File encryption method and system

Abstract

The application discloses a file encryption method and system. It is related to the field of information security. The method comprises the following steps: receiving a first signed file sent by a target device, and verifying the first signed file by using a first public key in a first key pair to obtain a verification result; in the case that the verification result represents that the first signed file is normal, obtaining a second public key in a second key pair and device verification information from the first signed file; generating a signature key according to the device verification information, and encrypting the signature key by using the second public key to obtain an initial encrypted file; and sending the initial encrypted file to the target device to encrypt a target file by the target device to obtain a target encrypted file. Through the application, the problem of low efficiency of updating the key in the device in the related art is solved.

Description

Technical Field

[0001] This application relates to the field of information security, and more specifically, to a file encryption method and system. Background Technology

[0002] Currently, financial institutions often require users to sign when conducting certain transactions. After receiving a user's signature, the signature screen of the financial institution must encrypt the signature trace to ensure the security of the user's signature.

[0003] Currently, the method for encrypting signature traces typically involves setting a key for the signature screen device, which then uses an encryption algorithm in conjunction with the key to encrypt the signature trace. However, the keys used in existing encryption technologies are often located in each signature screen device. When the keys are changed periodically, the keys in each signature screen device need to be changed sequentially, resulting in low key update efficiency.

[0004] There is currently no effective solution to the problem of low efficiency in updating keys in devices in related technologies. Summary of the Invention

[0005] This application provides a file encryption method and system to solve the problem of low efficiency in updating keys in devices in related technologies.

[0006] According to one aspect of this application, a file encryption method is provided. The method includes: receiving a first signed file sent by a target device, and verifying the first signed file using a first public key from a first key pair to obtain a verification result, wherein the first signed file is obtained by the target device signing device verification information and a second public key using a first private key from the first key pair; if the verification result indicates that the first signed file is normal, obtaining a second public key from a second key pair and device verification information from the first signed file; generating a signature key based on the device verification information, and encrypting the signature key using the second public key to obtain an initial encrypted file; sending the initial encrypted file to the target device, and encrypting the target file using the target device to obtain a target encrypted file, wherein the target device decrypts the initial encrypted file using the second private key from the second key pair to obtain a signature key, and then encrypts the target file using the signature key to obtain the target encrypted file.

[0007] Optionally, generating a signature key based on device verification information includes: obtaining the identification information of the target device from the device verification information and obtaining the reception time of the receiving device verification information; reading the root key from the storage space and combining the root key, identification information and reception time to obtain the signature key.

[0008] Optionally, before receiving the first signature file sent by the target device, the method further includes: generating a third key pair and sending the third public key in the third key pair to the target device; determining whether the first public key sent by the target device has been received within a preset time interval; if the first public key has been received, sending a file sending instruction to the target device, wherein the file sending instruction is used to instruct the target device to send the first signature file; and if the first public key has not been received, issuing an alarm message.

[0009] Optionally, the second key pair includes a second public key and a second private key, and the third key pair includes a third public key and a third private key. Encrypting the signature key using the second public key to obtain an initial encrypted file includes: generating a master key plaintext and encrypting it using the second public key to obtain a first sub-file; encrypting the signature key using the master key plaintext to obtain a second sub-file; combining the first and second sub-files to obtain a combined file, and signing and encrypting the combined file using the third private key from the third key pair to obtain the initial encrypted file. The target device verifies the initial encrypted file using the third public key, and if the verification is successful, decrypts the first sub-file using the second private key to obtain the master key plaintext, and then decrypts the second sub-file using the master key plaintext to obtain the signature key.

[0010] Optionally, before generating the third key pair, the method further includes: obtaining the time when the signature key was last generated to obtain the historical generation time; obtaining the update cycle of the signature key and calculating the target time based on the update cycle and the historical generation time; determining whether the target time has been reached, and if the target time has been reached, performing the step of generating the third key pair.

[0011] According to another aspect of this application, a file encryption method is provided. The method includes: generating device verification information and a second public key from a second key pair; signing the device verification information and the second public key using a first private key from a first key pair to obtain a first signed file; and sequentially sending the first public key and the first signed file to a server. The server verifies the first signed file using the first public key from the first key pair to obtain a verification result, generates a signature key based on the device verification information, and encrypts the signature key using the second public key to obtain an initial encrypted file. Upon receiving the initial encrypted file from the server, the server decrypts the initial encrypted file using the second private key from the second key pair to obtain a signature key, and then encrypts a target file using the signature key to obtain a target encrypted file.

[0012] Optionally, before generating the device verification information and the second public key in the second key pair, the method further includes: determining whether a third public key sent by the server has been received, and if the third public key has been received, performing the step of generating the device verification information and the second public key in the second key pair; sequentially sending the first public key and the first signature file to the server includes: if the third public key sent by the server has been received, sending the first public key to the server, and if a file sending instruction sent by the server has been received, sending the first signature file to the server.

[0013] Optionally, the initial encrypted file is decrypted using the second private key from the second key pair to obtain a signature key, and the target file is encrypted using the signature key to obtain the target encrypted file. This includes: verifying the initial encrypted file using the third public key, wherein the initial encrypted file includes a first sub-file and a second sub-file; if the initial encrypted file passes verification, the first sub-file is decrypted using the second private key to obtain the master key plaintext, and the second sub-file is decrypted using the master key plaintext to obtain the signature key; and feature information is obtained from the target file, and the target file is encrypted using the feature information and the signature key to obtain the target encrypted file.

[0014] Optionally, the target file is a trajectory signature file. The process of obtaining feature information from the target file and encrypting the target file using the feature information and a signature key to obtain the target encrypted file includes: identifying feature information of the target signature in the trajectory signature file, wherein the feature information includes at least one of the following: shape features, stroke features, and texture features; encoding the feature information to obtain feature data, and generating a feature key using the root key and the feature data; encrypting the target file using the signature key to obtain a candidate encrypted file, and encrypting the candidate encrypted file using the feature key to obtain the target encrypted file.

