Compression-based encryption method and device, decryption method and device and storage medium

Abstract

The invention relates to an encryption method and device based on compression, a decryption method and device and a storage medium, and belongs to the technical field of computers.The encryption method comprises the steps that initial preset bytes of an unencrypted file are compressed, and compressed bytes are obtained; the difference between the initial preset byte and the compression byte is greater than the preset byte; the unencrypted file comprises an initial preset byte and residual bytes; encrypting the compressed bytes to obtain a first encrypted segment; performing segmented encryption on the remaining bytes based on the number of the encryption segments to obtain second encryption segments; the number of the encryption segments is determined based on the remaining bytes; and determining the encrypted file based on the first encryption segment, the second encryption segment and the mark head. According to the compression-based encryption method provided by the invention, the encryption process time of big data can be shortened and the big data processing efficiency can be improved by adopting a compression space and segmented encryption mode.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an encryption method, a decryption method, a device and a storage medium based on compression. Background Art

[0002] Computer security involves a wide range of content and scope, including permission security, physical security, network security, host security, application security, data security, etc. In most cases, the most valuable thing in a computer system is various data. The confidentiality of data is crucial, from personal privacy to the fate of an enterprise, it is closely related to the security of the data content. Today, the main data storage methods are divided into file storage and database storage (from a purely technical point of view, databases are also files). Then data security is actually the safe processing of files on the computer. File security protection methods include hiding technology, permission technology, encryption technology, etc. Among them, hiding technology relies on the function of the operating system to hide files, and permission technology relies on the user classification of the operating system to lock files, so that ordinary users do not know, cannot find or cannot open specific files, thereby realizing the protection of file content. However, these are all based on the function of the operating system. The file itself is in plain text on the storage medium, which is easy to crack or bypass the system to access the content of the file. The use of encryption technology for security protection of important files is becoming more and more important.

[0003] File encryption uses cryptography technology to convert file contents according to a certain algorithm to hide the real content and prevent it from being illegally obtained, thus achieving security. Even if an illegal person can completely obtain the encrypted file, the file will still remain in ciphertext. The illegal person may even know the encryption algorithm used by the file. As long as there is no key, the encrypted content can remain safe.

[0004] In actual applications, file encryption is not just about converting the file content. In order to facilitate the legal use and management of encrypted files, some custom information tags are often added to the files during the encryption process. Tags are used to save and identify information such as file encryption properties, key conditions, encryption algorithms, etc. If the data is to be used normally after encryption, these tag information is indispensable. Where and how the tags are added is generally determined by the application environment of the data. Currently, the mainstream application methods of encrypted data are "decrypted use" and "transparent use".

[0005] Decrypted use means that the owner encrypts and transmits the data, and the user decrypts and applies the data after receiving it. This scenario is simple and the application process is single. Usually, only the efficiency of the encryption and decryption process needs to be considered. Generally, the mark is directly added to the end of the file and agreed upon.

[0006] Transparent use is a file transparent encryption technology that came into being to meet the needs of file confidentiality. It is mainly used in electronic file data security management. The so-called transparent encryption refers to the encryption or decryption of files during use. It is automatic and does not require user intervention. The user is actually unaware. When the user opens the file, the encrypted file is automatically decrypted. When the file is edited and saved, the file is automatically encrypted. All files generated during the operation of confidential processes (including but not limited to temporary files, transition files, random files, exported files, etc.) are automatically encrypted. In this way, no matter the file is saved or converted to a format (including unknown formats), it will be strictly encrypted and protected. Even using file recovery tools, the plaintext content of the encrypted document cannot be obtained. The file is always ciphertext on the disk. Once it leaves the use environment, the encrypted file cannot be opened or is opened as garbled characters, thereby protecting the file content.

[0007] In transparent usage scenarios, the application scenarios of encrypted data are complex and have certain unknowns. Data needs to be decrypted and encrypted in real time in multiple devices, multiple systems, and multiple software. And the files on the disk always remain encrypted during this process. In order to ensure the security and controllability of data content in complex environments, the encrypted tag information is generally placed in the header of the data file.

[0008] The encrypted tag information requires a certain amount of storage space. Adding it to the file header requires moving the original data content backward. This process is equivalent to moving the entire data content backward and extending the length of the tag header. Figure 1 As shown, Figure 1 The schematic diagram of the encryption method provided by the prior art. The encryption process is divided into six steps: 1. Check the disk space; 2. Create a new file; 3. Write a tag header into the new file; 4. Read the text from the original file; 5. Convert the text into ciphertext; 6. Write the ciphertext into the new file.

[0009] In actual operation, the encryption work of converting plaintext content into ciphertext is processed in memory, which is generally very efficient. However, steps 4 and 6 are processed on the physical disk, which accounts for more than 90% of the entire encryption time and is affected by the disk performance. The larger the file to be processed, the longer the disk read and write time of steps 4 and 6. Summary of the invention

[0010] In view of this, it is necessary to provide a compression-based encryption method, decryption method, device and storage medium to solve the problem that the existing encryption method takes a long time.

