A file authorization method and terminal

Abstract

The application discloses a file authorization method and a terminal, which comprises the following steps: marking file areas in a target file; using a homomorphic encryption algorithm to encrypt each file area to obtain encrypted area data and storing the encrypted area data; accepting an access request, wherein the access request comprises an identity and target data; obtaining a target file area corresponding to the target data; judging whether the identity is in an authorization list corresponding to the target file area; if yes, obtaining a key and a tool corresponding to the homomorphic encryption algorithm; accessing the encrypted area data corresponding to the target file area according to the key and the tool, performing calculation according to the target data, and returning a calculation result; when receiving the access request, the target data in the access request can be used to reduce the accessible range, and the authorization list can be used to confirm whether the identity in the access request has corresponding access authority, so that access control can be realized for each file area, and the complete target file can be managed and authorized in a more refined manner.

Description

Technical Field

[0001] This invention relates to the field of file storage encryption, and more particularly to a file authorization method and terminal. Background Technology

[0002] With the rapid development of big data and cloud computing technologies, the demand for processing and analyzing unstructured data is increasing. However, the security management and access control of unstructured data such as text files still face challenges. Existing technologies typically offer global access permissions to files, lacking fine-grained control over different parts of the file. Furthermore, traditional encryption technologies cannot perform computational processing on encrypted data, limiting its usability. Summary of the Invention

[0003] The technical problem to be solved by this invention is to provide a file authorization method and terminal to achieve flexible management and use of files.

[0004] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0005] A file authorization method, comprising the following steps:

[0006] Mark the file region in the target file;

[0007] Each of the aforementioned file regions is encrypted using a homomorphic encryption algorithm to obtain encrypted region data, which is then stored.

[0008] Accept the access request, which includes an identity identifier and target data;

[0009] Obtain the target file region corresponding to the target data;

[0010] Determine whether the identity identifier is in the authorization list corresponding to the target file area; if so, obtain the key and tool corresponding to the homomorphic encryption algorithm.

[0011] After accessing the encrypted region data corresponding to the target file region using the key and tools, calculations are performed based on the target data and the calculation results are returned.

[0012] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is as follows:

[0013] A file authorization terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it performs the following steps:

[0014] Mark the file region in the target file;

[0015] Each of the aforementioned file regions is encrypted using a homomorphic encryption algorithm to obtain encrypted region data, which is then stored.

[0016] Accept the access request, which includes an identity identifier and target data;

[0017] Obtain the target file region corresponding to the target data;

[0018] Determine whether the identity identifier is in the authorization list corresponding to the target file area; if so, obtain the key and tool corresponding to the homomorphic encryption algorithm.

[0019] After accessing the encrypted region data corresponding to the target file region using the key and tools, calculations are performed based on the target data and the calculation results are returned.

[0020] The beneficial effects of this invention are as follows: the target file is divided into multiple file regions, and each file region is encrypted using a homomorphic encryption algorithm. The homomorphic encryption algorithm can perform calculations on the data while the data is encrypted, thereby improving the confidentiality of the data. At the same time, the management of the target file is refined by dividing the file regions. When an access request is received, the accessible scope can be narrowed down according to the target data in it, and the identity identifier in the access request can be confirmed according to the authorization list to see if it has the corresponding access rights. Thus, access control can be implemented for each file region, enabling more refined management and authorization of a complete target file. Attached Figure Description

[0021] Figure 1 This is a flowchart illustrating the steps of a file authorization method according to an embodiment of the present invention;

[0022] Figure 2 Flowchart for constructing the authorization list according to an embodiment of the present invention;

[0023] Figure 3 This is a flowchart illustrating the visitor access process according to an embodiment of the present invention.

[0024] Figure 4 This is a flowchart of the homomorphic encryption process according to an embodiment of the present invention;

[0025] Figure 5 This is a flowchart illustrating a file authorization method in a specific scenario according to an embodiment of the present invention;

[0026] Figure 6 This is a schematic diagram of the structure of a file authorization terminal according to an embodiment of the present invention;

[0027] Label Explanation:

[0028] 1. A file authorization terminal; 2. A processor; 3. A memory. Detailed Implementation

[0029] To explain in detail the technical content, objectives, and effects of the present invention, the following description is provided in conjunction with the embodiments and accompanying drawings.

