File encryption method and device, file decryption method and device, distributed storage system and medium

Abstract

The invention relates to the technical field of data security, in particular to a file encryption method and device, a file decryption method and device, a distributed storage system and a medium, and the method comprises the steps: obtaining a to-be-encrypted file; dividing the to-be-encrypted file into files in different logic areas according to data types; calling a preset symmetric encryption algorithm of the corresponding logic area according to the files of the different logic areas to encrypt the files of the different logic areas to generate corresponding encryption keys; and dynamically exchanging the frequency and the algorithm of the encryption key by using a preset protocol to obtain a final encryption key, and performing encryption fusion on different logic regions of the to-be-encrypted file by using the final encryption key to generate an encrypted file. Therefore, the problems of performance bottleneck, single-point failure, low safety and reliability and the like caused by the fact that all encryption and decryption operations are completed on a single server in an encryption method in the related technology are solved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a file encryption method, decryption method, device, distributed storage system and medium. Background Art

[0002] With the frequent occurrence of data leaks and cyber attacks, protecting sensitive data has become a top priority. Traditional encryption technologies, such as symmetric encryption and asymmetric encryption, have their own advantages and disadvantages, but when dealing with large-scale distributed systems, there are still problems such as performance bottlenecks, key management difficulties and single point failure risks.

[0003] In the related art, the encryption method is usually centralized, that is, all encryption and decryption operations are completed on a single server, resulting in performance bottlenecks and single point failure problems, and low reliability and security. Summary of the invention

[0004] The present application provides a file encryption method, a decryption method, a device, a distributed storage system, a medium and a program to solve the problems that all encryption and decryption operations in the encryption method in the related art are completed on a single server, resulting in performance bottlenecks and single point failures, low security and reliability, etc.

[0005] A first aspect of the present application provides a file encryption method, which is applied to a distributed storage system, wherein the method includes the following steps: obtaining a file to be encrypted; dividing the file to be encrypted into files of different logical areas according to data type, wherein the files of different logical areas include the text content of the document, embedded pictures or images or charts, table data, footnotes, appendices and metadata; calling a preset symmetric encryption algorithm of the corresponding logical area according to the files of the different logical areas to perform regional distributed encryption on the files of the different logical areas to generate corresponding encryption keys; using a preset protocol to dynamically exchange the frequency and algorithm of the encryption key to obtain a final encryption key, and using the final encryption key to encrypt and fuse different logical areas of the file to be encrypted to generate an encrypted file.

[0006] Optionally, calling the preset symmetric encryption algorithm of the corresponding logical area according to the files of the different logical areas performs regional distributed encryption on the files of the different logical areas to generate corresponding encryption keys, including: if the files of the different logical areas are the text content of the document, calling the first symmetric encryption algorithm to encrypt the text content of the document to generate a first encryption key; if the files of the different logical areas are embedded pictures, images or charts, calling the second symmetric encryption algorithm to encrypt the embedded pictures, images or charts to generate a second encryption key; if the files of the different logical areas are tabular data, calling the third symmetric encryption algorithm to encrypt the tabular data to generate a third encryption key; if the files of the different logical areas are footnotes, calling the fourth symmetric encryption algorithm to encrypt the footnotes to generate a fourth encryption key; if the files of the different logical areas are appendices, calling the fifth symmetric encryption algorithm to encrypt the appendix to generate a fifth encryption key; if the files of the different logical areas are metadata, calling the sixth symmetric encryption algorithm to encrypt the metadata to generate a sixth encryption key, wherein the metadata includes the author and date.

[0007] Optionally, before obtaining the final encryption key by using the frequency and algorithm of dynamic encryption key exchange of the preset protocol, it includes: identifying system load and security requirements; and dynamically adjusting the frequency and algorithm of key exchange according to the system load and the security requirements.

[0008] Optionally, after using the final encryption key to encrypt and merge different logical areas of the file to be encrypted to generate the encrypted file, the method further includes: dispersively storing the encrypted data of each logical area in a distributed storage system.

[0009] The second aspect of the present application provides a file decryption method, including: the method is applied to a distributed storage system, wherein the method includes the following steps: obtaining a file to be decrypted; identifying encrypted data corresponding to each logical area of ​​the file to be decrypted, and obtaining a decryption key for each logical area through a preset key exchange protocol; using the decryption key to decrypt the file to be decrypted in each logical area layer by layer to obtain a decrypted file.