[0015] According to another aspect of this application, a file encryption system is provided. The system includes: a server, configured to, upon receiving a first public key and a first signature file sent by a target device, verify the first signature file using the first public key, obtain a second public key and device verification information from the first signature file in a second key pair, generate a signature key based on the device verification information, encrypt the signature key using the second public key to obtain an initial encrypted file, and send the initial encrypted file to the target device; and a target device, configured to generate device verification information and a second public key from the second key pair, sign the device verification information and the second public key using a first private key from the first key pair to obtain a first signature file, send the first public key and the first signature file to the server, and, upon receiving the initial encrypted file sent by the server, decrypt the initial encrypted file using the second private key to obtain the signature key, obtain feature information from the target file, and encrypt the target file using the feature information and the signature key to obtain a target encrypted file.

[0016] This application employs the following steps: receiving a first signature file sent by a target device, and verifying the first signature file using the first public key in a first key pair to obtain a verification result, wherein the first signature file is obtained by the target device signing device verification information and the second public key using the first private key in the first key pair; if the verification result indicates that the first signature file is normal, obtaining the second public key and device verification information from the second key pair from the first signature file; generating a signature key based on the device verification information, and encrypting the signature key using the second public key to obtain an initial encrypted file; sending the initial encrypted file to the target device, and encrypting the target file using the target device to obtain a target encrypted file, wherein the target device decrypts the initial encrypted file using the second private key in the second key pair to obtain a signature key, and then encrypts the target file using the signature key to obtain the target encrypted file. This solves the problem of low efficiency in updating keys in the device in related technologies. By generating a signature key based on the device verification information of the target device, the frequency and uniqueness of key updates are guaranteed. Furthermore, multiple key pairs are set between the server and the target device to encrypt the transmission of the signature key, enabling the signature key to be securely sent from the server to the target device. This achieves the technical effect of improving the efficiency of key distribution to the target device. Attached Figure Description

[0017] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0018] Figure 1 This is a flowchart of a file encryption method provided according to an embodiment of this application;

[0019] Figure 2 This is a flowchart of another file encryption method provided according to an embodiment of this application;

[0020] Figure 3 This is a schematic diagram of a file encryption system provided according to an embodiment of this application;

[0021] Figure 4 This is a flowchart of an optional file encryption method provided according to an embodiment of this application;

[0022] Figure 5 This is a schematic diagram of a file encryption device according to an embodiment of this application;

[0023] Figure 6 This is a schematic diagram of another file encryption device provided according to an embodiment of this application;

[0024] Figure 7 This is a schematic diagram of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0025] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0026] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] It should be noted that the file encryption method and system specified in this disclosure can be used in the field of information security, or in any field other than information security. The application field of the file encryption method and system specified in this disclosure is not limited.

[0029] It should be noted that all information, user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) used in this application are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with the relevant laws, regulations, and standards of the relevant regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose whether to authorize or refuse use. For example, this system has interfaces with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface, and the relevant information is obtained only after receiving consent from the aforementioned user or organization.

[0030] For ease of description, the following explains some of the nouns or terms used in the embodiments of this application:

[0031] Verification public / private key pair: This is a pair of keys used for digital signature verification, including a public key (used for verification) and a private key (used for signing).

[0032] Encryption public-private key pair: A key pair obtained through an encryption algorithm, consisting of a public key (public) and a private key (non-public), used for data encryption and decryption.

[0033] Master key plaintext: This is the initial key used in an encryption algorithm to generate other keys. It is usually a randomly generated string or sequence of numbers.

[0034] According to an embodiment of this application, a file encryption method is provided.

[0035] Figure 1 This is a flowchart of a file encryption method provided according to an embodiment of this application. For example... Figure 1 As shown, the method includes the following steps:

[0036] Step S101: Receive the first signature file sent by the target device, and verify the first signature file using the first public key in the first key pair to obtain the verification result. The first signature file is obtained by the target device signing the device verification information and the second public key using the first private key in the first key pair.

[0037] It should be noted that the target device can be any signature screen device in a financial institution. The signature screen device is equipped with a screen for users to perform signature operations. After receiving the user's signature, the device can encrypt and store the signature using a stored signature key to ensure the security of the signature. The signature key is the key corresponding to the user's signature, and its function is to encrypt the user's signature file (i.e., the target file) to ensure the security of the signature file.

[0038] It should be noted that the first key pair can consist of a first public key and a first private key. The first key pair can be used to verify the public and private key pair and determine whether the transmitted file has been modified, thereby ensuring the accuracy of the file content.

[0039] Specifically, in this embodiment, the execution entity is the server. After the server receives the first signature file sent by the target device, since the first signature file is a file obtained by the target device after signing and authenticating with the first private key, it is necessary to use the first public key in the first key pair to verify the first signature file and obtain the verification result. Based on the verification result, it can be determined whether the file content in the first signature file has been tampered with. For example, the verification result can be: "The first signature file has not been tampered with".

[0040] It should be noted that since the first signature file is signed by the target device using the first private key in the first key pair, the target device needs to send the first public key to the server first. Only when the server receives the first signature file can it use the first public key to verify the first signature file.

[0041] It should be noted that the first signature file contains a second public key and device verification information. The device verification information can be related to the target device, such as the device ID and name, or it can include information related to the device verification information itself, such as the generation and transmission times. The second public key can be used to encrypt the signature key generated by the server, thereby ensuring the security of the signature key when it is sent from the server to the target device.

[0042] Step S102: If the verification result indicates that the first signature file is normal, obtain the second public key and device verification information from the second key pair in the first signature file.

[0043] The second key pair can be an encrypted public-private key pair, used to encrypt the signature key.