[0030] Please refer to Figure 1 A file authorization method, comprising the following steps:

[0031] Mark the file region in the target file;

[0032] Each of the aforementioned file regions is encrypted using a homomorphic encryption algorithm to obtain encrypted region data, which is then stored.

[0033] Accept the access request, which includes an identity identifier and target data;

[0034] Obtain the target file region corresponding to the target data;

[0035] Determine whether the identity identifier is in the authorization list corresponding to the target file area; if so, obtain the key and tool corresponding to the homomorphic encryption algorithm.

[0036] After accessing the target file region using the key and tools, the system performs calculations based on the target data and returns the calculation results.

[0037] As can be seen from the above description, the beneficial effects of the present invention are as follows: the target file is divided into multiple file regions, and each file region is encrypted using a homomorphic encryption algorithm. The homomorphic encryption algorithm can perform calculations on the data while the data is encrypted, thereby improving the confidentiality of the data. At the same time, the management of the target file is refined by refining the file regions. When an access request is received, the accessible range can be narrowed down according to the target data in it, and the identity identifier in the access request can be confirmed according to the authorization list to see if it has the corresponding access rights. Thus, access control can be implemented for each file region, enabling more refined management and authorization of a complete target file.

[0038] Furthermore, the file region in the marked target file includes:

[0039] Obtain preset partitioning rules, and divide the target file into regions according to the partitioning rules to obtain file regions;

[0040] Record the start and end positions of each of the aforementioned file regions; or

[0041] The target file is split into file blocks according to the start and end positions of each file region;

[0042] Associate a first identifier and metadata with each of the aforementioned file regions.

[0043] As described above, when partitioning a file, the start and end positions of each file region are recorded. That is, instead of physically splitting the target file, the file regions are distinguished by storing logical partition positions. This avoids splitting the target file itself and complicates management. If the target file is too large, it can also be directly split into file blocks based on the start and end positions to complete the file region division. In this way, the entire target file does not need to be opened during calculation, thus improving the overall processing performance.

[0044] Furthermore, determining whether the identity identifier precedes the authorization list corresponding to the target file area includes:

[0045] Determine the access permission level for each of the file regions;

[0046] Obtain the visitor list, and associate the file area and access permission level corresponding to each visitor identifier in the visitor list to obtain the authorization list.

[0047] As described above, each file region has its own access permission level, and a list of possible visitors is pre-configured. The accessible file regions and access permission levels for each visitor in the visitor list are configured, thus enabling access control of visitors at the file region level. This allows for the opening of partial content of a file without opening the entire target file, and different file regions can be matched with different permission configurations, achieving fine-grained file management.

[0048] Furthermore, the step of accessing the encrypted region data corresponding to the target file region according to the key and tool, performing calculations based on the target data, and returning the calculation results further includes:

[0049] After accessing the encrypted region data corresponding to the target file region according to the key and tool, the target file region is marked as locked.

[0050] After performing calculations based on the target data and returning the calculation results, the locked state is released; or

[0051] Once the time for accessing the encrypted area data reaches a preset time, the locked state is released.

[0052] As described above, homomorphic encryption algorithms require corresponding keys and tools to obtain content. During the execution of a region, setting the file region to a locked state can protect the current execution process and prevent multiple users from executing the same data simultaneously, thus affecting the accuracy of the data.

[0053] Furthermore, the homomorphic encryption algorithms corresponding to different file regions are different.

[0054] As described above, in addition to setting access permissions for different file regions, different homomorphic algorithms can also be selected for different file regions. Even if a user gains access to other file regions, they will not be able to calculate the required data.

[0055] A file authorization terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it performs the following steps:

[0056] Mark the file region in the target file;

[0057] Each of the aforementioned file regions is encrypted using a homomorphic encryption algorithm to obtain encrypted region data, which is then stored.