[0011] In order to solve the above problems, the present invention provides a compression-based encryption method, comprising: The initial preset byte of the unencrypted file is compressed to obtain a compressed byte; the difference between the initial preset byte and the compressed byte is greater than the preset byte; the unencrypted file includes the initial preset byte and the remaining bytes; Encrypting the compressed bytes to obtain a first encrypted segment; Encrypting the remaining bytes in segments based on the number of encryption segments to obtain a second encryption segment; the number of encryption segments is determined based on the remaining bytes; An encrypted file is determined based on the first encrypted segment, the second encrypted segment, and a tag header.

[0012] In a possible implementation, encrypting the remaining bytes in segments based on the number of encryption segments to obtain the second encryption segment includes: Dividing the remaining bytes equally based on the number of the encryption segments, and determining the position of the encryption segments in the remaining bytes; Based on the position of the encrypted segment in the remaining bytes, the byte contents corresponding to the encrypted segment are encrypted in sequence to obtain a second encrypted segment.

[0013] In a possible implementation, before encrypting the remaining bytes in segments based on the number of encryption segments to obtain the second encryption segment, the method further includes: Determining bytes to be encrypted based on the remaining bytes and a preset ratio; Based on the bytes to be encrypted, the number of the encryption segments is determined.

[0014] In a possible implementation manner, after determining the bytes to be encrypted based on the remaining bytes and the preset ratio, the method further includes: Create temporary files for disaster recovery; The temporary disaster recovery file is used to back up the bytes to be encrypted.

[0015] In a possible implementation manner, after determining the encrypted file based on the first encryption segment, the second encryption segment and the tag header, the method further includes: The encrypted file is verified based on the mark header, and when it is determined that the length of the encrypted file is consistent with the length of the unencrypted file, the disaster recovery temporary file is deleted.

[0016] The present invention also provides a decryption method, comprising: Read the tag header of the encrypted file to obtain the first encrypted segment and the second encrypted segment; Decrypting and decompressing the first encrypted segment to obtain a first decrypted file; Decrypting the second encrypted segments in sequence to obtain a second decrypted file; A decrypted file is determined based on the first decrypted file and the second decrypted file.

[0017] The present invention also provides a compression-based encryption device, comprising: A compression module, used for compressing the initial preset bytes of the unencrypted file to obtain compressed bytes; the difference between the initial preset bytes and the compressed bytes is greater than the preset bytes; the unencrypted file includes the initial preset bytes and the remaining bytes; A first encryption module, used for encrypting the compressed bytes to obtain a first encrypted segment; A second encryption module, configured to perform segmented encryption on the remaining bytes based on the number of encryption segments to obtain second encryption segments; the number of encryption segments is determined based on the remaining bytes; The first determination module is used to determine the encrypted file based on the first encryption segment, the second encryption segment and the tag header.

[0018] The present invention also provides a decryption device, comprising: An acquisition module is used to read the tag header of the encrypted file and acquire the first encrypted segment and the second encrypted segment; A first decryption module, used to decrypt and decompress the first encrypted segment to obtain a first decrypted file; A second decryption module, used to decrypt the second encrypted segments in sequence to obtain a second decrypted file; The second determining module is used to determine a decrypted file based on the first decrypted file and the second decrypted file.

[0019] On the other hand, the present invention also provides an electronic device, including a memory and a processor, wherein: The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the compression-based encryption method or decryption method described in any of the above implementations.

[0020] On the other hand, the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the compression-based encryption method or decryption method described in any of the above implementations is implemented.

[0021] The beneficial effects of the present invention are as follows: the compression-based encryption method, decryption method, device and storage medium provided by the present invention obtain compressed bytes by compressing the starting preset bytes of an unencrypted file, ensuring that the difference between the starting preset bytes and the compressed bytes is greater than the preset bytes, and reserving space to store a tag header, encrypting the compressed bytes to obtain a first encryption segment, and encrypting the remaining bytes in segments according to the number of encryption segments to obtain a second encryption segment. The segmented encryption can reduce the total amount of reading and writing of the file during encryption, thereby determining the encrypted file based on the first encryption segment, the second encryption segment and the tag header. The use of compressed space and segmented encryption can shorten the encryption process time of large data and improve the efficiency of large data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 A schematic diagram of an encryption method provided by the prior art; Figure 2 A method flow chart of an embodiment of a compression-based encryption method provided by the present invention; Figure 3 A schematic diagram showing the comparison between before and after encryption provided by the present invention; Figure 4 A schematic diagram of a compression section and a marking head provided by the present invention; Figure 5 A schematic diagram of the dynamic segmented encryption process provided by the present invention; Figure 6 A method flow chart of an embodiment of the decryption method provided by the present invention; Figure 7 A schematic diagram of the structure of an embodiment of a compression-based encryption device provided by the present invention; Figure 8 A schematic diagram of the structure of an embodiment of a decryption device provided by the present invention; Fig. 9 A schematic structural diagram of an embodiment of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0024] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0025] In the description of the embodiments of the present invention, unless otherwise specified, "multiple" means two or more than two. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" may mean: A exists alone, A and B exist at the same time, and B exists alone.