[0044] Specifically, if the first signature file is verified to be normal using the first public key, the second public key and device verification information can be obtained from the second key pair in the first signature file. This allows the server to generate a signature key associated with the target device based on the device verification information when generating the signature key, and to encrypt the signature key using the second public key, thereby ensuring the randomness and security of the signature key.

[0045] Step S103: Generate a signature key based on the device verification information, and encrypt the signature key using the second public key to obtain the initial encrypted file.

[0046] Specifically, after obtaining the device verification information, since the device verification information may contain relevant device information as well as other random information such as time elements, a signature key can be generated through the device verification information. This ensures that the signature key is not only associated with the target device, but also guarantees the randomness of the signature key, thereby improving the security of the signature key.

[0047] Furthermore, after generating the signature key, since the signature key needs to be sent from the server to the target device, the signature key can be encrypted using the second public key to obtain the initial encrypted file. After receiving the initial encrypted file, the target device can use the second private key in the target device to decrypt the initial encrypted file to obtain the signature key, thereby ensuring the security of the signature key during transmission.

[0048] Step S104: The initial encrypted file is sent to the target device, and the target device encrypts the target file to obtain the target encrypted file. The target device uses the second private key in the second key pair to decrypt the initial encrypted file to obtain the signing key, and uses the signing key to encrypt the target file to obtain the target encrypted file.

[0049] Specifically, after obtaining the initial encrypted file, it can be sent to the target device. After decrypting the initial encrypted file, the target device can use the signing key to encrypt the user's signature (i.e., the target file) to obtain the target encrypted file. This allows subsequent operations such as storing the target encrypted file, ensuring the security of the target file stored on the target device. Alternatively, the target encrypted file can be sent to a database for storage, and the target file and the target encrypted file can be deleted from the target device, ensuring that the signing key and the target file are stored on different devices, thus guaranteeing the security of the target file.

[0050] The file encryption method provided in this application embodiment receives a first signed file sent by a target device and verifies the first signed file using the first public key in a first key pair to obtain a verification result. The first signed file is obtained by the target device signing device verification information and a second public key using the first private key in the first key pair. If the verification result indicates that the first signed file is normal, the second public key and device verification information from the second key pair are obtained from the first signed file. A signature key is generated based on the device verification information, and the signature key is encrypted using the second public key to obtain an initial encrypted file. The initial encrypted file is sent to the target device, which encrypts the target file to obtain a target encrypted file. The target device decrypts the initial encrypted file using the second private key in the second key pair to obtain a signature key, and then uses the signature key to encrypt the target file to obtain the target encrypted file. This method solves the problem of low efficiency in updating keys in related technologies. By generating a signature key based on the device verification information of the target device, the frequency and uniqueness of key updates are guaranteed. Furthermore, multiple key pairs are set between the server and the target device to encrypt the transmission of the signature key, enabling the signature key to be securely sent from the server to the target device. This achieves the technical effect of improving the efficiency of key distribution to the target device.

[0051] To improve the security of the signature key, optionally, in the file encryption method provided in this application embodiment, generating the signature key based on the device verification information includes: obtaining the identification information of the target device from the device verification information and obtaining the receiving time of the receiving device verification information; reading the root key from the storage space and combining the root key, the identification information and the receiving time to obtain the signature key.

[0052] It should be noted that the root key is the initial key used to generate the signature key. It can be a randomly generated string of characters or a key generated by a specific algorithm. After obtaining the device verification information, the unique identification information of the target device can be obtained from the device verification information. The identification information is information used to uniquely identify the target device, which can be a combination of relevant information such as device number, device name, and device deployment location.

[0053] Furthermore, to ensure the randomness of the key, the receiving time of the receiving device verification information can be obtained from the device verification information, and the receiving time can be used as a random feature in the process of generating the signature key. The receiving time is the timestamp when the signature key is generated, which can ensure the randomness and uniqueness of the signature key.

[0054] Furthermore, after obtaining the identification information, time information, and root key, the root key, identification information, and receiving time can be combined according to certain rules, such as by splicing, calculation, encryption, etc., to generate a signature key.

[0055] This embodiment combines the root key, identification information, and reception time according to certain rules to obtain the signature key, thereby achieving the technical effect of generating a signature key that is secure, random, and device-associated, ensuring the security of encrypting the target file.

[0056] To improve the security of the signature key during transmission, optionally, in the file encryption method provided in this application embodiment, before receiving the first signature file sent by the target device, the method further includes: generating a third key pair and sending the third public key in the third key pair to the target device; determining whether the first public key sent by the target device is received within a preset time interval; if the first public key is received, sending a file sending instruction to the target device, wherein the file sending instruction is used to instruct the target device to send the first signature file; if the first public key is not received, issuing an alarm message.

[0057] Specifically, the third key pair can be a public-private key pair for signature verification. Before receiving the first signed file sent by the target device, the server can send the third public key from the third key pair to the target device. The purpose of sending the third public key is twofold: first, it serves as a notification to the target device, informing it that it can send the first public key to the server; second, it sends the third public key to the target device, enabling the server to further encrypt the file content in the initial encrypted file using the third private key when sending the initial encrypted file to the target device. The target device can then use the third public key to decrypt the file, thereby further enhancing the security of the signature key in the initial encrypted file.

[0058] Furthermore, after sending the third public key to the target device, it is necessary to determine whether the first public key sent by the target device has been received within a preset time interval. If the first public key is not received, it indicates that the data transmission line between the server and the target device may be abnormal, causing the target device to be unable to receive the third public key sent by the server, or the target device to be unable to send information to the server. At this time, an alarm message needs to be issued to maintain the target device, the server, and the data transmission line in a timely manner, so as to ensure the timely transmission and updating of the signature key.

[0059] This embodiment transmits a third public key, enabling the target device to verify the content of the initially encrypted file using the third public key. Furthermore, the transmission result of the third public key can determine the status of the data transmission line, thereby improving the security of the transmitted signature key while ensuring the stability of data transmission.