[0058] Accept the access request, which includes an identity identifier and target data;

[0059] Obtain the target file region corresponding to the target data;

[0060] Determine whether the identity identifier is in the authorization list corresponding to the target file area; if so, obtain the key and tool corresponding to the homomorphic encryption algorithm.

[0061] After accessing the encrypted region data corresponding to the target file region using the key and tools, calculations are performed based on the target data and the calculation results are returned.

[0062] The beneficial effects of this invention are as follows: the target file is divided into multiple file regions, and each file region is encrypted using a homomorphic encryption algorithm. The homomorphic encryption algorithm can perform calculations on the data while the data is encrypted, thereby improving the confidentiality of the data. At the same time, the management of the target file is refined by dividing the file regions. When an access request is received, the accessible scope can be narrowed down according to the target data in it, and the identity identifier in the access request can be confirmed according to the authorization list to see if it has the corresponding access rights. Thus, access control can be implemented for each file region, enabling more refined management and authorization of a complete target file.

[0063] Furthermore, the file region in the marked target file includes:

[0064] Obtain preset partitioning rules, and divide the target file into regions according to the partitioning rules to obtain file regions;

[0065] Record the start and end positions of each of the aforementioned file regions; or

[0066] The target file is split into file blocks according to the start and end positions of each file region;

[0067] Associate a first identifier and metadata with each of the aforementioned file regions.

[0068] As described above, when partitioning a file, the start and end positions of each file region are recorded. That is, instead of physically splitting the target file, the file regions are distinguished by storing logical partition positions. This avoids splitting the target file itself and complicates management. If the target file is too large, it can also be directly split into file blocks based on the start and end positions to complete the file region division. In this way, the entire target file does not need to be opened during calculation, thus improving the overall processing performance.

[0069] Furthermore, determining whether the identity identifier precedes the authorization list corresponding to the target file area includes:

[0070] Determine the access permission level for each of the file regions;

[0071] Obtain the visitor list, and associate the file area and access permission level corresponding to each visitor identifier in the visitor list to obtain the authorization list.

[0072] As described above, each file region has its own access permission level, and a list of possible visitors is pre-configured. The accessible file regions and access permission levels for each visitor in the visitor list are configured, thus enabling access control of visitors at the file region level. This allows for the opening of partial content of a file without opening the entire target file, and different file regions can be matched with different permission configurations, achieving fine-grained file management.

[0073] Furthermore, the step of accessing the encrypted region data corresponding to the target file region according to the key and tool, performing calculations based on the target data, and returning the calculation results further includes:

[0074] After accessing the encrypted region data corresponding to the target file region according to the key and tool, the target file region is marked as locked.

[0075] After performing calculations based on the target data and returning the calculation results, the locked state is released; or

[0076] Once the time for accessing the encrypted area data reaches a preset time, the locked state is released.

[0077] As described above, homomorphic encryption algorithms require corresponding keys and tools to obtain content. During the execution of a region, setting the file region to a locked state can protect the current execution process and prevent multiple users from executing the same data simultaneously, thus affecting the accuracy of the data.

[0078] Furthermore, the homomorphic encryption algorithms corresponding to different file regions are different.

[0079] As described above, in addition to setting access permissions for different file regions, different homomorphic algorithms can also be selected for different file regions. Even if a user gains access to other file regions, they will not be able to calculate the required data.

[0080] The file authorization method and terminal described above are applicable to scenarios where different management strategies need to be applied to each part of the target file. The following detailed embodiments illustrate these methods.

[0081] Please refer to Figure 1 Embodiment 1 of the present invention is as follows:

[0082] A file authorization method, specifically including:

[0083] Please refer to Figure 2 S1, Mark file regions in the target file, including:

[0084] S10. Conduct a comprehensive review of the text file content to determine the content of different chapters and the types of sensitive information they contain;

[0085] The structure of text files is not limited to a fixed organizational structure and can be quite flexible.