[0026] The descriptions of "first", "second", etc. involved in the embodiments of the present invention are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the technical features defined as "first" or "second" may explicitly or implicitly include at least one of the features.

[0027] Before presenting the embodiments, the following terms are explained.

[0028] Tag header: also called file header, is a fixed-length string that records attribute information related to data encryption. And the key attribute content is also ciphertext. The header includes information such as encryption flag, encryption version, key status, encryption rules, compression level, compression length, encryption unit, etc. The length of the tag header can be fixed according to actual needs. The length of the proposed length of the present invention is 512 bytes.

[0029] Encryption unit: It is the minimum length when encrypting the file content. Arrange the data in space according to certain rules, which is called alignment. This alignment must ensure byte alignment. Generally, it is a multiple of 4. The present invention intends to adopt 16-byte alignment encryption for processing. Arrange and extract the file content in binary mode, and encrypt it in groups of 16 bytes.

[0030] Encryption segment: a ciphertext segment of a certain length consisting of a number of encryption units. The length can be determined according to the actual situation. The present invention intends to take 8 encryption units as a segment, that is, 128 bytes as an encryption segment.

[0031] Compression: It is to sort and re-record the repeated and redundant information in the data by a special encoding method without affecting the use of the file, so as to achieve the purpose of reducing space occupation. The present invention proposes that the minimum compression length is 4096 bytes. Compression algorithms include but are not limited to ZIP, LZMA, Brotli, RAR, etc. The present invention intends to use the zlib open source library to illustrate.

[0032] Figure 2 A method flow chart of an embodiment of the compression-based encryption method provided by the present invention is as follows: Figure 2 As shown, compression-based encryption methods include: S201, compressing the initial preset bytes of the unencrypted file to obtain compressed bytes; the difference between the initial preset bytes and the compressed bytes is greater than the preset bytes; the unencrypted file includes the initial preset bytes and the remaining bytes; S202, encrypting the compressed bytes to obtain a first encrypted segment; S203, encrypting the remaining bytes in segments based on the number of encryption segments to obtain a second encryption segment; the number of the encryption segments is determined based on the remaining bytes; S204: Determine an encrypted file based on the first encryption segment, the second encryption segment and the tag header.

[0033] It should be noted that: before encrypting the file, the 512-byte content of the file can be read, and the file is judged to be unencrypted according to the content, and encryption is determined to be required. In the embodiment of the present invention, the file needs to be compressed, and only files that are large enough can be compressed, so the length of the unencrypted file needs to be greater than the preset length, for example, greater than 4096 bytes.

[0034] The types of unencrypted files may include text files, compound files, database files, image files, media files, etc. If it is a text file, the number and length of encrypted segments will be appropriately increased to ensure that more content is encrypted.

[0035] In S201, compression is performed on the initial preset bytes of the unencrypted file to obtain compressed bytes.

[0036] The content of the initial preset bytes of the unencrypted file is read, where the initial preset bytes may be 4096 bytes, and a compression algorithm is used to perform compression processing to obtain compressed bytes.

[0037] Determine whether the difference between the starting preset byte and the compressed byte is greater than the preset byte, which may be 512 bytes. If the difference is greater than 512 bytes, compression is completed. If the difference is less than or equal to 512 bytes, increase the compression level and compress again until the difference is greater than 512 bytes, and compression is completed.

[0038] By compressing the beginning of the file, enough space can be reserved so that encryption-related information can be written into the space in the form of a marker header.

[0039] In S202, the compressed bytes are encrypted to obtain a first encrypted segment.

[0040] The compressed bytes are encrypted, that is, the compressed content is encrypted and converted into ciphertext through an encryption algorithm to obtain a first encrypted segment.

[0041] In S203, the remaining bytes are encrypted in segments based on the number of encryption segments to obtain second encryption segments.

[0042] The unencrypted file includes a starting preset byte and remaining bytes. The number of encryption segments can be determined by the remaining bytes. The remaining bytes are segmented according to the number of encryption segments and encrypted in sequence to obtain a second encryption segment.

[0043] In S204, an encrypted file is determined based on the first encrypted segment, the second encrypted segment and the tag header.

[0044] The tag header records information such as the encrypted content length, encryption algorithm, encryption level, and encryption segment location.

[0045] Write the tag header and the first encrypted segment at the beginning of the original file. Since the length of the compressed segment after compression is uncontrollable, there will generally be extra space, which is padded with 0 to generate a padded segment. The final guarantee is: tag header length + compressed segment length + padded segment length = 4096 bytes. Then write the second encrypted segment in sequence to obtain the encrypted file.

[0046] Figure 3 A schematic diagram showing the comparison between before and after encryption provided by the present invention, such as Figure 3 As shown, data compression encryption is used to complete the data encryption process, and the length of the encrypted data remains unchanged.