[0060] To improve the security of the signature key, optionally, in the file encryption method provided in this application embodiment, the second key pair includes a second public key and a second private key, and the third key pair includes a third public key and a third private key. Encrypting the signature key using the second public key to obtain an initial encrypted file includes: generating a master key plaintext and encrypting the master key plaintext using the second public key to obtain a first sub-file; encrypting the signature key using the master key plaintext to obtain a second sub-file; combining the first sub-file and the second sub-file to obtain a combined file, and signing and encrypting the combined file using the third private key from the third key pair to obtain the initial encrypted file. The target device verifies the initial encrypted file using the third public key, and if the verification is successful, decrypts the first sub-file using the second private key to obtain the master key plaintext, and decrypts the second sub-file using the master key plaintext to obtain the signature key.

[0061] Specifically, when encrypting the signature key, the master key plaintext can be generated first, and then the master key plaintext can be encrypted using the second public key to obtain the first sub-file. The master key plaintext can then be encrypted using the first sub-file to ensure the security of the master key plaintext.

[0062] Furthermore, the signature key is encrypted using the master key in plaintext to obtain a second sub-file, which is then used to encrypt the signature key, ensuring its security.

[0063] Furthermore, after obtaining the first and second sub-files, the first and second sub-files can be combined to obtain a combined file. The combined file is then signed and encrypted using a third private key to obtain an initial encrypted file. Thus, the content of the combined file is encrypted using the third private key, ensuring that the combined file cannot be tampered with.

[0064] It should be noted that the styles of the first and second sub-files can be further disguised so that when the first and second sub-files are identified from the outside, the identification result is that the first and second sub-files are exactly the same. This makes it impossible to distinguish between the first and second sub-files without using the second private key for decryption, thereby improving the security of the signing key in the second sub-file.

[0065] Furthermore, after the target device receives the initial encrypted file, it can use the second private key to decrypt the first and second sub-files. At this time, only the first sub-file can be decrypted to obtain the master key plaintext, and the master key plaintext can be used to decrypt the second sub-file to obtain the signature key, thereby improving the security of the target device obtaining the signature key.

[0066] This embodiment uses a second public key to encrypt the plaintext master key to obtain a first sub-file, uses the plaintext master key to encrypt the signature key to obtain a second sub-file, and uses a third private key to encrypt both the first and second sub-files. This increases the complexity of obtaining the signature key and ensures the secure transmission of the signature key.

[0067] Optionally, in the file encryption method provided in this application embodiment, before generating the third key pair, the method further includes: obtaining the time when the signature key was last generated to obtain the historical generation time; obtaining the update cycle of the signature key and calculating the target time based on the update cycle and the historical generation time; determining whether the target time has been reached, and if the target time has been reached, performing the step of generating the third key pair.

[0068] It should be noted that, in order to ensure that the signing key is automatically updated according to a certain period, the historical moment when the signing key was last generated can be obtained, the time difference between the current moment and the historical moment can be determined, and the update period can be obtained. When the time difference reaches the update period, it indicates that the signing key needs to be updated at the current moment. At this time, the step of generating a third key pair can be executed, thereby initiating the above-mentioned interactive operation between the server and the target device. This allows the target device to obtain the updated signing key and replace the signing key from the historical moment with the updated signing key, ensuring the timeliness of the signing key and the security of the target file.

[0069] According to an embodiment of this application, another file encryption method is provided. Figure 2 This is a flowchart of another file encryption method provided according to an embodiment of this application, such as... Figure 2 As shown, the method includes the following steps:

[0070] Step S201: Generate device verification information and the second public key in the second key pair; use the first private key in the first key pair to sign the device verification information and the second public key to obtain a first signature file; and send the first public key and the first signature file to the server in sequence. The server uses the first public key in the first key pair to verify the first signature file, obtains the verification result, generates a signature key based on the device verification information, and uses the second public key to encrypt the signature key to obtain an initial encrypted file.

[0071] Specifically, the target device can obtain device verification information, generate a second key pair and a first key pair, and use the first private key in the first key pair to sign the device verification information and the second public key to obtain a first signature file. Upon receiving the third public key sent by the server, the target device sends the first public key to the server. Upon receiving a file sending instruction, the target device sends the first signature file to the server, enabling the server to generate a signature key based on the device verification information in the first signature file and encrypt it using the second public key to obtain an initial encrypted file.

[0072] Step S202: After receiving the initial encrypted file sent by the server, the initial encrypted file is decrypted using the second private key in the second key pair to obtain the signing key, and the target file is encrypted using the signing key to obtain the target encrypted file.

[0073] Specifically, after the target device receives the initial encrypted file sent by the server, it can decrypt the initial encrypted file to obtain the signed file, and then use the signing key to encrypt the target file to obtain the target encrypted file, thereby ensuring the security of the target file.

[0074] Furthermore, subsequent operations such as storing the target encrypted file can be performed, or the target encrypted file can be sent to a database for storage, and the target file and the target encrypted file can be deleted from the target device, so that the signing key and the target file are stored on different devices, thus ensuring the security of the target file.

[0075] The file encryption method provided in this application generates device verification information and a second public key from a second key pair. It then uses a first private key from a first key pair to sign the device verification information and the second public key, obtaining a first signed file. The first public key and the first signed file are then sent sequentially to a server. The server verifies the first signed file using the first public key from the first key pair, obtains a verification result, generates a signature key based on the device verification information, and encrypts the signature key using the second public key to obtain an initial encrypted file. Upon receiving the initial encrypted file from the server, the server decrypts the initial encrypted file using the second private key from the second key pair to obtain a signature key, and then uses the signature key to encrypt a target file, obtaining a target encrypted file. This method solves the problem of low efficiency in updating keys in related technologies. By generating a signature key based on the device verification information of the target device, the update frequency and uniqueness of the key are guaranteed. Furthermore, by setting up multiple key pairs between the server and the target device to encrypt and transmit the signature key, the signature key can be securely sent from the server to the target device, thereby improving the efficiency of key distribution to the target device.

