortcut, a path alias, and a soft link; wherein the shortcut of the ciphertext data is displayed in the ciphertext management interface; Determining a file extension corresponding to the decrypted plaintext data in the memory of the electronic device; Based on the file extension, create a new process and open the decrypted plaintext data; When the process ends, the decrypted plaintext data is re-encrypted and imported into the sixth storage path; wherein The corresponding interface of the private key storage device is monitored in real time, and when the monitored signal is abnormal, a private key verification request is sent to the private key storage device; If the verification of the private key succeeds, the process continues; if the verification of the private key fails, the process ends and all generated data is erased; When the private key storage device has been connected and the private key has been successfully verified, the electronic device is in an authorized state, otherwise it is in a public state; in the authorized state, the ciphertext management interface displays part of the decrypted plaintext data in the form of preview thumbnails, and allows encryption operations, ciphertext-related operations, decryption operations, and ciphertext transfer operations; in the public state, no operations are allowed, or only the encryption operations and ciphertext-related operations are allowed; When the electronic device switches from the authorized state to the public state, the data generated in the authorized state is deleted, the displayed preview thumbnail is deleted, and the additional process in the authorized state is terminated; When the electronic device switches from the public state to the authorized state, the data required for the authorized state is generated, the preview thumbnail is generated and displayed, and an additional process of the authorized state is opened.

2. The method according to claim 1, characterized in that The method further comprises: Receiving an encryption request from a user, wherein the encryption request includes plaintext data to be encrypted; Loading the plaintext data to be encrypted into the memory; Invoking an encryption device to encrypt the plaintext data to be encrypted based on an asymmetric encryption algorithm to obtain the ciphertext data; Determining a first storage path of the plaintext data to be encrypted and a second storage path of the ciphertext data; storing the ciphertext data in the second storage path; and The plaintext data to be encrypted in the first storage path is deleted.

3. The method according to claim 2, characterized in that The second storage path is generated based on a predetermined rule and on the basis of the first storage path.

4. The method according to claim 2, characterized in that: Encrypting the plaintext data to be encrypted to obtain the ciphertext data includes, when the ciphertext data cannot be successfully obtained, deleting the plaintext data to be encrypted in the memory.

5. The method according to claim 1, characterized in that: The method further comprises: Receiving a decryption request from a user, wherein the decryption request includes ciphertext data to be decrypted; Loading the ciphertext data into the memory, reading a private key and invoking an encryption device to decrypt the ciphertext data based on an asymmetric encryption algorithm to obtain the decrypted plaintext data; Determining a fourth storage path of the ciphertext data and a fifth storage path of the decrypted plaintext data; storing the decrypted plaintext data in the fifth storage path; and The ciphertext data in the fourth storage path is deleted.

6. The method according to claim 5, characterized in that The fifth storage path is generated based on the fourth storage path based on a predetermined rule.

7. The method according to claim 2 or 5, characterized in that: The asymmetric encryption algorithm generates a pair of public keys and private keys, wherein the public key is used to encrypt the plaintext data to be encrypted; the public key is stored in the encryption device, and the private key is stored in the private key storage device of the external device.

8. The method according to claim 7, characterized in that The method further comprises, receiving a ciphertext transfer request from a user, wherein the ciphertext transfer request includes the ciphertext data and a second user; Invoking the encryption device to generate second ciphertext data based on the private key, the ciphertext data and a second public key corresponding to the second user, wherein the second public key is generated in pair with the second private key using the asymmetric encryption algorithm; The second ciphertext data is stored in a third storage path.

9. The method according to claim 7, characterized in that: The private key storage device includes one or more of a USB device, a lightning interface device, a magnetic interface device, an IC card, and a near field communication device.

10. A data encryption and decryption system, characterized in that: It includes a ciphertext management device, a private key storage device, and an encryption device, wherein the private key storage device is used to store a private key, the encryption device is used for encryption and decryption operations and storing a public key, and the ciphertext management device is used to execute the data encryption and decryption method according to any one of claims 1-9.

11. An electronic device, characterized in that: The device comprises a memory storing computer executable instructions and a processor; when the instructions are executed by the processor, the device implements the method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method according to any one of claims 1 to 9.

Images