[0047] Compared with the prior art, the compression-based encryption method provided by the embodiment of the present invention obtains compressed bytes by compressing the starting preset bytes of an unencrypted file, ensuring that the difference between the starting preset bytes and the compressed bytes is greater than the preset bytes, and reserving space to store a tag header. The compressed bytes are encrypted to obtain a first encryption segment, and the remaining bytes are encrypted in segments according to the number of encryption segments to obtain a second encryption segment. The segmented encryption can reduce the total amount of reading and writing of the file during encryption, thereby determining the encrypted file based on the first encryption segment, the second encryption segment and the tag header. The use of compressed space and segmented encryption can shorten the encryption process time of big data and improve the efficiency of big data processing.

[0048] In some embodiments of the present invention, before encrypting the remaining bytes in segments based on the number of encryption segments to obtain the second encryption segment, the method further includes: Determining bytes to be encrypted based on the remaining bytes and a preset ratio; Based on the bytes to be encrypted, the number of the encryption segments is determined.

[0049] In some embodiments of the present invention, encrypting the remaining bytes in segments based on the number of encryption segments to obtain the second encryption segment includes: Dividing the remaining bytes equally based on the number of the encryption segments, and determining the position of the encryption segments in the remaining bytes; Based on the position of the encrypted segment in the remaining bytes, the byte contents corresponding to the encrypted segment are encrypted in sequence to obtain a second encrypted segment.

[0050] You can get the original file length. If the length is greater than 4G, it will be calculated as 4G at most. Subtract 4096 bytes of the compressed segment from the original file length to get the remaining byte length, and then divide this length into equal parts according to a certain ratio.

[0051] In actual data applications, for non-text document data, most of the time, only 20%~30% of the file content needs to be encrypted, and for text document data, only 50%~60% of the file content needs to be encrypted, so that the file cannot be recognized by its corresponding program, thereby achieving the purpose of data content security protection.

[0052] In the embodiment of the present invention, the preset ratio is set to 20%. If the type of the unencrypted file is a text file, the preset ratio must be higher than 50%. The positions of the equally divided files are recorded.

[0053] That is, the remaining bytes are multiplied by a preset ratio to obtain the bytes to be encrypted, and the number of encryption segments can be determined based on the bytes to be encrypted.

[0054] For example, the length of the original file is 100M, which is converted into 1,048,57600 bytes, of which 20% is 20,971,520 bytes, i.e., the bytes to be encrypted, i.e., 20,971,520 bytes of content need to be encrypted. Based on 128 bytes per segment, 163,840 encryption segments are required.

[0055] The remaining bytes are equally divided according to the number of encryption segments, the corresponding position of each encryption segment in the remaining bytes is obtained, and these positions are recorded. Thus, the byte contents corresponding to the encryption segments can be encrypted in sequence according to the positions of the encryption segments in the remaining bytes to obtain the second encryption segment.

[0056] The compression-based encryption method provided by the embodiment of the present invention can reduce the total amount of file reading and writing during encryption and decryption by dynamically encrypting the file content in segments, while ensuring that the encrypted data cannot be recognized and used by the corresponding program. The segment size can be dynamically adjusted according to the characteristics of the data file content.

[0057] In some embodiments of the present invention, after determining the bytes to be encrypted based on the remaining bytes and the preset ratio, the method further includes: Create temporary files for disaster recovery; The temporary disaster recovery file is used to back up the bytes to be encrypted.

[0058] After the bytes to be encrypted are determined, a temporary disaster recovery file can be created to back up the bytes to be encrypted in the original file.

[0059] If any abnormality occurs in the subsequent process, this file can be restored to prevent damage.

[0060] The compression-based encryption method provided by the embodiment of the present invention backs up the bytes to be encrypted through the temporary disaster recovery file, and can restore the bytes to be encrypted through the temporary disaster recovery file when an abnormal situation occurs, thereby improving the security of encryption.

[0061] In some embodiments of the present invention, after determining the encrypted file based on the first encryption segment, the second encryption segment and the tag header, the method further includes: The encrypted file is verified based on the mark header, and when it is determined that the length of the encrypted file is consistent with the length of the unencrypted file, the disaster recovery temporary file is deleted.

[0062] After encryption is completed, the encrypted file can be verified according to the tag header to check whether the length of the encrypted file is consistent with the length of the unencrypted file. If the length of the encrypted file is the same as the length of the unencrypted file, the encrypted file is judged to be correct and the disaster recovery temporary file is deleted.

[0063] The compression-based encryption method provided by the embodiment of the present invention verifies the encrypted file through the tag header. When it is determined that the length of the encrypted file is the same as the length of the unencrypted file, the encrypted file is determined to be correct, thereby improving the accuracy of encryption.

[0064] Optionally, Figure 4 The schematic diagram of the compression section and the marking head provided by the present invention is shown in FIG. Figure 4 , the compression method provided by the present invention comprises: S401: compress the initial part of the original data.

[0065] S402: Obtain the compressed plaintext segment.

[0066] S403: Encrypt the compressed segment to obtain a ciphertext compressed segment.