[0076] Optionally, in the file encryption method provided in this application embodiment, before generating the device verification information and the second public key in the second key pair, the method further includes: determining whether a third public key sent by the server is received, and if the third public key is received, performing the step of generating the device verification information and the second public key in the second key pair; sequentially sending the first public key and the first signature file to the server includes: if the third public key is received by the server, sending the first public key to the server, and if a file sending instruction is received by the server, sending the first signature file to the server.

[0077] Specifically, when the target device receives the third public key, it needs to generate device verification information and the second public key in the second key pair, and generate the first signature file. At this time, the above-mentioned operation of generating the first signature file needs to be performed, and the first public key is sent to the server.

[0078] Furthermore, upon receiving a file sending instruction from the server, indicating that the server requires the target device to send a first signature file, the server sends the first signature file to the server, thereby ensuring that the server can generate a signature key based on the device verification information in the first signature file.

[0079] Optionally, in the file encryption method provided in this application embodiment, decrypting the initial encrypted file using the second private key in the second key pair to obtain a signature key, and encrypting the target file using the signature key to obtain the target encrypted file includes: verifying the initial encrypted file using a third public key, wherein the initial encrypted file includes a first sub-file and a second sub-file; if the initial encrypted file passes verification, decrypting the first sub-file using the second private key to obtain the master key plaintext, and decrypting the second sub-file using the master key plaintext to obtain the signature key; obtaining feature information in the target file, and encrypting the target file using the feature information and the signature key to obtain the target encrypted file.

[0080] Specifically, since the server uses a third private key to sign the initial encrypted file, after the target device receives the initial encrypted file, it needs to use a third public key to verify the initial encrypted file, and if the verification is correct, determine the accuracy of the first and second sub-files in the initial encrypted file.

[0081] Furthermore, after obtaining the first and second sub-files, the second private key is needed to decrypt both sub-files. At this point, only the first sub-file can be decrypted to obtain the master key plaintext. The master key plaintext is then used to decrypt the second sub-file to obtain the signature key, thereby improving the security of the target device obtaining the signature key.

[0082] Furthermore, when encrypting a target file using a signature key, feature information can be obtained from the target file, and the target file can be encrypted using the feature information and the signature key to obtain an encrypted target file, thereby improving the security of the target file.

[0083] To improve the security of the target file, optionally, in the file encryption method provided in this application embodiment, the target file is a trajectory signature file. Obtaining feature information from the target file and encrypting the target file using the feature information and a signature key to obtain the target encrypted file includes: identifying feature information of the target signature in the trajectory signature file, wherein the feature information includes at least one of the following: shape features, stroke features, and texture features; encoding the feature information to obtain feature data, and generating a feature key using a root key and the feature data; encrypting the target file using the signature key to obtain a candidate encrypted file, and encrypting the candidate encrypted file using the feature key to obtain the target encrypted file.

[0084] Specifically, when acquiring the feature information of the target file, since the target file is the user's trajectory signature file, feature information can be obtained from the trajectory information in the signature. For example, based on the binarized image of the signature, the shape features of the signature can be analyzed, such as the number of connected slices (i.e., the number of interconnected stroke slices), the number of meshes, the aspect ratio of the signature, the effective aspect ratio of the signature, and the ratio of the black dot area to the overall area. The above feature information can be extracted using image processing algorithms. At the same time, the texture features of the signature handwriting can also be analyzed, such as the thickness, depth, and density of the strokes, to obtain texture features, or the dynamic features such as the stroke order, speed, and acceleration during the signature process can be extracted to obtain stroke features. Thus, the above features can be used as the feature information of the trajectory signature file.

[0085] Furthermore, after obtaining the feature information, it is necessary to convert the extracted feature information into digital codes for subsequent processing. For example, this can be achieved by using a feature encoding algorithm (such as a hash algorithm) to convert complex feature information into a fixed-length code, thereby obtaining feature data.

[0086] Furthermore, a feature key can be generated from the root key and feature data, and the target file can be encrypted using the signature key to obtain a candidate encrypted file. The candidate encrypted file can then be encrypted using the feature key to obtain the target encrypted file. This two-layer encryption method double-encrypts the signature key, ensuring its security.

[0087] According to an embodiment of this application, a file encryption system is provided. Figure 3 This is a schematic diagram of a file encryption system provided according to an embodiment of this application, such as... Figure 3 As shown, the system includes:

[0088] Server 31 is configured to, upon receiving a first public key and a first signature file sent by target device 32, verify the first signature file using the first public key, obtain the second public key and device verification information from the second key pair in the first signature file, generate a signature key based on the device verification information, encrypt the signature key using the second public key to obtain an initial encrypted file, and send the initial encrypted file to target device 32.

[0089] The target device 32 is used to generate device verification information and the second public key in the second key pair. It uses the first private key in the first key pair to sign the device verification information and the second public key to obtain a first signature file. It then sends the first public key and the first signature file to the server 31. After receiving the initial encrypted file sent by the server 31, it uses the second private key to decrypt the initial encrypted file to obtain the signature key. It also obtains the feature information in the target file and uses the feature information and the signature key to encrypt the target file to obtain the target encrypted file.

[0090] Specifically, Figure 4 This is a flowchart of an optional file encryption method provided according to an embodiment of this application, such as... Figure 4 As shown, the implementation process is explained below. Figure 3 Data interaction between the server and the target device in a Chinese file encryption system.