[0010] In a third aspect, an embodiment of the present application provides a file encryption device, which is applied to a distributed storage system, wherein the device includes: a first acquisition module, used to acquire a file to be encrypted; a division module, used to divide the file to be encrypted into files of different logical areas according to data type, wherein the files of different logical areas include the text content of the document, embedded pictures or images or charts, table data, footnotes, appendices and metadata; a calling module, used to call a preset symmetric encryption algorithm of the corresponding logical area according to the files of the different logical areas, perform regional distributed encryption on the files of the different logical areas to generate corresponding encryption keys; an encryption module, used to dynamically exchange the frequency and algorithm of the encryption key using a preset protocol to obtain a final encryption key, and use the final encryption key to encrypt and fuse different logical areas of the file to be encrypted to generate an encrypted file.

[0011] The fourth aspect of the present application provides a file decryption device, which is applied to a distributed storage system, wherein the device includes: a second acquisition module, used to obtain a file to be decrypted; an identification module, used to identify the encrypted data corresponding to each logical area of ​​the file to be decrypted, and obtain a decryption key for each logical area through a preset key exchange protocol; a decryption module, used to use the decryption key to decrypt the file to be decrypted in each logical area layer by layer to obtain a decrypted file.

[0012] The fifth aspect of the present application provides a distributed storage system, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to execute the file encryption method or the file decryption method as described in the above embodiments.

[0013] The sixth aspect of the present application provides a computer-readable storage medium on which a computer program is stored. The program is executed by a processor to perform the file encryption method or the file decryption method as described in the above embodiments.

[0014] The seventh aspect of the present application provides a computer program product, including a computer program or instructions, characterized in that when the computer program or instructions are executed, the file encryption method or the file decryption method as described in the above embodiments is implemented.

[0015] Therefore, this application has at least the following beneficial effects:

[0016] The embodiment of the present application obtains a file to be encrypted; divides the file to be encrypted into files of different logical areas according to data type, and calls a preset symmetric encryption algorithm of the corresponding logical area according to the files of different logical areas to perform regional distributed encryption on the files of different logical areas to generate corresponding encryption keys; uses a preset protocol to dynamically exchange the frequency and algorithm of encryption keys to obtain a final encryption key, and uses the final encryption key to encrypt and fuse different logical areas of the file to be encrypted to generate an encrypted file. By dividing the file into multiple areas and adopting distributed encryption and key management technology, the purpose of efficient and secure data protection is achieved, and the reliability and scalability of the system are improved.

[0017] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0019] Figure 1 A flowchart of a file encryption method provided according to an embodiment of the present application;

[0020] Figure 2 A flowchart of a file encryption method based on regional distributed encryption and key exchange provided according to an embodiment of the present application;

[0021] Figure 3 A flowchart of a file decryption method provided according to an embodiment of the present application;

[0022] Figure 4 A block diagram of a file encryption device provided according to an embodiment of the present application;

[0023] Figure 5 A block diagram of a file decryption device provided according to an embodiment of the present application;

[0024] Figure 6 A schematic diagram of the structure of a distributed storage system provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0026] The following describes the file encryption method, decryption method, device, distributed storage system, medium and program of the embodiment of the present application with reference to the accompanying drawings. In view of the problem that all encryption and decryption operations in the encryption method of the related technology mentioned in the background technology center are completed on a single server, resulting in performance bottlenecks and single point failures, low security and reliability, the present application provides a file encryption method, in which a file to be encrypted is obtained; the file to be encrypted is divided into files of different logical areas according to the data type, and the preset symmetric encryption algorithm of the corresponding logical area is called according to the files of different logical areas to perform regional distributed encryption on the files of different logical areas to generate corresponding encryption keys; the frequency and algorithm of dynamically exchanging encryption keys using the preset protocol are used to obtain the final encryption key, and the final encryption key is used to encrypt and fuse different logical areas of the encrypted file to generate an encrypted file, and by dividing the file into multiple areas, distributed encryption and key management technology are used to achieve the purpose of efficient and secure data protection, and improve the reliability and scalability of the system. Thus, the problems that all encryption and decryption operations in the encryption method of the related technology are completed on a single server, resulting in performance bottlenecks and single point failures, low security and reliability, etc. are solved.