[0067] S404. Write the compressed segment into the original file after the length of the offset marker segment.

[0068] S405: Generate a marker segment, in which encryption-related attribute information is recorded.

[0069] S406: Write a marker segment at the beginning of the file.

[0070] S407: Calculate the length of the space to be padded and generate a padded segment.

[0071] S408. Write a padding segment after the compression segment.

[0072] The present invention proposes a method of using data compression to perform binary compression on part of the file content to free up space for storing a tag header, which can maintain the total file size, avoid reading and writing when copying the file, and improve the encryption and decryption efficiency of large data.

[0073] Figure 5 The schematic diagram of the dynamic segment encryption process provided by the present invention is as follows: Figure 5 As shown, the present invention provides, including: S501. Calculate the position that needs to be encrypted based on the file type and length, and record it in the tag header.

[0074] S502: Read the content stream from the original file and perform encryption processing.

[0075] S503: Write the encrypted ciphertext segment back to the original offset position of the data.

[0076] S504: Continue reading subsequent content to be encrypted to complete encryption.

[0077] S505. Continue writing the encrypted segment.

[0078] S506, read out the remaining encrypted positions in sequence, encrypt them, and then write them back.

[0079] S507: Finally, the encryption process of all content segments is completed.

[0080] The present invention proposes a dynamic segmented encryption processing method, which further reduces the reading and writing of the disk and improves the encryption and decryption efficiency of large data by performing proportional dynamic segmented encryption processing on the file content.

[0081] The compression-based encryption method provided by the embodiment of the present invention compresses the tag header and then processes the content in segments, and uses data compression to perform binary compression on part of the file content to make room for the tag header. This can keep the total file size unchanged and avoid reading and writing when copying the file. At the same time, the subsequent file content is dynamically encrypted in proportion to further reduce the reading and writing of the disk. Ultimately, the encryption and decryption efficiency of large data is improved. When encrypting, the starting part of the file is first compressed to make enough space, and then the encryption-related information is written into the space in the form of a tag header. The remaining file content is then encrypted in proportion using segmented encryption. The encryption is completed.

[0082] Figure 6 A method flow chart of an embodiment of the decryption method provided by the present invention is as follows: Figure 6 As shown, the decryption method includes: S601, read the tag header of the encrypted file to obtain the first encrypted segment and the second encrypted segment; S602, decrypting and decompressing the first encrypted segment to obtain a first decrypted file; S603, decrypting the second encrypted segments in sequence to obtain a second decrypted file; S604: Determine a decryption file based on the first decryption file and the second decryption file.

[0083] It should be noted that: before decryption, the 512-byte content of the file can be read to determine whether the file is encrypted based on the content. Only encrypted files need to be decrypted. And according to the information in the tag header, the encryption method is obtained to determine whether it is encrypted using the encryption method provided by the present invention. If not, it is decrypted using the ordinary method.

[0084] By reading the encrypted file's tag header, obtaining the first encrypted segment and the second encrypted segment, calculating the length of the file's encrypted segment, and determining whether the disk space is greater than this length plus 4096, if the space is insufficient, prompting the user and terminating the decryption process.

[0085] Optionally, you can create a temporary disaster recovery file to back up the first 4096 bytes of the ciphertext and the subsequent encrypted segment content. Establish a disaster recovery mechanism so that if an abnormality occurs in the subsequent process, the ciphertext can be restored.

[0086] According to the information related to the compressed segment in the tag header, the compressed content, i.e. the first encrypted segment, is read, converted into plain text, and then decompressed and restored to a length of 4096 to obtain the first decrypted file. The ciphertext is written back from the beginning.

[0087] According to the encrypted segment information in the tag header, the encrypted segment contents at the corresponding positions are read in sequence, the plaintext is converted to obtain the second decrypted file, and then written back.

[0088] Until all the encrypted segments are decrypted, a decrypted file is obtained based on the first decrypted file and the second decrypted file.

[0089] Optionally, you can check whether the length of the decrypted file is consistent with the ciphertext. If it is consistent, delete the temporary disaster recovery file and complete the decryption.

[0090] The decryption method provided by the embodiment of the present invention obtains the encrypted file by using compression space and segmented encryption. During decryption, the tag header is first read, and the compression length, compression algorithm, encryption unit, key and other information are obtained from the tag header. The initial part of the content is reversely decompressed and written back, and then the subsequent encrypted segments are converted into plain text to complete the decryption, which can shorten the decryption process time of large data.

[0091] The compression-based encryption and decryption method provided by the present invention is described in detail below in conjunction with specific embodiments. The method includes: a file encryption process and a file decryption process.

[0092] 1. The file encryption process includes the preparation stage, encryption stage and verification stage.

[0093] Preparation stage: Step 1: Read 512 bytes of the file content, and determine whether the file is encrypted based on the content. If it is not encrypted, encrypt it.

[0094] Step 2: Get the file size. Only files that are large enough can be compressed. Determine whether the file length is greater than 4096. If it is less than 4096, it is not applicable to the technology of the present invention. Use ordinary encryption.