[0091] First, the server obtains the last time the signature key was generated, thus obtaining the historical generation time and the signature key update cycle. Based on the update cycle and the historical generation time, the server calculates the target time and determines whether the target time has been reached. If the target time has been reached, the server generates a third key pair and sends the third public key to the target device.

[0092] Furthermore, upon receiving the third public key, the target device generates a first key pair and sends the first public key to the server.

[0093] Furthermore, upon receiving the first public key, the server sends a file sending instruction to the target device. After receiving the file sending instruction, the target device generates device verification information and the second public key in the second key pair. It then uses the first private key in the first key pair to sign the device verification information and the second public key to obtain a first signature file, and sends the first signature file to the server.

[0094] Furthermore, after receiving the first signature file, the server verifies the first signature file using the first public key, obtains device verification information and the second public key, generates a signature key based on the device verification information, further generates a master key plaintext, encrypts the master key plaintext using the second public key to obtain the first sub-file, encrypts the signature key using the master key plaintext to obtain the second sub-file, encrypts the first sub-file and the second sub-file using the third private key to obtain the initial encrypted file, and sends the initial encrypted file to the target device.

[0095] Furthermore, the target device uses a third public key to verify the initial encrypted file and the second private key from the second key pair to decrypt the initial encrypted file, obtaining the signing key. It then acquires the feature information from the target file and uses the feature information and the signing key to encrypt the target file, thus completing the encryption operation. By generating the signing key based on the target device's verification information, the frequency and uniqueness of key updates are ensured. Moreover, by setting up multiple key pairs between the server and the target device to encrypt and transmit the signing key, the signing key can be securely sent from the server to the target device, thereby improving the efficiency of key distribution to the target device.

[0096] The file encryption method provided in this application embodiment, through server 31, upon receiving a first public key and a first signature file sent by target device 32, verifies the first signature file using the first public key, obtains the second public key and device verification information from the second key pair in the first signature file, generates a signature key based on the device verification information, encrypts the signature key using the second public key to obtain an initial encrypted file, and sends the initial encrypted file to target device 32; target device 32, for example, generates device verification information and the second public key from the second key pair, signs the device verification information and the second public key using the first private key from the first key pair to obtain a first signature file, and sends the first public key and the first signature file to server 31; after receiving the initial encrypted file sent by server 31, decrypts the initial encrypted file using the second private key to obtain the signature key, obtains feature information from the target file, and encrypts the target file using the feature information and the signature key to obtain the target encrypted file. This solves the problem of low efficiency in updating keys in devices in related technologies. By generating a signature key based on the device verification information of the target device, the frequency and uniqueness of key updates are guaranteed. Furthermore, multiple key pairs are set between the server and the target device to encrypt the transmission of the signature key, enabling the signature key to be securely sent from the server to the target device. This achieves the technical effect of improving the efficiency of key distribution to the target device.

[0097] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0098] This application also provides a file encryption device. It should be noted that the file encryption device of this application can be used to execute the file encryption method provided in this application. The file encryption device provided in this application is described below.

[0099] Figure 5 This is a schematic diagram of a file encryption device provided according to an embodiment of this application. Figure 5 As shown, the device includes: a receiving unit 51, a first acquisition unit 52, a first encryption unit 53, and a second encryption unit 54.

[0100] The receiving unit 51 is used to receive the first signature file sent by the target device, and to verify the first signature file using the first public key in the first key pair to obtain the verification result. The first signature file is obtained by the target device signing the device verification information and the second public key using the first private key in the first key pair.

[0101] The first acquisition unit 52 is used to acquire the second public key and device verification information from the second key pair in the first signature file when the verification result indicates that there is no abnormality in the first signature file.

[0102] The first encryption unit 53 is used to generate a signature key based on the device verification information and encrypt the signature key using the second public key to obtain an initial encrypted file.

[0103] The second encryption unit 54 is used to send the initial encrypted file to the target device, and the target device encrypts the target file to obtain the target encrypted file. The target device uses the second private key in the second key pair to decrypt the initial encrypted file to obtain the signature key, and uses the signature key to encrypt the target file to obtain the target encrypted file.

[0104] The file encryption device provided in this application embodiment receives a first signed file sent by a target device through a receiving unit 51, and verifies the first signed file using the first public key in the first key pair to obtain a verification result. The first signed file is obtained by the target device signing device verification information and the second public key using the first private key in the first key pair. If the verification result indicates that the first signed file is normal, the first obtaining unit 52 obtains the second public key and device verification information from the first signed file. The first encryption unit 53 generates a signature key based on the device verification information and encrypts the signature key using the second public key to obtain an initial encrypted file. The second encryption unit 54 sends the initial encrypted file to the target device, and the target device encrypts the target file to obtain a target encrypted file. The target device decrypts the initial encrypted file using the second private key in the second key pair to obtain a signature key, and then encrypts the target file using the signature key to obtain the target encrypted file. This invention addresses the issue of low efficiency in updating keys within devices in related technologies. By generating a signature key based on the target device's device verification information, the update frequency and uniqueness of the key are guaranteed. Furthermore, multiple key pairs are set up between the server and the target device to encrypt the transmission of the signature key, enabling the signature key to be securely sent from the server to the target device. This achieves the technical effect of improving the efficiency of key distribution to the target device.

[0105] Optionally, in the file encryption device provided in this application embodiment, the first encryption unit includes: an acquisition module, used to acquire the identification information of the target device from the device verification information and acquire the reception time of the receiving device verification information; and a combination module, used to read the root key from the storage space and combine the root key, the identification information and the reception time to obtain the signature key.

[0106] Optionally, in the file encryption device provided in this application embodiment, before receiving the first signed file sent by the target device, the device further includes: a first generation unit, configured to generate a third key pair and send the third public key in the third key pair to the target device; a first judgment unit, configured to judge whether the first public key sent by the target device is received within a preset time interval; a sending unit, configured to send a file sending instruction to the target device when the first public key is received, wherein the file sending instruction is used to instruct the target device to send the first signed file; and an alarm unit, configured to issue an alarm message when the first public key is not received.

