File processing method and device

Abstract

The embodiment of the invention provides a file processing method and device.The method comprises the steps that in the file processing process, an encrypted storage request for file storage aiming at a storage position is obtained, a file encryption mode and a user key generation mode corresponding to the storage position are determined, a file key matched with the file encryption mode is generated, and the file key is stored in the encrypted storage request; according to the file encryption method, file encryption processing is carried out through the file key according to the file encryption mode to obtain encrypted file data, the user permission configured for the storage position is inquired, and the user key matched with the user permission is generated according to the user key generation mode, so that encrypted storage of the file is realized, and the security of data storage is improved; and the functionality of file storage is increased.

Description

Technical Field

[0001] This document relates to the field of data processing technology, and in particular to a file processing method and device. Background Art

[0002] With the continuous development of Internet technology and the continuous increase of data resources, more and more users begin to transmit data through the Internet. Users can download the data they need on the Internet for use, which greatly improves convenience. However, with the continuous increase of data on the Internet, cloud storage services are being established to store data in order to ensure the immediacy and transmission efficiency of data. However, the current storage methods still have problems such as security and privacy. In the prior art, different access rights are usually assigned to users, and the scope of data that users are allowed to access is controlled by the access rights. However, access rights are easy to circumvent, and users can circumvent the access rights to obtain the same data from other data storage locations, which challenges data security and privacy. How to better provide storage services has become a focus of attention for all parties. Summary of the invention

[0003] An embodiment of the present specification aims to provide a file processing method and device to solve the problem of low processing efficiency and weak pertinence for user storage requirements during file encryption and decryption.

[0004] To solve the above technical problems, an embodiment of this specification is implemented as follows: In a first aspect, an embodiment of the present specification provides a file processing method, including: Obtain an encrypted storage request for storing a file at a storage location, and determine a file encryption method and a user key generation method corresponding to the storage location; Generate a file key suitable for the file encryption method, and perform file encryption processing using the file key according to the file encryption method to obtain encrypted file data; The user authority configured for the storage location is queried, and a user key matching the user authority is generated according to the user key generation method.

[0005] The file processing method provided in this embodiment, during the file encryption process, responds to an encrypted storage request for file storage at a storage location, determines the file encryption method and the user key generation method corresponding to the storage location, generates a file key corresponding to the file encryption method, and performs file encryption processing according to the file encryption method using the file key to obtain encrypted file data, determines the file encryption method through the file storage location, quickly and stably determines the encryption strategy, improves the encryption efficiency, then queries the user rights configured for the storage location, generates a user key matching the user rights according to the key generation method, represents the user's file access rights through the generated user key, enables permission verification in offline scenarios, improves the security of file encryption, and improves the encryption efficiency while improving the file security through the joint use of the file key and the user key.

[0006] In a second aspect, another embodiment of the present specification provides another file processing method, including: Parsing the encrypted data set of the acquired file to obtain encrypted file data and key data, and determining a file decryption method for the encrypted file data; Parsing the key data according to the key parameters in the encrypted data set to obtain a file key and a user key; Decrypting the encrypted file data using the file key in accordance with the file decryption method to obtain the file data of the file; Target file data matching the user authority corresponding to the user key is screened out from the file data.

[0007] Another file processing method provided by this embodiment, during the file decryption process, obtains an encrypted data set of the file, parses the encrypted data set to obtain encrypted file data and key data, determines a file decryption method corresponding to the encrypted file data, parses the key data according to key parameters to obtain a file key and a user key, decrypts the encrypted file data according to the file decryption method using the file key to obtain the file data of the file, determines the file decryption method using the data in the encrypted data set, implements decryption in an offline state, improves the decryption processing efficiency, and adds the offline function of the decryption processing, then screens out target file data that matches the user authority corresponding to the user key from the file data, and through the joint use of the user key and the file key, improves the security of file decryption while improving the file decryption efficiency.