[0027] Specifically, Figure 1 A flowchart of a file encryption method provided in an embodiment of the present application.

[0028] like Figure 1 As shown, the file encryption method is applied to a distributed storage system, wherein the method comprises the following steps:

[0029] In step S101, a file to be encrypted is obtained.

[0030] It can be understood that the embodiment of the present application can obtain the to-be-encrypted files uploaded by the vehicle computer through a distributed storage system, so as to subsequently divide the to-be-encrypted files into files in different logical areas according to data types.

[0031] In step S102, the files to be encrypted are divided into files in different logical areas according to data types.

[0032] Among them, files in different logical areas include the text content of the document, embedded pictures or images or charts, table data, footnotes, appendices and metadata.

[0033] It is understandable that the embodiments of the present application can divide the files to be encrypted into files in different logical areas according to the data type, so as to facilitate the subsequent distributed encryption of files in different logical areas.

[0034] Specifically, if Figure 2As shown, the file is divided into regions, and the file to be encrypted is divided into multiple regions, each region contains a different part of the file. For example, a large document is divided into five regions, each region contains a part of the document data, region A contains the text content of the document, region B contains embedded pictures, attached images or charts, region C contains table data, region D contains footnotes, region D contains appendices, and region F contains metadata, such as author, date, etc.

[0035] In step S103, based on the files in different logical areas, a preset symmetric encryption algorithm of the corresponding logical area is called to perform regional distributed encryption on the files in the different logical areas to generate corresponding encryption keys.

[0036] It can be understood that the embodiments of the present application can call the preset symmetric encryption algorithm of the corresponding logical area according to the files in different logical areas to perform regional distributed encryption on the files in different logical areas to generate corresponding encryption keys. By dividing the files into multiple areas and adopting distributed encryption and key management technology, efficient and secure data protection purposes can be achieved.

[0037] In an embodiment of the present application, the preset symmetric encryption algorithm of the corresponding logical area is called according to the files in different logical areas to perform regional distributed encryption on the files in different logical areas to generate corresponding encryption keys, including: if the files in different logical areas are the text content of the document, the first symmetric encryption algorithm is called to encrypt the text content of the document to generate a first encryption key; if the files in different logical areas are embedded pictures, images or charts, the second symmetric encryption algorithm is called to encrypt the embedded pictures, images or charts to generate a second encryption key; if the files in different logical areas are tabular data, the third symmetric encryption algorithm is called to encrypt the tabular data to generate a third encryption key; if the files in different logical areas are footnotes, the fourth symmetric encryption algorithm is called to encrypt the footnotes to generate a fourth encryption key; if the files in different logical areas are appendices, the fifth symmetric encryption algorithm is called to encrypt the appendix to generate a fifth encryption key; if the files in different logical areas are metadata, the sixth symmetric encryption algorithm is called to encrypt the metadata to generate a sixth encryption key, wherein the metadata includes the author and date.

[0038] Among them, the first symmetric encryption algorithm can be the AES-256 algorithm, the second symmetric encryption algorithm can be the AES-192 algorithm, the third symmetric encryption algorithm can be the AES-128 algorithm, the fourth symmetric encryption algorithm can be the AES-256 algorithm, the fifth symmetric encryption algorithm can be the AES-192 algorithm, the sixth symmetric encryption algorithm can be the AES-128 algorithm, and the first to sixth encryption keys can be K1-K6, without specific limitation.

[0039] It can be understood that the embodiments of the present application can call the preset symmetric encryption algorithm of the corresponding logical area according to the files of different logical areas to perform regional distributed encryption on the files of different logical areas and generate corresponding encryption keys. Different areas can use different encryption algorithms and key lengths to generate encrypted regional data to enhance the security of encryption.

[0040] It should be noted that the Mersenne Twister algorithm is used to generate symmetric keys from area A to area F. These keys are stored in a distributed key management system, and the security and confidentiality of the keys are ensured. Dynamic update and synchronization of keys are supported to ensure that the keys are not accessed by unauthorized users.