[0086] S11. Obtain preset partitioning rules, and divide the target file into regions according to the partitioning rules to obtain file regions;

[0087] In one alternative implementation, the file is divided into multiple file regions based on the content of the target file, the sensitivity of the content, departmental needs or other business rules, semantics or other standards; for example, the regions can be divided according to organizational structure, data type or security level.

[0088] S12. Record the start and end positions of each file region; or split the target file into file blocks according to the start and end positions of each file region.

[0089] For example, the start and end positions of each file region can be stored in the file management system, so that the system can identify and control access to each file region without splitting the file;

[0090] S13. Associate each file region with a first identifier and metadata (such as encrypted hash value, file size, timestamp, etc., or set custom attributes or tags for each file region to facilitate searching).

[0091] For example, when data analysis and processing of financial services or medical and health data are required under confidential conditions, the use of homomorphic encrypted blockchain distributed storage can protect the security and privacy of the data, and also allow for effective data processing without decrypting the data, which greatly expands the application scope of blockchain distributed storage.

[0092] S14. Preprocess the contents of each file region to ensure they are suitable for subsequent encryption and access control processes. This may include text cleaning, formatting, and encoding;

[0093] In one alternative implementation, after obtaining the file area, the partitioning strategy, i.e., the partitioning rules, can be confirmed with relevant departments and the data security team to ensure that it meets all relevant business needs and security requirements.

[0094] S2. Encrypt each of the file regions using a homomorphic encryption algorithm to obtain encrypted region data and store it.

[0095] In one optional implementation, the homomorphic encryption algorithms corresponding to different file regions are different;

[0096] In one alternative implementation, S2 includes:

[0097] S21. Select a homomorphic encryption algorithm: Choose a suitable homomorphic encryption algorithm based on your needs. For example, if only addition is required, a partially homomorphic encryption algorithm, such as the Paillier algorithm, can be selected. If both addition and multiplication are required, a fully homomorphic encryption algorithm, such as the Lattice-based algorithm, can be selected.

[0098] S22. Key Generation: Generate a public and private key pair using the selected homomorphic encryption algorithm. The public key is used to encrypt data, and the private key is used to decrypt data.

[0099] S23. Preprocessing Data: Before encryption, file regions are preprocessed to ensure they conform to the requirements of homomorphic encryption algorithms. This may include, for example, formatting data, encoding, or other necessary transformations.

[0100] S24. Encrypt each file region separately. Use the generated public key to encrypt the data in each file region to obtain encrypted region data and store it for subsequent calculations and access;

[0101] S25. Upload the encrypted area data to a blockchain network. This network may be a private blockchain specifically set up for this purpose; the metadata of each file area is recorded on the blockchain, while the actual encrypted data can be stored in a secure off-chain storage system; for example, a unique hash value is generated for each encrypted area data as a digital fingerprint of the encrypted area data, which facilitates subsequent data integrity verification;

[0102] The process of recording data on the blockchain includes: recording the metadata (including hash value, storage location, timestamp, etc.) of each encrypted area data on the blockchain. This information is encapsulated into a new block and added to the blockchain through a consensus mechanism, thus permanently recording it on the blockchain.

[0103] S26. To improve data availability and redundancy, encrypted data can be backed up and stored on different nodes of the blockchain network. These nodes may be located in different geographical locations and maintained by different network participants; specifically, appropriate nodes are selected for data storage based on specific criteria (such as geographical location, storage space, and network bandwidth), and the reliability and fault tolerance of the data are enhanced by backing up and storing encrypted data blocks on multiple nodes.

[0104] Homomorphic encryption is a technique that allows computation to be performed directly on ciphertext to obtain an encrypted result, which, when decrypted, is identical to the result of performing the same computation on the plaintext. This means that data can be processed while remaining encrypted, thus protecting user privacy without exposing the original data.

[0105] S3. Accept the access request, which includes an identity identifier and target data;

[0106] S4. Obtain the target file region corresponding to the target data;

[0107] Please refer to Figure 3 S5. Determine whether the identity identifier is in the authorization list corresponding to the target file area. If so, execute S6.

