Data encryption method and device, medium, electronic equipment and program product

Abstract

The invention provides a data encryption method and device, a medium, electronic equipment and a program product. The method comprises the steps of obtaining a to-be-encrypted target file; symmetrically encrypting the target file by adopting a first key to obtain an encrypted file body; performing asymmetric encryption on the first secret key according to a first public key to generate a first authorization string; the first public key is a public key of an authorizer; and storing or forwarding the encrypted file body carrying the first authorization string. According to the technical scheme, the target file is encrypted in a symmetric encryption mode, encryption of the target file can be completed through one-time encryption, the encryption efficiency of the target file is improved, then the first key which is subjected to symmetric encryption is encrypted in an asymmetric encryption mode, the safety of the first key is improved, and then the safety of the target file is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, and in particular to a data encryption method, device, medium, electronic device and program product. Background Art

[0002] In order to meet the need for data confidentiality, digital files can be encrypted during the transmission process. For encrypted digital files, only designated authorized persons can decrypt and use them. Currently, there are two main methods for encrypting digital files, one is symmetric encryption and the other is asymmetric encryption.

[0003] For symmetric encryption, the digital file can be encrypted and decrypted with the same key. When the encrypted digital file is sent to the authorized person, the decryption key is also sent to the authorized person. If the authorized person makes the key public, the encrypted digital file will also be public, which reduces security.

[0004] For asymmetric encryption, the authorizer uses the authorized person's public key to encrypt the file, and then the authorized person uses his own private key to decrypt the encrypted file. Although this encryption method is highly secure, the same digital file needs to be asymmetric encrypted multiple times by the authorizer for different authorized persons, and the encryption efficiency is low. In addition, the encrypted files have inconsistent ciphertext content for different users, which is not conducive to the rapid forwarding of digital files, especially in CDN (Content Delivery Network), which is not conducive to the distribution of digital files. Summary of the invention

[0005] In view of this, the present disclosure provides a data encryption method, device, medium, electronic device and program product, which can improve the encryption efficiency and security of digital files.

[0006] According to a first aspect of an embodiment of the present disclosure, a data encryption method is provided, the method comprising: Get the target file to be encrypted; Using a first key to symmetrically encrypt the target file to obtain an encrypted file body; Asymmetrically encrypt the first secret key according to the first public key to generate a first authorization string; the first public key is the public key of the authorizer; The encrypted file body carrying the first authorization string is stored or forwarded.

[0007] In one embodiment, storing or forwarding the encrypted file body carrying the first authorization string includes: Encapsulating the first authorization string and authorization information into an electronic envelope of the encrypted file body, wherein the authorization information is used to determine the authorized person's right to use the target file; Based on the electronic envelope, the first authorization string and the encrypted file body are stored or forwarded.

[0008] In one embodiment, after storing and forwarding the encrypted file body carrying the first authorization string, the method further includes: If an authorization request is received, identity verification is performed on the authorized person in the authorization request; If the identity authentication of the authorized person in the authorization request is passed, a second authorization string exclusive to the authorized person is generated based on the first authorization string.

[0009] In one embodiment, generating a second authorization string exclusive to the authorized person based on the first authorization string includes: Decrypting the first authorization string using a first private key to obtain the first key; the first private key is the private key of the authorizer; The first key is asymmetrically encrypted according to the second public key in the authorization request to obtain a second authorization string; the second public key is the public key of the authorized person.

[0010] In one embodiment, after generating a second authorization string exclusive to the authorized person based on the first authorization string, the method further includes: The second authorization string is sent to the authorized person, so that the authorized person decrypts the second authorization string by using the second private key, obtains the first key, and uses the first key to decrypt the encrypted file body; the second private key is the private key of the authorized person.

[0011] In one embodiment, authenticating the authorized person in the authorization request includes at least one of the following: authenticating the authorized person based on the user name and password provided by the authorized person in the authorization request; authenticating the authorized person based on the verification token of the authorized person in the authorization request; The authorized person is authenticated based on the digital certificate provided by the authorized person in the authorization request.