[0107] Optionally, in the file encryption device provided in this application embodiment, the second key pair includes a second public key and a second private key, the third key pair includes a third public key and a third private key, and the first encryption unit includes: a first encryption module, used to generate a master key plaintext and encrypt the master key plaintext using the second public key to obtain a first sub-file; a second encryption module, used to encrypt a signature key using the master key plaintext to obtain a second sub-file; and a third encryption module, used to combine the first sub-file and the second sub-file to obtain a combined file, and to sign and encrypt the combined file using the third private key in the third key pair to obtain an initial encrypted file. The target device verifies the initial encrypted file using the third public key, and if the verification is successful, decrypts the first sub-file using the second private key to obtain the master key plaintext, and decrypts the second sub-file using the master key plaintext to obtain the signature key.

[0108] Optionally, in the file encryption device provided in this application embodiment, before generating the third key pair, the device further includes: a second acquisition unit, used to acquire the time of the last generation of the signature key to obtain the historical generation time; a third acquisition unit, used to acquire the update cycle of the signature key and calculate the target time based on the update cycle and the historical generation time; and a second judgment unit, used to judge whether the target time has been reached, and if the target time has been reached, to execute the step of generating the third key pair.

[0109] Figure 6 This is a schematic diagram of another file encryption device provided according to an embodiment of this application. For example... Figure 6 As shown, the device includes: a second generation unit 61 and a third encryption unit 62.

[0110] The second generation unit 61 is used to generate device verification information and the second public key in the second key pair, sign the device verification information and the second public key using the first private key in the first key pair to obtain a first signature file, and send the first public key and the first signature file to the server in sequence. The server uses the first public key in the first key pair to verify the first signature file to obtain a verification result, generates a signature key based on the device verification information, and encrypts the signature key using the second public key to obtain an initial encrypted file.

[0111] The third encryption unit 62 is used to decrypt the initial encrypted file using the second private key in the second key pair after receiving the initial encrypted file sent by the server, to obtain the signature key, and then use the signature key to encrypt the target file to obtain the target encrypted file.

[0112] The file encryption device provided in this application embodiment generates device verification information and a second public key from a second key pair using a second generation unit 61. It then signs the device verification information and the second public key using a first private key from a first key pair to obtain a first signed file. The first public key and the first signed file are then sent sequentially to a server. The server verifies the first signed file using the first public key from the first key pair, obtains a verification result, generates a signature key based on the device verification information, and encrypts the signature key using the second public key to obtain an initial encrypted file. After receiving the initial encrypted file from the server, the third encryption unit 62 decrypts the initial encrypted file using the second private key from the second key pair to obtain a signature key, and then encrypts the target file using the signature key to obtain a target encrypted file. This solves the problem of low efficiency in updating keys in related technologies. By generating a signature key based on the device verification information of the target device, the update frequency and uniqueness of the key are guaranteed. Furthermore, by setting up multiple key pairs between the server and the target device to encrypt and transmit the signature key, the signature key can be securely sent from the server to the target device, thereby improving the efficiency of key distribution to the target device.

[0113] Optionally, in the file encryption device provided in this application embodiment, before generating the device verification information and the second public key in the second key pair, the device further includes: a third judging unit, used to judge whether a third public key sent by the server is received, and if the third public key is received, to perform the step of generating the device verification information and the second public key in the second key pair; the second generating unit includes: a sending module, used to send a first public key to the server if the third public key is received, and to send a first signature file to the server if a file sending instruction is received from the server.

[0114] Optionally, in the file encryption device provided in this application embodiment, the third encryption unit includes: a verification module, used to verify the initial encrypted file using a third public key, wherein the initial encrypted file includes a first sub-file and a second sub-file; a decryption module, used to decrypt the first sub-file using a second private key to obtain the master key plaintext, and use the master key plaintext to decrypt the second sub-file to obtain the signature key, provided that the initial encrypted file has passed verification; and a fourth encryption module, used to obtain feature information in the target file, and use the feature information and the signature key to encrypt the target file to obtain the target encrypted file.

[0115] Optionally, in the file encryption device provided in this application embodiment, the target file is a trajectory signature file, and the fourth encryption module includes: an identification submodule, used to identify the feature information of the target signature in the trajectory signature file, wherein the feature information includes at least one of the following: shape features, stroke features, and texture features; an encoding submodule, used to encode the feature information to obtain feature data, and generate a feature key through the root key and the feature data; and an encryption submodule, used to encrypt the target file using the signature key to obtain a candidate encrypted file, and encrypt the candidate encrypted file using the feature key to obtain the target encrypted file.

[0116] The aforementioned file encryption device includes a processor and a memory. The receiving unit 51, the first acquisition unit 52, the first encryption unit 53, the second encryption unit 54, the second generation unit 61, the third encryption unit 62, etc., are all stored in the memory as program units. The processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0117] The processor contains a kernel, which retrieves the corresponding program unit from memory. One or more kernels can be configured; by adjusting kernel parameters, the low efficiency of updating keys in the device can be addressed in related technologies.

[0118] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0119] This invention provides a computer-readable storage medium storing a program thereon, which, when executed by a processor, implements the file encryption method.

[0120] This invention provides a processor for running a program, wherein the program executes the file encryption method during runtime.

[0121] Figure 7 This is a schematic diagram of an electronic device provided according to an embodiment of this application, such as... Figure 7 As shown, this embodiment of the invention provides an electronic device 70, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of the above-described file encryption method. The device in this document can be a server, PC, PAD, mobile phone, etc.

[0122] This application also provides a computer program product that, when executed on a data processing device, is adapted to perform the steps of initializing the above-described file encryption method.