[0108] S6. Obtain the key and tool corresponding to the homomorphic encryption algorithm; after accessing the encrypted region data corresponding to the target file region according to the key and tool, perform calculations based on the target data and return the calculation results, including:

[0109] After accessing the encrypted region data corresponding to the target file region according to the key and tool, the target file region is marked as locked.

[0110] After performing calculations based on the target data and returning the calculation results, the locking state is released; or after the time for accessing the encrypted area data reaches a preset time, the locking state is released.

[0111] When an authorized user requests access to a data area, the authorization management system provides the necessary keys and tools to allow the user to perform permitted homomorphic operations on the encrypted data. The authorized user then uses homomorphic encryption tools to perform computations on the encrypted data. These computations are performed in the encrypted state of the data, without needing to decrypt the data into plaintext. After the computation is complete, the encrypted result is returned to the user or stored. These results remain encrypted and can be decrypted when needed to obtain the actual result. When the plaintext of the computation result is required, the encrypted result is decrypted using the private key.

[0112] Please refer to Figure 4 Embodiment two of the present invention is: a file authorization method, which differs from Embodiment one in that: before determining whether the identity identifier is in the authorization list corresponding to the target file area, it includes establishing an authorization list:

[0113] S01. Analyze and identify data sensitivity: Review the content of each file area to determine the sensitivity and confidentiality level of the data; identify which file areas contain sensitive information that requires special access control;

[0114] S02. Determine the access permission level for each file area. Access permission levels include read-only, read-write, and management. Management has the highest permission. File areas with the highest permission can also perform low-permission operations. And associate specific operations with permission levels.

[0115] The operations include read, write, and management operations; management operations may include adding or deleting users, user group access, access to certain applications, and modifying access permissions.

[0116] S03. Obtain the visitor list, and associate the file region and access permission level corresponding to each visitor identifier in the visitor list to obtain the authorization list, including:

[0117] S031. List the users, user groups, or applications that may need to access each file area;

[0118] S032. Determine the visitor's role and responsibilities, and the business rationale for needing to access specific data areas;

[0119] S033. Based on the sensitivity of each file area and the needs of potential users, formulate detailed authorization rules for each file area; the authorization rules include which users can access the file area and the specific permission levels they are authorized to.

[0120] S034. Configure Access Control Lists (ACLs) in the data management system to encode access permissions according to the established authorization rules; ensure that the ACLs can accurately enforce the authorization rules and can be easily updated and managed; the specific method for implementing ACLs is as follows:

[0121] 1) ACL Definition and Structure Design: First, the structure of the ACL needs to be defined, which typically includes visitor identifiers (such as user ID, group ID, or application ID), file region identifiers, and permission levels (such as read-only, read-write, and administrative). The ACL structure design needs to support fast querying and modification.

[0122] 2) Access Control Encoding: Access permission levels are encoded, either numerically or as string identifiers, for ease of storage and parsing. For example, read-only permission can be encoded as 1, read-write permission as 2, and administrative permission as 3.

[0123] 3) Data Management System Integration: Integrate ACLs into the data management system to store and manage ACL information within the system.

[0124] S035. Associate each visitor's identity with the corresponding permission level; ensure that only verified and authorized entities can access the corresponding file areas;

[0125] Specifically, the visitor list includes users or applications. In addition to setting access permission levels, access durations can also be set, allowing for either temporary or long-term access permissions. Through this detailed process, organizations can ensure that access to each data area is strictly controlled and monitored, thereby protecting sensitive data from unauthorized access by users or applications.

[0126] Please refer to Figure 5 Embodiment three of the present invention is: applying the above-mentioned file authorization method to a real-world scenario:

[0127] Suppose you have an unstructured text file containing multiple sections, each with different sensitive information. The file owner wants different users or applications to be able to access specific sections of the file, while keeping the rest of the file encrypted to ensure that sensitive information is not leaked even during data analysis.

[0128] 1. File Areas: The file owner uses text analysis tools to divide the text file into chapters. For example, the file may be divided into three areas: Chapter 1 (File Area A), Chapter 2 (File Area B), and Chapter 3 (File Area C).