[0012] According to a second aspect of an embodiment of the present disclosure, there is provided a data encryption device, the device comprising: An acquisition unit, used for acquiring a target file to be encrypted; A first encryption unit, used to symmetrically encrypt the target file using a first key to obtain an encrypted file body; A second encryption unit, configured to asymmetrically encrypt the first secret key according to a first public key to generate a first authorization string; the first public key is a public key of the authorizer; A processing unit is used to store or forward the encrypted file body carrying the first authorization string.

[0013] In one embodiment, the processing unit is specifically configured to: Encapsulating the first authorization string and authorization information into an electronic envelope of the encrypted file body, wherein the authorization information is used to determine the authorized person's right to use the target file; Based on the electronic envelope, the first authorization string and the encrypted file body are stored or forwarded.

[0014] In one embodiment, the apparatus further comprises: A verification unit, configured to, if an authorization request is received, authenticate the identity of the authorized person in the authorization request; A generating unit is configured to generate a second authorization string exclusive to the authorized person based on the first authorization string if the identity authentication of the authorized person in the authorization request is passed.

[0015] In one embodiment, the generating unit is specifically used to: Decrypting the first authorization string using a first private key to obtain the first key; the first private key is the private key of the authorizer; The first key is asymmetrically encrypted according to the second public key in the authorization request to obtain a second authorization string; the second public key is the public key of the authorized person.

[0016] In one embodiment, the apparatus further comprises: The sending unit is used to send the second authorization string to the authorized person, so that the authorized person decrypts the second authorization string through the second private key, obtains the first key, and uses the first key to decrypt the encrypted file body; the second private key is the private key of the authorized person.

[0017] In one embodiment, the verification unit is specifically used to: authenticating the authorized person based on the user name and password provided by the authorized person in the authorization request; authenticating the authorized person based on the verification token of the authorized person in the authorization request; The authorized person is authenticated based on the digital certificate provided by the authorized person in the authorization request.

[0018] According to a third aspect of an embodiment of the present disclosure, there is provided a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps of any method described in the first aspect are implemented.

[0019] According to a fourth aspect of an embodiment of the present disclosure, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any method described in the first aspect are implemented.

[0020] According to a fifth aspect of an embodiment of the present disclosure, a computer program product is provided, which, when executed by a processor, implements the steps of any method described in the first aspect.

[0021] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects: By using symmetric encryption to encrypt the target file, the target file can be encrypted once, thereby improving the encryption efficiency of the target file. Then, the first key of the symmetric encryption is encrypted using asymmetric encryption, thereby improving the security of the first key and further improving the security of the target file. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 is a flow chart of a data encryption method shown in an exemplary embodiment of the present disclosure; Figure 2 is a flow chart showing a method of storing or forwarding an encrypted file body according to an exemplary embodiment of the present disclosure; Figure 3 is a flowchart of processing an authorization request shown in an exemplary embodiment of the present disclosure; Figure 4 is a flow chart of generating a second authorization string shown in an exemplary embodiment of the present disclosure; Figure 5 is a block diagram of a data encryption device shown in an exemplary embodiment of the present disclosure; Figure 6 It is a hardware structure diagram of an electronic device shown in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0024] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. The singular forms of "a", "said" and "the" used in this disclosure and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0025] It should be understood that although the terms first, second, third, etc. may be used in the present disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present disclosure, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0026] Digital files refer to data files stored in digital form. Such files may include but are not limited to various types of data, such as text, images, audio, and video. In some application scenarios, digital files need to be kept confidential to ensure that only specific users can use the data information in the encrypted digital files. When encrypting digital files, symmetric encryption or asymmetric encryption can be used. In symmetric encryption, the same key is used to encrypt and decrypt data. In asymmetric encryption, a pair of keys are used to encrypt and decrypt data, one of which is a public key and the other is a private key.