[0095] Step 3: Identify the file type and judge it as a text file, compound file, database file, image file, media file, etc. If it is a text file, the number and length of the encryption segments will be appropriately increased to ensure that more content is encrypted.

[0096] Encryption phase: Step 4, read the content of the first 4096 bytes of the file, and try to compress it using a compression algorithm to obtain the compressed content and length, subtract the compressed length from 4096, if it is greater than 512 bytes, the compression is completed, if it is less than 512, try to increase the compression level, and compress again, if the compressed space is still less than 512 bytes, the technology of the present invention is not applicable, and ordinary encryption is used.

[0097] Step 5: Prepare the encrypted segment. First, obtain the length of the original file. If the length is greater than 4G, calculate it as 4G at most. Subtract the length of the compressed segment 4096 from the length of the original file to get the remaining content length. Then divide this length into equal parts according to a certain ratio.

[0098] The ratio proposed by the present invention is 20%, and if it is a text file, the ratio must be higher than 50%. And record the position of the equally divided files.

[0099] For example, the original file is 100M, which is converted to 1,048,57600 bytes, of which 20% is 20,971,520 bytes. That is, 20,971,520 bytes need to be encrypted. Based on 128 bytes per segment, 163,840 encrypted segments are required. Finally, these encrypted segments are equally divided into the original file positions and these positions are recorded.

[0100] Step 6: Prepare the tag header, initialize the tag header in the memory, and record the encrypted content length, encryption algorithm, encryption level, encryption segment location and other information.

[0101] Step 7. Determine the disk space and back up the encrypted content.

[0102] Continuing with the previous 100M file as an example, the content that needs to be encrypted is 4096 plus 20,971,520, a total of 20,975,616 bytes. Check whether the current disk space is greater than 20,975,616 bytes. If not, a prompt will be given and the process will be terminated.

[0103] Step 8. Create a temporary disaster recovery file and back up the 20,975,616 bytes of the original file to be encrypted. If an exception occurs in the subsequent process, you can restore it through this file to prevent damage.

[0104] Step 9: Write a tag header at the beginning of the original file, encrypt the compressed content and convert it into ciphertext before writing it. The length of the compressed segment after compression is uncontrollable, and usually there will be extra space, which is padded with 0 to generate a padded segment. The final guarantee is: tag header length + compressed segment length + padded segment length = 4096 bytes.

[0105] Step 10: Read the encrypted segment contents one by one according to the encrypted segment position, convert them into ciphertext and write them back until all encrypted segments have completed encryption processing.

[0106] Verification phase: Step 11: Verify that the tag header is correct and check whether the file length is consistent with the original file. Delete the temporary disaster recovery file. Complete the encryption.

[0107] 2. The file decryption process includes the preparation stage, decryption stage and verification stage.

[0108] Preparation stage: Step 1: Read the 512-byte content of the file, determine whether the file is encrypted based on the content, and decrypt the encrypted file.

[0109] Step 2: According to the information in the tag header, the encryption method is obtained to determine whether the encryption is performed using the technology of the present invention. If not, the decryption is performed using the common method.

[0110] Decryption phase: Step 3: Calculate the length of the encrypted segment of the file based on the information in the tag header and determine whether the disk space is greater than this length plus 4096. If the space is insufficient, prompt the user and terminate the decryption process.

[0111] Step 4: Create a temporary disaster recovery file and back up the starting 4096 of the ciphertext and the subsequent encrypted segments. Establish a disaster recovery mechanism so that the ciphertext can be restored if an abnormality occurs in the subsequent process.

[0112] Step 5: Read the compressed content according to the compressed segment information in the tag header, convert it into plain text, and then decompress it to restore it to a length of 4096. Write back from the beginning of the ciphertext.

[0113] Step 6: According to the encrypted segment information in the tag header, read the encrypted segment content at the corresponding position in sequence, convert it into plain text, and write it back until all encrypted segments are decrypted.

[0114] Verification phase: Step 7: Check whether the length of the decrypted file is consistent with the ciphertext. Delete the temporary disaster recovery file. Decryption is complete.

[0115] In the field of transparent encryption technology, data encryption and decryption is a frequently occurring operation. From the perspective of computer physics, the encryption and decryption process is the process of reading and writing operations on the disk. If the data is small, it can be compensated by memory mapping technology or disk cache technology to improve efficiency, but large data is a complete test of the disk's performance.

[0116] Under the premise of fixed disk performance, the larger the data being processed, the more times the encryption and decryption process requires reading and writing, and the longer the process takes. Under the premise of fixed data size, reducing disk reading and writing can reduce the process time.

[0117] The most commonly used data encryption method currently is to add an information header during encryption and then encrypt and copy the subsequent file content. This method cannot avoid reading and writing the entire file. The larger the file, the more times it is read and written, and the slower the efficiency.