[0008] In a third aspect, another embodiment of the present specification provides a file processing device, including: An encryption method determination module is used to obtain an encrypted storage request for storing a file at a storage location, and determine a file encryption method and a user key generation method corresponding to the storage location; A file encryption module, used to generate a file key adapted to the file encryption method, and perform file encryption processing using the file key according to the file encryption method to obtain encrypted file data; The key generation module is used to query the user authority configured for the storage location and generate a user key matching the user authority according to the user key generation method.

[0009] In a fourth aspect, another embodiment of the present specification provides another file processing device, including: A decryption method determination module, used to parse the encrypted data set of the acquired file to obtain the encrypted file data and key data, and determine the file decryption method of the encrypted file data; A key data parsing module, used to parse the key data according to the key parameters in the encrypted data set to obtain a file key and a user key; A file decryption module, used to decrypt the encrypted file data using the file key according to the file decryption method to obtain the file data of the file; The file data screening module is used to screen out target file data that matches the user authority corresponding to the user key from the file data.

[0010] In the fifth aspect, another embodiment of the present specification provides a file processing device, comprising: a memory, a processor, and computer executable instructions stored on the memory and executable on the processor, wherein the computer executable instructions, when executed by the processor, implement the steps of the file processing method as described in the first aspect above.

[0011] In the sixth aspect, another embodiment of the present specification provides another file processing device, comprising: a memory, a processor, and computer executable instructions stored on the memory and executable on the processor, wherein the computer executable instructions, when executed by the processor, implement the steps of the file processing method as described in the second aspect above.

[0012] In a seventh aspect, another embodiment of the present specification provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the steps of the file processing method described in the first aspect above are implemented.

[0013] In an eighth aspect, another embodiment of the present specification provides another computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the steps of the file processing method described in the second aspect above are implemented.

[0014] In a ninth aspect, another embodiment of the present specification provides a computer program product, wherein the computer program product includes a file processing program, and the file processing program is executed by a processor to implement the steps of the file processing method as described in the first aspect above.

[0015] In the tenth aspect, another embodiment of the present specification provides another computer program product, wherein the computer program product includes a file processing program, and the file processing program is executed by a processor to implement the steps of the file processing method as described in the second aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate one or more embodiments of the present specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present specification. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work. Figure 1 A flowchart of a file processing method provided for one or more embodiments of this specification; Figure 2 A schematic diagram of a permission tree provided for one or more embodiments of this specification; Figure 3 A processing flow chart of a file processing method applied to a first encryption scenario provided by one or more embodiments of this specification; Figure 4 A processing flow chart of a file processing method applied to a second encryption scenario provided by one or more embodiments of this specification; Figure 5 A schematic diagram of a file encryption process provided by one or more embodiments of this specification; Figure 6 A processing flow chart of another file processing method provided for one or more embodiments of this specification; Figure 7 A processing flow chart of a file processing method applied to a first decryption scenario provided by one or more embodiments of this specification; Figure 8 A processing flow chart of a file processing method applied to a second decryption scenario provided by one or more embodiments of this specification; Fig. 9 A flowchart of a file decryption process provided by one or more embodiments of this specification; Fig.10 A schematic diagram of a file processing device provided for one or more embodiments of this specification; Fig.11A schematic diagram of another file processing device provided for one or more embodiments of this specification; Fig.12 A schematic diagram of the structure of a file processing device provided for one or more embodiments of this specification; Fig.13 A schematic diagram of the structure of another file processing device provided for one or more embodiments of this specification. DETAILED DESCRIPTION

[0017] In order to enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the following will be combined with the drawings in one or more embodiments of this specification to clearly and completely describe the technical solutions in one or more embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this document.

[0018] This specification provides a method for processing a file: Reference Figure 1 , which shows a flow chart of a file processing method provided by this embodiment, referring to Figure 3 , which shows a processing flow chart of a file processing method applied to a first encryption scenario provided by this embodiment, referring to Figure 4 , which shows a processing flow chart of a file processing method provided by this embodiment and applied to a second encryption scenario.