[0041] Specifically, if Figure 2 As shown, a symmetric encryption algorithm is applied to each area for encryption. Different areas can use different encryption algorithms and key lengths to generate encrypted area data to enhance security.

[0042] The specific encryption method can be selected according to needs, as long as the encryption methods of each area are different to prevent unified cracking, for example, area A: use AES-256 to encrypt the text content of area A and generate encryption key K1; area B: use AES-192 to encrypt the image data of area B and generate encryption key K2; area C: use AES-128 to encrypt the table data of area C and generate encryption key K3; area D: use AES-256 to encrypt the footnote data of area D and generate encryption key K4; area E: use AES-192 to encrypt the appendix data of area E and generate encryption key K5, F: use AES-128 to encrypt the metadata of area F and generate encryption key K6. Different areas can use different encryption algorithms and key lengths to generate encrypted regional data to enhance security.

[0043] In step S104, the frequency and algorithm of dynamically exchanging encryption keys using a preset protocol are used to obtain a final encryption key, and the final encryption key is used to encrypt and merge different logical areas of the file to be encrypted to generate an encrypted file.

[0044] Among them, the preset protocol is the Diffie-Hellman exchange protocol, which can be set according to actual needs without specific limitation.

[0045] It can be understood that the embodiments of the present application can use the preset protocol to dynamically exchange the frequency and algorithm of encryption keys to obtain the final encryption key, use the final encryption key to encrypt and fuse different logical areas of the encrypted file to generate an encrypted file, support dynamic update and synchronization of the key, ensure that the key is not accessed by unauthorized users, and transmit the key of each area through an encrypted channel to ensure that the key is not intercepted and stolen during the exchange process, thereby improving the reliability and security of encryption.

[0046] Specifically, if Figure 2 As shown in the figure, the dynamic key Diffie-Hellman exchange protocol is used to dynamically exchange keys in a distributed system. The keys of each area are transmitted through an encrypted channel to ensure that the keys are not intercepted and stolen during the exchange process. The frequency and algorithm of key exchange are dynamically adjusted according to the system load and security requirements. The negotiation of secret keys generates key pairs through the protocol and exchanges them between nodes. The key transmission transmits the keys through an encrypted channel to ensure the security of the transmission process. The key application uses the exchanged keys to perform data decryption operations during the decryption process.

[0047] In an embodiment of the present application, before obtaining the final encryption key using the frequency and algorithm of dynamic encryption key exchange according to a preset protocol, it includes: identifying the system load and security requirements; and dynamically adjusting the frequency and algorithm of key exchange according to the system load and security requirements.

[0048] It can be understood that the embodiments of the present application can identify system load and security requirements; dynamically adjust the frequency and algorithm of key exchange according to the system load and security requirements, thereby supporting dynamic updating and synchronization of keys and ensuring that keys are not accessed by unauthorized users.

[0049] Specifically, use automated monitoring tools to monitor the system load in real time, such as: CPU usage, memory usage, network bandwidth usage, storage space usage and file transfer rate, record various operation logs during system operation, including logs of encryption, decryption, key exchange and other activities for post-analysis, conduct performance tests regularly, simulate system performance under different load conditions, and evaluate the system's response time and processing capabilities.

[0050] When the load is low, reduce the frequency of key exchange to save computing resources and network bandwidth; when the load is high, increase the frequency of key exchange to improve system security; when security requirements are high, key exchange should be performed frequently even if the system load is not high.

[0051] In the embodiment of the present application, after different logical areas of the to-be-encrypted file are encrypted and merged using the final encryption key to generate the encrypted file, the following steps include: dispersively storing the encrypted data of each logical area in a distributed storage system.

[0052] It is understandable that the embodiments of the present application can store the encrypted data of each logical area in a distributed storage system in a dispersed manner to ensure the security and confidentiality of the key.

[0053] Specifically, if Figure 2 As shown, the encrypted data of each region is stored in a distributed storage system, for example, Amazon S3 distributed storage system is used to improve data reliability and access efficiency. The encrypted data of each region is merged to generate the final encrypted file. The file storage adopts a distributed storage solution to improve the reliability and scalability of the storage system; the file data is distributed on multiple storage nodes to avoid the risk of single point failure.