[0129] 2. File Region Authorization Rules: The file owner sets authorization rules for each file region. For example:

[0130] File area A: Accessible only to users in the finance department.

[0131] File area B: Accessible only to users in the marketing department.

[0132] File area C: Accessible only to users in the R&D department.

[0133] 3. Homomorphic Encryption of File Regions: The file owner encrypts each region of the file using a homomorphic encryption algorithm. For example, using an RSA-based homomorphic encryption algorithm allows certain types of computations, such as search and sorting operations, to be performed on the data in its encrypted state.

[0134] 4. Mutually Exclusive Authorization: The file owner implements a mutually exclusive authorization mechanism through the authorization management system. For example, when a user from the finance department requests access to file area A, the system checks the authorization rules and provides a temporary decryption key. During this user's access, users from other departments cannot access file area A.

[0135] The mutual exclusion authorization mechanism works by ensuring that at any given time, only one specific user or application can access and manipulate a specific portion of a data resource. This mechanism is commonly used to improve data security and prevent unauthorized data access and potential data conflicts. Assume a text file is divided into three file regions A, B, and C, each with specific access authorization rules. The mutual exclusion authorization mechanism presented in this specification is as follows: Figure 5 As shown, the specific process is as follows:

[0136] Authorization Request: When a user or application requests access to a file area, it sends a request to the authorization management system containing its identity information and the identifier of the file area to be accessed.

[0137] Authentication: After receiving a request, the authorization management system first performs authentication to confirm whether the requester has the corresponding permissions.

[0138] Authorization check: After successful verification, the system checks the current access status of the file area. If the file area is already occupied by another user or application, the system will deny new access requests until the current access session ends.

[0139] Authorization Lock: If a file area is not currently accessed, the authorization management system will grant the requester access and apply a "lock" status to the file area to prevent other users or applications from accessing it during this period.

[0140] Access and Operation: Authorized users or applications can perform computations on data in an encrypted state, as permitted by homomorphic encryption algorithms.

[0141] Session End: Once the access session ends or the predetermined time limit is reached, the user or application must release access to the file area. The authorization management system will unlock the file area, making it available again for other users or applications to request access.

[0142] The aforementioned mutual exclusion authorization mechanism ensures the security and consistency of file areas, prevents unauthorized concurrent access, and provides an effective data access control method. This mechanism is particularly suitable for environments requiring high security and strict access control, such as financial services, medical record management, and sensitive information processing.

[0143] Please refer to Figure 6 Embodiment four of the present invention is as follows:

[0144] A file authorization terminal 1 includes a processor 2, a memory 3, and a computer program stored on the memory 3 and executable on the processor 2. When the processor 2 executes the computer program, it implements the steps in Embodiment 1.

[0145] In summary, this invention provides a file authorization method and terminal, offering a data access method based on file partitioning authorization. This method allows for fine-grained access control over different parts of unstructured data files while simultaneously enabling computational processing of encrypted data, thereby improving data security and availability. Specifically, this method can be combined with blockchain technology to partition files and use homomorphic encryption, then deploy them on the blockchain, providing enhanced data security and privacy protection. When data processing or analysis is required, it can be performed directly on the encrypted file area. Due to the use of homomorphic encryption, the computation result remains encrypted and can be securely returned to financial institutions, which then decrypt it to obtain the actual result. By partitioning files and implementing fine-grained authorization rules, computational processing of encrypted data can be achieved without disclosing file content, improving data security and availability. Furthermore, by putting file areas on the blockchain, the immutability of the blockchain ensures that once the metadata of a file area is recorded, it cannot be changed or deleted. Any attempt to modify the record will be detected by the network, leaving traceable evidence.