[0019] Reference Figure 1 The file processing method provided in this embodiment can be applied to a server of a storage service and / or a cloud storage service, and specifically includes the following steps S102 to S106.

[0020] Step S102, obtaining an encrypted storage request for storing a file at a storage location, and determining a file encryption method and a user key generation method corresponding to the storage location.

[0021] In this embodiment, the storage location refers to the location in the storage space divided according to the function and / or type of each file directory, or the location divided according to the preset function of each file directory. Specifically, the storage location can be a storage location in the cloud storage space. The storage space can be divided into multiple file directories, or multiple file root directories and subdirectories. The file storage party can select the storage location by selecting the file storage directory, that is, the storage location includes the file directory. Optionally, the storage location includes the storage location of the cloud storage service.

[0022] Accordingly, different functions can be set for each file directory in advance, and different file encryption algorithms can be configured for each file directory to increase the functionality of the storage space. Specifically, the file directory can be configured as an exclusive / private file directory, and the files under this directory can only be accessed, viewed and / or edited by the file uploader, and a single-user file encryption method, such as ECC (Elliptic curve cryptography) can be configured for the file directory; or, the file directory can be configured as a shared file directory, and the files under this directory can be accessed, viewed and / or edited by multiple associated users, and different permissions can be configured for multiple associated users, and a multi-user file encryption method, such as ABE (Attribute-Based Encryption) can be configured for the file directory; in addition, a normal file directory can also be set in the storage space, that is, a file directory that stores unencrypted files. Optionally, the storage space and / or storage location is provided by a cloud storage service.

[0023] In actual applications, the file storage party may be a user, or a user of a cloud storage service. The user may pre-set the function and / or type of each file directory in the storage space. For a shared file directory, the user rights of each user may be configured, or the user rights of associated users and associated users may be configured for a shared file, so as to improve the security of the file and the pertinence of subsequent encryption. For this purpose, a permission tree may be configured according to the user rights of each associated user under the shared file directory, or a permission tree may be configured for the user rights of each associated user of a shared file, so as to improve data processing efficiency. In an optional implementation manner provided by this embodiment, before obtaining an encrypted storage request, the following is further included: Obtaining user configuration information submitted by the user for the target storage location and / or the target file, and determining the candidate users included in the user configuration information as the associated users of the target storage location and / or the target file; According to the permission information of each candidate user in the user configuration information, a permission tree of the target storage location and / or the target file is constructed.

[0024] For example, there are two levels of directories in the shared file directory. Three shared users, user A, user B, and user C, are configured for the shared file directory. User A can access all two levels of directories, user B can only access the first level directory, and user C can only access the second level directory. Then the following is generated: Figure 2The permission tree shown. Among them, the non-leaf nodes of the permission tree can represent a threshold gate, and each leaf node of the permission tree can be composed of the unique identifier of the shared user; for the parameters of the nodes in the permission tree, Num_x represents the number of child nodes of the node, k_s represents the threshold value of the node, k_s = Num_x for the AND gate, and 0 < k_s ≤ Num_x for the OR gate, parent(x) represents the parent node of the node, index(x) defines the order between child nodes, and Att(x) represents that the node is a leaf node and is associated with the attribute value of the node.

[0025] In practical applications, the user can also first send the file to be stored to the storage service provider and select the storage location. In this regard, the user can generate an encrypted storage request for the file based on the file data and the target storage location through the terminal device and submit it to the storage service provider; optionally, the encrypted storage request is generated and submitted by the user's terminal device based on the file data and the storage location.

[0026] In specific implementation, the user submits an encrypted storage request to store the file at the storage location through the terminal device. In response to the encrypted storage request, query the preset file encryption method and user key generation method for the file in the storage location for subsequent processing.

[0027] In the specific execution process, the file directory corresponding to the storage location in the encrypted storage request can be queried, and the file encryption method and user key generation method for encrypting the file are determined according to the directory type configured in the file directory. Specifically, if the file directory is an exclusive / private file directory, the file encryption method with single-user permissions and the corresponding user key generation method can be used for encryption. If the file directory is a shared file directory, the file encryption method with multi-user permissions and the corresponding user key generation method can be used for encryption.