[0054] According to the file encryption method proposed in the embodiment of the present application, a file to be encrypted is obtained; the file to be encrypted is divided into files of different logical areas according to the data type, and the preset symmetric encryption algorithm of the corresponding logical area is called according to the files of different logical areas to perform regional distributed encryption on the files of different logical areas to generate corresponding encryption keys; the frequency and algorithm of dynamically exchanging encryption keys using a preset protocol are used to obtain a final encryption key, and the final encryption key is used to encrypt and fuse different logical areas of the file to be encrypted to generate an encrypted file. By dividing the file into multiple areas and adopting distributed encryption and key management technology, the purpose of efficient and secure data protection is achieved, and the reliability and scalability of the system are improved.

[0055] Next, the file decryption method proposed according to the embodiment of the present application is described with reference to the accompanying drawings.

[0056] Figure 3 It is a flowchart of the file decryption method of an embodiment of the present application.

[0057] like Figure 3 As shown, the file decryption method is applied to a distributed storage system, wherein the method comprises the following steps:

[0058] In step S201, a file to be decrypted is obtained.

[0059] It is understandable that the embodiment of the present application can obtain the file to be decrypted so as to facilitate the subsequent decryption of the file to be decrypted.

[0060] In step S202, the encrypted data corresponding to each logical area of ​​the file to be decrypted is identified, and the decryption key of each logical area is obtained through a preset key exchange protocol.

[0061] The preset key exchange protocol is the Diffie-Hellman exchange protocol, which is not specifically limited.

[0062] It is understandable that the embodiment of the present application can identify the encrypted data corresponding to each logical area of ​​the file to be decrypted, and obtain the decryption key of each logical area through a preset key exchange protocol.

[0063] In step S203, the decryption key is used to decrypt the file to be decrypted in each logical area layer by layer to obtain a decrypted file.

[0064] It can be understood that the embodiments of the present application can use the decryption key to decrypt the files to be decrypted in each logical area layer by layer to obtain the decrypted files, decrypt the data of each area layer by layer according to the encryption order, use the corresponding decryption key to decrypt the data of each area, and ensure the data integrity and consistency of each area during the decryption process, thereby ensuring the accuracy of the data.

[0065] Specifically, if Figure 2 As shown in the figure, after reading the encrypted file in the storage, the data is read by region. The decryption key of each region is obtained through the dynamic key exchange protocol. The data of each region is decrypted layer by layer according to the encryption order, and the data of each region is decrypted using the corresponding decryption key. The data integrity and consistency of each region are ensured during the decryption process. The original file content is restored layer by layer to ensure that the final restored file is consistent with the file before encryption. The decrypted data of each region is merged into the original complete file. The consistency and integrity of the regional data are ensured during decryption.

[0066] It should be noted that according to the actual file transfer, the encryption and decryption parameters are adjusted dynamically. When facing new security threats, the key length can be increased or the encryption algorithm can be changed. Use automated tools to monitor system load. Regularly evaluate the performance of the key management system and update the key generation and management strategy. Use load balancing technology to allocate storage and computing resources to improve the overall efficiency of the system.

[0067] According to the file decryption method proposed in the embodiment of the present application, the file to be decrypted is obtained, the encrypted data corresponding to each logical area of ​​the file to be decrypted is identified, and the decryption key of each logical area is obtained through a preset key exchange protocol. The decryption key is used to decrypt the file to be decrypted in each logical area layer by layer to obtain the decrypted file, and the data of each area is decrypted layer by layer according to the encryption order. The corresponding decryption key is used to decrypt the data of each area. The data integrity and consistency of each area are ensured during the decryption process, thereby ensuring the accuracy of the data.

[0068] Next, the file encryption device proposed according to the embodiment of the present application is described with reference to the accompanying drawings.

[0069] Figure 4 It is a block diagram of a file encryption device according to an embodiment of the present application.

[0070] like Figure 4As shown, the file encryption device 10 is applied to a distributed storage system, wherein the device includes: a first acquisition module 110 , a division module 120 , a calling module 130 and an encryption module 140 .