[0027] After the authorizer encrypts the digital file, the authorized person can obtain the encrypted digital file, and after decrypting the digital file, the data information in the digital file can be obtained.

[0028] For symmetric encryption, the authorized person needs to share the encrypted key with the authorized person. After the authorized person obtains the key and the encrypted digital file, he can forward them to other users so that other users can also obtain the data information in the digital file. In other words, in symmetric encryption, once the key is leaked, the data information in the digital file will also be leaked, resulting in a relatively low security of the digital file.

[0029] In order to improve the security of digital files, asymmetric encryption can be used to encrypt digital files. However, because asymmetric encryption requires the use of the authorized person's public key to encrypt digital files, different public keys of different authorized persons will result in different encrypted digital files. In other words, for asymmetric encryption, the authorizer needs to encrypt the digital file multiple times according to different authorized persons, which has low encryption efficiency and is not conducive to the dissemination of digital files.

[0030] Based on this, the present disclosure provides a data encryption method, which is applied to the electronic device corresponding to the authorizer. Figure 1 , Figure 1 This is a flow chart of a data encryption method provided by an exemplary embodiment of the present disclosure, and the flow chart includes the following steps: S101, obtaining a target file to be encrypted.

[0031] The authorizer obtains the target file to be encrypted, where the data in the target file includes but is not limited to text, images, audio, video, etc.

[0032] S102: Use a first key to symmetrically encrypt the target file to obtain an encrypted file body.

[0033] After obtaining the target file, a random key string is used as the first key, and the length and strength of the first key depend on the symmetric encryption algorithm used. For example, the AES (Advanced Encryption Standard) algorithm may use an encryption key of 128 bits, 192 bits, or 256 bits.

[0034] After determining the first key, the target file can be encrypted according to the first key. In some embodiments, when encrypting the target file, the target file can be loaded first, and then the data information in the target file is converted into a byte stream, and then the encryption algorithm and the first key are used to encrypt the data information in the target file. During the encryption process, the data will be processed block by block or byte by byte, and encrypted data will be generated. After all the data in the digital file is encrypted, the encrypted file body can be obtained. The symmetric encryption algorithm can be a symmetric encryption algorithm such as AES, DES (Data Encryption Standard) and 3DES (Triple DES).

[0035] S103: Asymmetrically encrypt the first key according to the first public key to generate a first authorization string.

[0036] The first public key is the public key of the authorizer. After obtaining the encrypted file body, the first key can be further encrypted to ensure the security of the first key. In some embodiments, the first key can be asymmetrically encrypted using the public key of the authorizer, and the first authorization string of the target file can be obtained after the encryption is completed. By encrypting the first key, the first key can be prevented from being obtained and decrypted by users who are not authorized by the authorizer, thereby improving the security of the target file. Asymmetrically encrypting the first key using the public key of the authorizer can ensure that only the authorizer can decrypt the first authorization string.

[0037] S104: Store or forward the encrypted file body carrying the first authorization string.

[0038] After obtaining the first authorization string, the first authorization string and the encrypted file body of the target file can be stored or forwarded. In order to improve the security of the target file, the first authorization string and the encrypted file body can be encapsulated together so that the encrypted file body carries the first authorization string, thereby ensuring that people who cannot decrypt the first authorization string cannot decrypt the encrypted file body.

[0039] In some embodiments, it is possible to use Figure 2 The method shown stores or forwards the encrypted file body. Figure 2 The flow chart shown includes the following steps: S201, encapsulate the first authorization string and authorization information into an electronic envelope of the encrypted file body.

[0040] S202: Based on the electronic envelope, store or forward the first authorization string and the encrypted file body.