[0123] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0124] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0125] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0126] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0127] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0128] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0129] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0130] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0131] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A file encryption method, characterized in that, include: The system receives a first signature file sent by the target device and verifies the first signature file using the first public key in the first key pair to obtain a verification result. The first signature file is obtained by the target device signing the device verification information and the second public key using the first private key in the first key pair. If the verification result indicates that the first signature file is normal, the second public key and device verification information in the second key pair are obtained from the first signature file. A signature key is generated based on the device verification information and the time of receiving the device verification information. The master key plaintext is encrypted using the second public key, and the signature key is encrypted using the master key plaintext to obtain the initial encrypted file. The initial encrypted file is sent to the target device, which then encrypts the target file to obtain the target encrypted file. The target device uses the second private key from the second key pair to decrypt the initial encrypted file to obtain the signing key, and then uses the signing key to encrypt the target file to obtain the target encrypted file.

2. The method according to claim 1, characterized in that, Generating a signature key based on the device verification information and the time of receiving the device verification information includes: Obtain the identification information of the target device from the device verification information, and obtain the receiving time of receiving the device verification information; The root key is read from the storage space, and the root key, the identification information, and the receiving time are combined to obtain the signature key.

3. The method according to claim 1, characterized in that, Before receiving the first signature file sent by the target device, the method further includes: Generate a third key pair and send the third public key from the third key pair to the target device; Determine whether the first public key sent by the target device has been received within a preset time interval; Upon receiving the first public key, a file sending instruction is sent to the target device, wherein the file sending instruction is used to instruct the target device to send the first signature file; If the first public key is not received, an alarm message is issued.

4. The method according to claim 3, characterized in that, The second key pair includes the second public key and the second private key, and the third key pair includes the third public key and the third private key. The master key plaintext is encrypted using the second public key, and the signature key is encrypted using the master key plaintext to obtain the initial encrypted file, which includes: Generate a master key plaintext and encrypt the master key plaintext using the second public key to obtain the first sub-file; The signature key is encrypted using the plaintext of the master key to obtain the second sub-file; The first sub-file and the second sub-file are combined to obtain a combined file. The combined file is then signed and encrypted using the third private key from the third key pair to obtain the initial encrypted file. The target device verifies the initial encrypted file using the third public key. If the verification is successful, the first sub-file is decrypted using the second private key to obtain the master key plaintext. The second sub-file is then decrypted using the master key plaintext to obtain the signing key.

5. The method according to claim 3, characterized in that, Before generating the third key pair, the method further includes: Obtain the time when the signature key was last generated to get the historical generation time; Obtain the update cycle of the signature key, and calculate the target time based on the update cycle and the historical generation time; Determine whether the target time has been reached, and if the target time has been reached, execute the step of generating the third key pair.

6. A file encryption method, characterized in that, include: The system generates device verification information and a second public key from a second key pair. It then uses a first private key from a first key pair to sign the device verification information and the second public key, obtaining a first signature file. The system then sends the first public key and the first signature file to a server. The server uses the first public key from the first key pair to verify the first signature file, obtaining a verification result. Based on the device verification information and the time the device verification information is received, the server generates a signature key. It then uses the second public key to encrypt the plaintext master key, and uses the plaintext master key to encrypt the signature key, obtaining an initial encrypted file. After receiving the initial encrypted file sent by the server, the initial encrypted file is decrypted using the second private key in the second key pair to obtain the signing key, and the target file is encrypted using the signing key to obtain the target encrypted file.

7. The method according to claim 6, characterized in that, Before generating the device verification information and the second public key in the second key pair, the method further includes: Determine whether the third public key sent by the server has been received, and if the third public key has been received, execute the step of generating the device verification information and the second public key in the second key pair; Sending the first public key and the first signature file to the server in sequence includes: Upon receiving the third public key sent by the server, the first public key is sent to the server; upon receiving the file sending instruction sent by the server, the first signature file is sent to the server.

8. The method according to claim 7, characterized in that, The initial encrypted file is decrypted using the second private key from the second key pair to obtain the signing key, and the target file is then encrypted using the signing key to obtain the target encrypted file, which includes: The initial encrypted file is verified using the third public key, wherein the initial encrypted file includes a first sub-file and a second sub-file; If the initial encrypted file passes verification, the first sub-file is decrypted using the second private key to obtain the master key plaintext, and the second sub-file is decrypted using the master key plaintext to obtain the signature key; The feature information in the target file is obtained, and the target file is encrypted using the feature information and the signature key to obtain the target encrypted file.

9. The method according to claim 8, characterized in that, The target file is a trajectory signature file. Feature information is obtained from the target file, and the target file is encrypted using the feature information and the signature key to obtain the encrypted target file, which includes: Identify the feature information of the target signature in the trajectory signature file, wherein the feature information includes at least one of the following: shape features, stroke features, and texture features; The feature information is encoded to obtain feature data, and a feature key is generated using the root key and the feature data; The target file is encrypted using the signature key to obtain a candidate encrypted file, and the candidate encrypted file is then encrypted using the feature key to obtain the target encrypted file.

10. A file encryption system, characterized in that, include: The server is configured to, upon receiving a first public key and a first signature file sent by a target device, verify the first signature file using the first public key, obtain the second public key and device verification information from the second key pair in the first signature file, generate a signature key based on the device verification information and the time of receiving the device verification information, encrypt the master key plaintext using the second public key, encrypt the signature key using the master key plaintext, obtain an initial encrypted file, and send the initial encrypted file to the target device. The target device is used to generate device verification information and a second public key in a second key pair. It uses a first private key in a first key pair to sign the device verification information and the second public key to obtain a first signature file. It then sends the first public key and the first signature file to the server. After receiving an initial encrypted file from the server, it uses the second private key to decrypt the initial encrypted file to obtain a signature key. It also obtains feature information from the target file and uses the feature information and the signature key to encrypt the target file to obtain a target encrypted file.

Images