[0146] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A file authorization method, characterized in that, Including the following steps: Mark the file region in the target file; Each of the aforementioned file regions is encrypted using a homomorphic encryption algorithm to obtain encrypted region data, which is then stored. Accept the access request, which includes an identity identifier and target data; Obtain the target file region corresponding to the target data; Determine whether the identity identifier is in the authorization list corresponding to the target file area; if so, obtain the key and tool corresponding to the homomorphic encryption algorithm. After accessing the encrypted region data corresponding to the target file region according to the key and tool, performing calculations based on the target data and returning the calculation results; Before determining whether the identity identifier is in the authorization list corresponding to the target file area, the process includes establishing the authorization list. The file regions in the marked target file include: Obtain preset partitioning rules, and divide the target file into regions according to the partitioning rules to obtain file regions; Record the start and end positions of each of the aforementioned file regions; or The target file is split into file blocks according to the start and end positions of each file region; Associate a first identifier and metadata with each of the aforementioned file regions; After accessing the encrypted region data corresponding to the target file region according to the key and tool, performing calculations based on the target data and returning the calculation results also includes: After accessing the encrypted region data corresponding to the target file region according to the key and tool, the target file region is marked as locked. After performing calculations based on the target data and returning the calculation results, the locked state is released; or After a preset time has elapsed since the access to the encrypted area data was completed, the locking state is released. When an authorized user requests access to the encrypted area data, the authorization management system will provide the necessary keys and tools so that the authorized user can perform permitted homomorphic operations on the encrypted area data. The authorized user uses a homomorphic encryption tool to perform calculations on the encrypted area data, and the calculations are performed in the encrypted state of the encrypted area data. After the calculation is completed, the encrypted calculation result is returned to the authorized user or stored.

2. The file authorization method according to claim 1, characterized in that, The step of determining whether the identity identifier appears before the authorization list corresponding to the target file area includes: Determine the access permission level for each of the file regions; Obtain the visitor list, and associate the file area and access permission level corresponding to each visitor identifier in the visitor list to obtain the authorization list.

3. A file authorization method according to any one of claims 1-2, characterized in that, The homomorphic encryption algorithms corresponding to different file regions are different.

4. A file authorization terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it performs the following steps: Mark the file region in the target file; Each of the aforementioned file regions is encrypted using a homomorphic encryption algorithm to obtain encrypted region data, which is then stored. Accept the access request, which includes an identity identifier and target data; Obtain the target file region corresponding to the target data; Determine whether the identity identifier is in the authorization list corresponding to the target file area; if so, obtain the key and tool corresponding to the homomorphic encryption algorithm. After accessing the target file region using the key and tools, the system performs calculations based on the target data and returns the calculation results. Before determining whether the identity identifier is in the authorization list corresponding to the target file area, the process includes establishing the authorization list. The file regions in the marked target file include: Obtain preset partitioning rules, and divide the target file into regions according to the partitioning rules to obtain file regions; Record the start and end positions of each of the aforementioned file regions; or The target file is split into file blocks according to the start and end positions of each file region; Associate a first identifier and metadata with each of the aforementioned file regions; After accessing the encrypted region data corresponding to the target file region according to the key and tool, performing calculations based on the target data and returning the calculation results also includes: After accessing the encrypted region data corresponding to the target file region according to the key and tool, the target file region is marked as locked. After performing calculations based on the target data and returning the calculation results, the locked state is released; or After a preset time has elapsed since the access to the encrypted area data was completed, the locking state is released. When an authorized user requests access to the encrypted area data, the authorization management system will provide the necessary keys and tools so that the authorized user can perform permitted homomorphic operations on the encrypted area data. The authorized user uses a homomorphic encryption tool to perform calculations on the encrypted area data, and the calculations are performed in the encrypted state of the encrypted area data. After the calculation is completed, the encrypted calculation result is returned to the authorized user or stored.

5. A file authorization terminal according to claim 4, characterized in that, The step of determining whether the identity identifier appears before the authorization list corresponding to the target file area includes: Determine the access permission level for each of the file regions; Obtain the visitor list, and associate the file area and access permission level corresponding to each visitor identifier in the visitor list to obtain the authorization list.

6. A file authorization terminal according to any one of claims 4-5, characterized in that, The homomorphic encryption algorithms corresponding to different file regions are different.

Images