[0041] The authorization information is used to determine the authorized person's right to use the target file. For example, the authorization information may include read permission information, write permission information, expiration information, authorizer information, etc. Among them, the read permission information is used to determine whether the authorized person can read the file; the write permission information is used to determine whether the authorized person can modify the file; the expiration information is used to determine the validity period of the target file, after which the target file cannot be accessed; the authorizer information is used to indicate the identity of the authorizer, for example, the authorizer's signature. In one embodiment, the authorization information includes read permission and a usage period of 7 days. Then, after decrypting the target file, the authorized person can only read the data information in the target file within 7 days after decryption.

[0042] The electronic envelope is used to ensure the privacy, integrity and authentication of the file during transmission. The encapsulated electronic envelope includes the encrypted content and the encrypted key used to encrypt the content, that is, the encrypted file body and the first authorization string. In addition, the present disclosure also encapsulates the authorization information and the first authorization string into the file header of the electronic envelope. Then, the first authorization string and the encrypted file body are stored and forwarded based on the electronic envelope.

[0043] Users can obtain electronic envelopes through various channels, such as Internet transmission, USB flash drive copy or disk copy, etc. However, users cannot decrypt the encrypted file body and thus cannot obtain the data information in the target file, which improves the security of the target file.

[0044] If the user wants to access the data in the encrypted file after obtaining it, he can send an authorization request to the authorizer according to the authorization information in the electronic envelope, and ask the authorizer to grant the permission. For example, if the authorization information includes write permission information, the authorized person can apply to the authorizer for write permission to the target file.

[0045] If the authorizer receives the authorization request initiated by the authorized person, it can process the authorization request. For specific methods, see Figure 3 The flowchart shown in FIG. 1 includes at least the following steps: S301: If an authorization request is received, identity verification is performed on the authorized person in the authorization request.

[0046] S302: If the identity authentication of the authorized person in the authorization request passes, a second authorization string exclusive to the authorized person is generated based on the first authorization string.

[0047] The authorization request at least includes the identity information and the usage permission information of the authorized person. The usage permission is the usage permission obtained by the authorized person after the authorization by the authorizer. If the authorizer receives the authorization request initiated by the authorized person, the identity of the authorized person can be verified based on the authorization request. Because the authorization request contains the information of the authorizer, the authentication of the authorizer can be verified based on the information of the authorizer. For example, the user name and password provided by the authorized person in the authorization request can be compared with the user name and password stored in the database. If the user name and password of the authorized person exist in the database, it means that the authentication is passed. Alternatively, the authorized person is authenticated based on the verification token of the authorized person in the authorization request. The verification token can be a verification token obtained by the user name and password when the authorized person logs in for the first time. When the authorized person initiates the authorization request, the verification token can be carried in the request header of the authorization request. Then the authorizer confirms the identity of the authorized person by verifying the validity of the token. Alternatively, the authorizer can determine the identity of the authorized person based on the digital certificate provided by the authorized person in the authorization request.

[0048] There are various ways to verify the identity of the authorized person, and they are not limited to the above-mentioned verification methods. By verifying the identity of the authorized person, the legitimacy of the authorized person's identity can be determined, thereby improving the accuracy of authorization and the security of the target file.

[0049] The authorization request also includes the authorized person's public key. If the authorized person's identity is authenticated, the authorizer can decrypt the first authorization string to obtain the first key used to encrypt the target file, and then encrypt the first key based on the authorized person's public key to generate a second authorization string exclusive to the authorized person.

[0050] In some embodiments, the method for generating the second authorization string is as follows: Figure 4 As shown, the flow chart includes the following steps: S401: Decrypt the first authorization string using a first private key to obtain the first key.

[0051] S402: Perform asymmetrical encryption on the first key according to the second public key in the authorization request to obtain a second authorization string.

[0052] The first private key is the private key of the authorizer, and the second public key is the public key of the authorized person. The authorizer first decrypts the first authorization string. Because the first authorization string is obtained by encrypting the first key using the public key of the authorizer and an asymmetric encryption algorithm. Therefore, the private key of the authorizer, that is, the first private key, can be called, and the same asymmetric encryption algorithm can be used to decrypt the first authorization string to obtain the first key in the first authorization string. After obtaining the first key, the first key is asymmetrically encrypted using the public key of the authorized person in the authorization request to obtain the second authorization string. Because the second public key is the public key of the authorized person, the second authorization string is the exclusive authorization string of the authorized person, and other users cannot decrypt the second authorization string.