[0118] The present invention adopts a method of compressing the tag header data to squeeze out space to record the encrypted information tag without changing the total file size, and adopts dynamic segmented encryption for the subsequent content. Through the combination of these two mechanisms, the amount of file reading and writing is greatly reduced during the processing process, thereby improving the encryption and decryption efficiency.

[0119] By compressing the file content, space can be squeezed out to put the encrypted information mark without changing the file size. Compression methods include but are not limited to ZIP, LZMA, Brotli, RAR, etc. The size of the mark header can be agreed upon as needed.

[0120] By dynamically encrypting the file content in segments, the total amount of file reading and writing during encryption and decryption is reduced while ensuring that the encrypted data cannot be recognized and used by the corresponding program. The segment size can be dynamically adjusted according to the characteristics of the data file content.

[0121] Through the above two key technologies, the efficiency of encryption and decryption of large files can be improved.

[0122] In order to better implement the compression-based encryption method in the embodiment of the present invention, on the basis of the compression-based encryption method, the embodiment of the present invention further provides a compression-based encryption device. Figure 7A schematic diagram of the structure of an embodiment of a compression-based encryption device provided by the present invention is shown in FIG. Figure 7 As shown, the compression-based encryption device 700 includes: The compression module 710 is used to compress the initial preset bytes of the unencrypted file to obtain compressed bytes; the difference between the initial preset bytes and the compressed bytes is greater than the preset bytes; the unencrypted file includes the initial preset bytes and the remaining bytes; A first encryption module 720, configured to encrypt the compressed bytes to obtain a first encrypted segment; A second encryption module 730, configured to perform segmented encryption on the remaining bytes based on the number of encryption segments to obtain a second encryption segment; the number of encryption segments is determined based on the remaining bytes; The first determination module 740 is used to determine the encrypted file based on the first encryption segment, the second encryption segment and the tag header.

[0123] The compression-based encryption device 700 provided in the above embodiment can implement the technical solution described in the above compression-based encryption method embodiment. The specific implementation principles of the above modules or units can refer to the corresponding contents in the compression-based encryption method embodiment, which will not be repeated here.

[0124] In order to better implement the decryption method in the embodiment of the present invention, based on the decryption method, the embodiment of the present invention also provides a decryption device. Figure 8 A schematic diagram of the structure of an embodiment of the decryption device provided by the present invention is shown as follows: Figure 8 As shown, the decryption device 800 includes: An acquisition module 810 is used to read the tag header of the encrypted file and acquire the first encrypted segment and the second encrypted segment; A first decryption module 820, configured to decrypt and decompress the first encrypted segment to obtain a first decrypted file; A second decryption module 830, configured to decrypt the second encrypted segments in sequence to obtain a second decrypted file; The second determination module 840 is configured to determine a decrypted file based on the first decrypted file and the second decrypted file.

[0125] The decryption device 800 provided in the above embodiment can implement the technical solution described in the above decryption method embodiment. The specific implementation principles of the above modules or units can refer to the corresponding contents in the decryption method embodiment, which will not be repeated here.

[0126] like Fig. 9 As shown, the present invention also provides an electronic device 900. The electronic device 900 includes a processor 901, a memory 902 and a display 903. Fig. 9Only some components of the electronic device 900 are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0127] In some embodiments, the processor 901 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run program codes stored in the memory 902 or process data, such as the compression-based encryption method or decryption method in the present invention.

[0128] In some embodiments, the processor 901 may be a single server or a server group. The server group may be centralized or distributed. In some embodiments, the processor 901 may be local or remote. In some embodiments, the processor 901 may be implemented in a cloud platform. In some embodiments, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an internal cloud, a multi-cloud, etc., or any combination thereof.

[0129] In some embodiments, the memory 902 may be an internal storage unit of the electronic device 900, such as a hard disk or memory of the electronic device 900. In other embodiments, the memory 902 may also be an external storage device of the electronic device 900, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc., equipped on the electronic device 900.

[0130] Furthermore, the memory 902 may include both an internal storage unit of the electronic device 900 and an external storage device. The memory 902 is used to store application software installed in the electronic device 900 and various data.

[0131] In some embodiments, the display 903 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an organic light-emitting diode (OLED) touch device, etc. The display 903 is used to display information on the electronic device 900 and to display a visual user interface. The components 901-903 of the electronic device 900 communicate with each other via a system bus.

[0132] In one embodiment, when the processor 901 executes the compression-based encryption or decryption program in the memory 902, the following steps may be implemented: The initial preset byte of the unencrypted file is compressed to obtain a compressed byte; the difference between the initial preset byte and the compressed byte is greater than the preset byte; the unencrypted file includes the initial preset byte and the remaining bytes; Encrypting the compressed bytes to obtain a first encrypted segment; Encrypting the remaining bytes in segments based on the number of encryption segments to obtain a second encryption segment; the number of encryption segments is determined based on the remaining bytes; Determine an encrypted file based on the first encrypted segment, the second encrypted segment and the tag header; or, Read the tag header of the encrypted file to obtain the first encrypted segment and the second encrypted segment; Decrypting and decompressing the first encrypted segment to obtain a first decrypted file; Decrypting the second encrypted segments in sequence to obtain a second decrypted file; A decrypted file is determined based on the first decrypted file and the second decrypted file.