[0071] Among them, the first acquisition module 110 is used to obtain the file to be encrypted; the division module 120 is used to divide the file to be encrypted into files of different logical areas according to the data type, wherein the files of different logical areas include the text content of the document, embedded pictures or images or charts, table data, footnotes, appendices and metadata; the calling module 130 is used to call the preset symmetric encryption algorithm of the corresponding logical area according to the files of different logical areas to perform regional distributed encryption on the files of different logical areas to generate corresponding encryption keys; the encryption module 140 is used to dynamically exchange the frequency and algorithm of the encryption key using the preset protocol to obtain the final encryption key, and use the final encryption key to encrypt and fuse the different logical areas of the file to be encrypted to generate an encrypted file.

[0072] It should be noted that the above explanation of the file encryption method embodiment is also applicable to the file encryption device of this embodiment, and will not be repeated here.

[0073] According to the file encryption device proposed in the embodiment of the present application, a file to be encrypted is obtained; the file to be encrypted is divided into files of different logical areas according to the data type, and the preset symmetric encryption algorithm of the corresponding logical area is called according to the files of different logical areas to perform regional distributed encryption on the files of different logical areas to generate corresponding encryption keys; the frequency and algorithm of dynamically exchanging encryption keys using a preset protocol are used to obtain a final encryption key, and the final encryption key is used to encrypt and fuse different logical areas of the file to be encrypted to generate an encrypted file. By dividing the file into multiple areas and adopting distributed encryption and key management technology, the purpose of efficient and secure data protection is achieved, and the reliability and scalability of the system are improved.

[0074] Next, the file decryption device proposed according to the embodiment of the present application is described with reference to the accompanying drawings.

[0075] Figure 5 It is a block diagram of a file decryption device according to an embodiment of the present application.

[0076] like Figure 5 As shown, the file decryption device is applied to a distributed storage system, wherein the device includes: a second acquisition module 210, an identification module 220 and a decryption module 230.

[0077] Among them, the second acquisition module 210 is used to obtain the file to be decrypted; the identification module 220 is used to identify the encrypted data corresponding to each logical area of ​​the file to be decrypted, and obtain the decryption key of each logical area through a preset key exchange protocol; the decryption module 230 is used to use the decryption key to decrypt the file to be decrypted in each logical area layer by layer to obtain the decrypted file.

[0078] It should be noted that the above explanation of the file decryption method embodiment is also applicable to the file decryption device of this embodiment, and will not be repeated here.

[0079] According to the file decryption device proposed in the embodiment of the present application, the file to be decrypted is obtained, the encrypted data corresponding to each logical area of ​​the file to be decrypted is identified, and the decryption key of each logical area is obtained through a preset key exchange protocol. The decryption key is used to decrypt the file to be decrypted in each logical area layer by layer to obtain the decrypted file, the data of each area is decrypted layer by layer according to the encryption order, and the corresponding decryption key is used to decrypt the data of each area. The data integrity and consistency of each area are ensured during the decryption process, thereby ensuring the accuracy of the data.

[0080] Figure 6 A schematic diagram of the structure of a distributed storage system provided in an embodiment of the present application. The distributed storage system may include:

[0081] A memory 601 , a processor 602 , and a computer program stored in the memory 601 and executable on the processor 602 .

[0082] When the processor 602 executes the program, the file encryption method or the file decryption method provided in the above embodiments is implemented.

[0083] Furthermore, the distributed storage system also includes:

[0084] The communication interface 603 is used for communication between the memory 601 and the processor 602 .

[0085] The memory 601 is used to store computer programs that can be executed on the processor 602 .

[0086] The memory 601 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0087] If the memory 601, the processor 602 and the communication interface 603 are implemented independently, the communication interface 603, the memory 601 and the processor 602 can be connected to each other through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0088] Optionally, in a specific implementation, if the memory 601, the processor 602 and the communication interface 603 are integrated on a chip, the memory 601, the processor 602 and the communication interface 603 can communicate with each other through an internal interface.

[0089] The processor 602 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0090] An embodiment of the present application also provides a computer-readable storage medium on which a computer program or instruction is stored. When the computer program or instruction is executed by a processor, the above file encryption method or file decryption method is implemented.

[0091] An embodiment of the present application also provides a computer program product, including a computer program or instructions, characterized in that when the computer program or instructions are executed, the above file encryption method or file decryption method is implemented.