[0053] After the authorizer encrypts and generates the second authorization string, the second authorization string can be sent to the corresponding authorized person, and the authorized person then uses the second private key, that is, the authorizer's private key, to decrypt the second authorization string through an asymmetric encryption algorithm to obtain the first key. After obtaining the first key, the encrypted file body is decrypted using the first key and the symmetric encryption algorithm to obtain the use rights of the target file.

[0054] First, the target file is symmetrically encrypted using the first key to obtain an encrypted file body, and then the first key is asymmetrically encrypted using the public key of the authorizer to obtain a first authorization string, and the first authorization string and the authorization information are encapsulated into the file header of the encrypted file body. At this point, there is no exclusive information of the authorized person in the encrypted file body and the first authorization string, so that the encrypted file body can be widely disseminated. For example, in the CDN service process, digital files can be conveniently cached and shared, and all users can share the encrypted file body, saving storage space and network resources. However, the first authorization string is obtained by asymmetrical encryption with the public key of the authorizer, so even if the user obtains the encrypted file body, he cannot decrypt the data information therein. He needs to send an authorization request to the authorizer before he can obtain the right to use it, which improves the security of the file.

[0055] After the user initiates an authorization request to the authorizer and applies for permission to use, the authorizer can authenticate the user. After the authentication is passed, the authorizer uses the private key to decrypt the first authorization string to obtain the first key in the first authorization string. Then, the first key is asymmetrically encrypted according to the user's public key carried in the authorization request to obtain a second authorization string exclusive to the user. After receiving the second authorization string, the user becomes the authorized person and can use his own private key to decrypt the second authorization string to obtain the first key, and then use the first key to decrypt the encrypted file body to obtain the permission to use the target file. The authorizer authenticates the authorized person and generates a second authorization string exclusive to the authorized person, so that the authorized person can decrypt the encrypted file body according to the second authorization string, thereby improving the security of the target file.

[0056] Corresponding to the aforementioned data encryption method embodiment, the present disclosure also provides an embodiment of a data encryption device.

[0057] Please refer to Figure 5 , Figure 5 : is a block diagram of a data encryption device provided by an exemplary embodiment of the present disclosure, the device comprising: An acquisition unit 501 is used to acquire a target file to be encrypted; A first encryption unit 502, configured to symmetrically encrypt the target file using a first key to obtain an encrypted file body; The second encryption unit 503 is used to asymmetrically encrypt the first secret key according to the first public key to generate a first authorization string; the first public key is the public key of the authorizer; The processing unit 504 is configured to store or forward the encrypted file body carrying the first authorization string.

[0058] In one embodiment, the processing unit 504 is specifically configured to: Encapsulating the first authorization string and authorization information into an electronic envelope of the encrypted file body, wherein the authorization information is used to determine the authorized person's right to use the target file; Based on the electronic envelope, the first authorization string and the encrypted file body are stored or forwarded.

[0059] In one embodiment, the apparatus further comprises: A verification unit, configured to, if an authorization request is received, authenticate the identity of the authorized person in the authorization request; A generating unit is configured to generate a second authorization string exclusive to the authorized person based on the first authorization string if the identity authentication of the authorized person in the authorization request is passed.

[0060] In one embodiment, the generating unit is specifically used to: Decrypting the first authorization string using a first private key to obtain the first key; the first private key is the private key of the authorizer; The first key is asymmetrically encrypted according to the second public key in the authorization request to obtain a second authorization string; the second public key is the public key of the authorized person.