[0133] It should be understood that: when the processor 901 executes the compression-based encryption or decryption program in the memory 902, in addition to the above functions, other functions can also be implemented. For details, please refer to the description of the corresponding method embodiment above.

[0134] Furthermore, the embodiment of the present invention does not specifically limit the type of the electronic device 900 mentioned, and the electronic device 900 may be a portable electronic device such as a mobile phone, a tablet computer, a personal digital assistant (PDA), a wearable device, a laptop computer, etc. Exemplary embodiments of portable electronic devices include but are not limited to portable electronic devices equipped with IOS, Android, Microsoft or other operating systems. The above-mentioned portable electronic devices may also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the present invention, the electronic device 900 may not be a portable electronic device, but a desktop computer with a touch-sensitive surface (e.g., a touch panel).

[0135] Correspondingly, an embodiment of the present invention also provides a computer-readable storage medium, which is used to store computer-readable programs or instructions. When the program or instructions are executed by a processor, it can implement the steps or functions in the compression-based encryption method or decryption method provided in the above-mentioned method embodiments.

[0136] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware (such as a processor, a controller, etc.) through a computer program, and the computer program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0137] The compression-based encryption method, decryption method, device and storage medium provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A compression-based encryption method, characterized in that: include: Compressing the initial preset bytes of the unencrypted file to obtain compressed bytes; The difference between the starting preset byte and the compressed byte is greater than the preset byte; the unencrypted file includes the starting preset byte and the remaining bytes; Encrypting the compressed bytes to obtain a first encrypted segment; Encrypting the remaining bytes in segments based on the number of encryption segments to obtain a second encryption segment; the number of encryption segments is determined based on the remaining bytes; An encrypted file is determined based on the first encrypted segment, the second encrypted segment, and a tag header.

2. The compression-based encryption method according to claim 1, characterized in that: The step of encrypting the remaining bytes in segments based on the number of encryption segments to obtain a second encryption segment includes: Dividing the remaining bytes equally based on the number of the encryption segments, and determining the position of the encryption segments in the remaining bytes; Based on the position of the encrypted segment in the remaining bytes, the byte contents corresponding to the encrypted segment are encrypted in sequence to obtain a second encrypted segment.

3. The compression-based encryption method according to claim 1, characterized in that: Before encrypting the remaining bytes in segments based on the number of encryption segments to obtain the second encryption segment, the method further includes: Determining bytes to be encrypted based on the remaining bytes and a preset ratio; Based on the bytes to be encrypted, the number of the encryption segments is determined.

4. The compression-based encryption method according to claim 3, characterized in that: After determining the bytes to be encrypted based on the remaining bytes and the preset ratio, the method further includes: Create temporary files for disaster recovery; The temporary disaster recovery file is used to back up the bytes to be encrypted.

5. The compression-based encryption method according to claim 4, characterized in that: After determining the encrypted file based on the first encryption segment, the second encryption segment and the tag header, the method further includes: The encrypted file is verified based on the mark header, and when it is determined that the length of the encrypted file is consistent with the length of the unencrypted file, the disaster recovery temporary file is deleted.

6. A decryption method, characterized in that: include: Read the tag header of the encrypted file to obtain the first encrypted segment and the second encrypted segment; Decrypting and decompressing the first encrypted segment to obtain a first decrypted file; Decrypting the second encrypted segments in sequence to obtain a second decrypted file; A decrypted file is determined based on the first decrypted file and the second decrypted file.

7. A compression-based encryption device, characterized in that: include: A compression module, used for compressing the initial preset bytes of the unencrypted file to obtain compressed bytes; The difference between the starting preset byte and the compressed byte is greater than the preset byte; the unencrypted file includes the starting preset byte and the remaining bytes; A first encryption module, used for encrypting the compressed bytes to obtain a first encrypted segment; A second encryption module, configured to perform segmented encryption on the remaining bytes based on the number of encryption segments to obtain second encryption segments; the number of encryption segments is determined based on the remaining bytes; The first determination module is used to determine the encrypted file based on the first encryption segment, the second encryption segment and the tag header.

8. A decryption device, characterized in that: include: An acquisition module is used to read the tag header of the encrypted file and acquire the first encrypted segment and the second encrypted segment; A first decryption module, used to decrypt and decompress the first encrypted segment to obtain a first decrypted file; A second decryption module, used to decrypt the second encrypted segments in sequence to obtain a second decrypted file; The second determining module is used to determine a decrypted file based on the first decrypted file and the second decrypted file.

9. An electronic device, characterized in that: comprising a memory and a processor, wherein: The memory is used to store programs; The processor is coupled to the memory and is used to execute the program stored in the memory to implement the compression-based encryption method according to any one of claims 1 to 5 or the decryption method according to claim 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the compression-based encryption method according to any one of claims 1 to 5 or the decryption method according to claim 6 is implemented.

Images