[0092] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0093] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0094] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or N executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0095] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above embodiment, the N steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one or a combination of multiple of the following technologies known in the art: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0096] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

Claims

1. A file encryption method, characterized in that: The method is applied to a distributed storage system, wherein the method comprises the following steps: Get the file to be encrypted; Dividing the to-be-encrypted file into files of different logical areas according to data types, wherein the files of different logical areas include text content of the document, embedded pictures or images or charts, table data, footnotes, appendices and metadata; According to the files in the different logical areas, a preset symmetric encryption algorithm of the corresponding logical area is called to perform regional distributed encryption on the files in the different logical areas to generate corresponding encryption keys; The frequency and algorithm of dynamically exchanging encryption keys using a preset protocol are used to obtain a final encryption key, and the final encryption key is used to encrypt and merge different logical areas of the file to be encrypted to generate an encrypted file.

2. The file encryption method according to claim 1, characterized in that: The calling of a preset symmetric encryption algorithm of a corresponding logical area according to the files of the different logical areas to perform regional distributed encryption on the files of the different logical areas to generate corresponding encryption keys includes: If the files in the different logical areas are text contents of a document, calling a first symmetric encryption algorithm to encrypt the text contents of the document to generate a first encryption key; If the files in the different logical areas are embedded pictures, images or charts, calling a second symmetric encryption algorithm to encrypt the embedded pictures, images or charts to generate a second encryption key; If the files in the different logical areas are table data, calling a third symmetric encryption algorithm to encrypt the table data to generate a third encryption key; If the files in the different logical areas are footnotes, calling a fourth symmetric encryption algorithm to encrypt the footnotes to generate a fourth encryption key; If the file in the different logical area is an appendix, calling the fifth symmetric encryption algorithm to encrypt the appendix to generate a fifth encryption key; If the files in the different logical areas are metadata, a sixth symmetric encryption algorithm is called to encrypt the metadata to generate a sixth encryption key, wherein the metadata includes an author and a date.

3. The file encryption method according to claim 1, characterized in that: Before obtaining the final encryption key by using the frequency and algorithm of dynamic encryption key exchange of the preset protocol, the method includes: Identify system load and security requirements; The frequency and algorithm of key exchange are dynamically adjusted according to the system load and the security requirements.

4. The file encryption method according to claim 1, characterized in that: After the different logical areas of the to-be-encrypted file are encrypted and merged using the final encryption key to generate the encrypted file, the method includes: The encrypted data of each logical area is dispersedly stored in a distributed storage system.

5. A file decryption method, characterized in that: The method is applied to a distributed storage system, wherein the method comprises the following steps: Get the file to be decrypted; Identify the encrypted data corresponding to each logical area of ​​the file to be decrypted, and obtain the decryption key of each logical area through a preset key exchange protocol; The decryption key is used to decrypt the file to be decrypted in each logical area layer by layer to obtain the decrypted file.

6. A file encryption device, characterized in that: The device is applied to a distributed storage system, wherein the device comprises: A first acquisition module, used to acquire a file to be encrypted; A division module, used for dividing the to-be-encrypted file into files of different logical areas according to data types, wherein the files of different logical areas include the text content of the document, embedded pictures or images or charts, table data, footnotes, appendices and metadata; A calling module, used for calling a preset symmetric encryption algorithm of a corresponding logical area according to the files of the different logical areas to perform regional distributed encryption on the files of the different logical areas and generate corresponding encryption keys; The encryption module is used to dynamically exchange the frequency and algorithm of the encryption key using a preset protocol to obtain a final encryption key, and use the final encryption key to encrypt and merge different logical areas of the encrypted file to generate an encrypted file.

7. A file decryption device, characterized in that: The device is applied to a distributed storage system, wherein the device comprises: A second acquisition module, used to acquire the file to be decrypted; An identification module, used to identify the encrypted data corresponding to each logical area of ​​the file to be decrypted, and obtain a decryption key for each logical area through a preset key exchange protocol; The decryption module is used to use the decryption key to decrypt the file to be decrypted in each logical area layer by layer to obtain a decrypted file.

8. A distributed storage system, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the file encryption method according to any one of claims 1 to 4, or the file decryption method according to claim 5.

9. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, it is used to implement the file encryption method according to any one of claims 1 to 4, or the file decryption method according to claim 5.

10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed, the file encryption method according to any one of claims 1 to 4 or the file decryption method according to claim 5 is implemented.

Images