[0061] In one embodiment, the apparatus further comprises: The sending unit is used to send the second authorization string to the authorized person, so that the authorized person decrypts the second authorization string through the second private key, obtains the first key, and uses the first key to decrypt the encrypted file body; the second private key is the private key of the authorized person.

[0062] In one embodiment, the verification unit is specifically used to: authenticating the authorized person based on the user name and password provided by the authorized person in the authorization request; authenticating the authorized person based on the verification token of the authorized person in the authorization request; The authorized person is authenticated based on the digital certificate provided by the authorized person in the authorization request.

[0063] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0064] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the disclosed solution. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0065] The embodiments of the data encryption device disclosed in the present invention can be applied to electronic devices. The device embodiments can be implemented by software, hardware, or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, the processor of the electronic device in which it is located reads the corresponding computer program instructions in the non-volatile memory into the memory and runs them. From the hardware level, if Figure 6 The figure is a hardware structure diagram of the electronic device where the data encryption device of the present disclosure is located. Figure 6In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in which the device in the embodiment is located may also include other hardware according to its actual functions, which will not be described in detail.

[0066] Based on the same inventive concept, an embodiment of the present disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any step of the data encryption method when executing the program.

[0067] Based on the same inventive concept, an embodiment of the present disclosure further provides a computer program product, which implements any step of the data encryption method when executed by a processor.

[0068] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the particular order or sequential order shown to achieve the desired results. In some implementations, multitasking and parallel processing may be advantageous.

[0069] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure shall be included in the scope of protection of the present disclosure.

Claims

1. A data encryption method, characterized in that: The method comprises: Get the target file to be encrypted; Using a first key to symmetrically encrypt the target file to obtain an encrypted file body; Asymmetrically encrypt the first secret key according to the first public key to generate a first authorization string; the first public key is the public key of the authorizer; The encrypted file body carrying the first authorization string is stored or forwarded.

2. The method according to claim 1, characterized in that The storing or forwarding the encrypted file body carrying the first authorization string includes: Encapsulating the first authorization string and authorization information into an electronic envelope of the encrypted file body, wherein the authorization information is used to determine the authorized person's right to use the target file; Based on the electronic envelope, the first authorization string and the encrypted file body are stored or forwarded.

3. The method according to claim 1, characterized in that After storing and forwarding the encrypted file body carrying the first authorization string, the method further includes: If an authorization request is received, identity verification is performed on the authorized person in the authorization request; If the identity authentication of the authorized person in the authorization request is passed, a second authorization string exclusive to the authorized person is generated based on the first authorization string.

4. The method according to claim 3, characterized in that The generating, based on the first authorization string, a second authorization string exclusive to the authorized person includes: Decrypting the first authorization string using a first private key to obtain the first key; the first private key is the private key of the authorizer; The first key is asymmetrically encrypted according to the second public key in the authorization request to obtain a second authorization string; the second public key is the public key of the authorized person.

5. The method according to claim 3, characterized in that: After generating a second authorization string exclusive to the authorized person based on the first authorization string, the method further includes: The second authorization string is sent to the authorized person, so that the authorized person decrypts the second authorization string by using the second private key, obtains the first key, and uses the first key to decrypt the encrypted file body; the second private key is the private key of the authorized person.

6. The method according to claim 3, characterized in that The authenticating the authorized person in the authorization request includes at least one of the following: authenticating the authorized person based on the user name and password provided by the authorized person in the authorization request; authenticating the authorized person based on the verification token of the authorized person in the authorization request; The authorized person is authenticated based on the digital certificate provided by the authorized person in the authorization request.

7. A data encryption device, characterized in that: The device comprises: An acquisition unit, used for acquiring a target file to be encrypted; A first encryption unit, used to symmetrically encrypt the target file using a first key to obtain an encrypted file body; A second encryption unit, configured to asymmetrically encrypt the first secret key according to a first public key to generate a first authorization string; the first public key is a public key of the authorizer; A processing unit is used to store or forward the encrypted file body carrying the first authorization string.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that When the program product is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images