[0028] Step S104, generate a file key adapted to the file encryption method, and perform file encryption processing on the file through the file key according to the file encryption method to obtain encrypted file data.

[0029] In this embodiment, files at different storage locations are encrypted through different file encryption methods, and the files are encrypted specifically according to the functions and / or types configured at different storage locations, improving the security of data storage and enhancing the functionality of the storage service.

[0030] In specific implementation, obtain the file key generation method corresponding to the file encryption method, generate a file key through preset parameters according to the file key generation method, and perform file encryption processing on the file through the file key to obtain encrypted file data.

[0031] Specifically, for the encryption method of exclusive / private files in an exclusive / private file directory, a file private key, a file public key and a temporary key can be generated, the file is encrypted by the temporary key, and the temporary key is encrypted by the file private key and / or the file public key; for the encryption method of shared files in a shared file directory, multiple file private keys and file public keys corresponding to each associated user can be generated, and file encryption processing is performed based on the file private key and file public key of each user to obtain multiple encrypted sub-file data.

[0032] In the specific implementation process, encryption parameters and / or system keys for encryption may be generated first, for example, sets of parameters may be set, system keys may be set, and / or data initialization may be performed to improve data processing efficiency. For example, p may be a large prime number, are two cyclic groups of order p, and g is the group The generator of , let e: is a linear map, let H: is a secure one-way hash function that can randomly map attributes to group G. System initialization Setup( ) ,The algorithm can be executed by the storage service provider, where the algorithm inputs security parameters The key strength configured by the system. The storage service provider randomly selects , Represents the length of the unencrypted file, Z is an integer set, is the set of integers less than p, and we get j= , k= , l= , at this time j,k,l , and g, j, k, l are binary position coordinates, m represents the file data before encryption, length(x) represents the size of x, and then calculate ， , and e , and finally generate encryption parameters PK={e, }, and system key MSK={α,β}, PK is made public as the system public key, and MSK is used as the system private key.

[0033] (1) Encryption method of shared files During the specific execution process, different user permissions are configured for each associated user of the file, and a file key for each user can be generated according to the user permissions of each user to improve the pertinence of encryption and enhance the security of the file. In an optional implementation manner provided in this embodiment, generating a file key includes: Obtaining a permission tree configured for the shared file corresponding to the storage location, and querying a node value of each user node in the permission tree; Associating the system key with the user ID of each user to obtain the file private key of each user; The node value corresponding to each user and the file private key are matched to obtain the file public key of each user.

[0034] Specifically, a system key can be obtained and associated with the system key and the user ID of each user to generate a file private key for each user, and then a permission tree configured for the shared file directory corresponding to the storage location can be obtained. The file public key of each user can be obtained by calculating and processing the node value of each user node in the permission tree and the file private key corresponding to each user.

[0035] For example, input the system public key PK, the system private key MSK, and the node value set S of each user in the permission tree = { }, and the user ID of each associated user, are calculated according to the following formula:

[0036]

[0037]

[0038]

[0039]

[0040]

[0041] in, ,(i=1,2,…,k), As each user's private key, As the user public key of each user, and construct the user public key and user private key into a key set SK={ }, perform file encryption based on SK.

[0042] In the specific encryption process, since the permissions of each user are different, the keys used are also different. The encryption process can be performed in sequence according to the file encryption method using the file keys of each user, and the encrypted sub-file data of each user obtained is combined into encrypted file data, thereby improving the pertinence of file encryption, encrypting the file when storing it, and improving data security. In an optional implementation manner provided in this embodiment, file encryption processing is performed, including: The file is encrypted by using the file public key and the file private key to obtain sub-encrypted file data corresponding to each user; The encrypted file data is constructed according to each sub-encrypted file data and the permission tree.

[0043] Specifically, first, the file is encrypted using the file private key to obtain the offline ciphertext corresponding to each user, and then the file is encrypted using the file public key to obtain the online ciphertext corresponding to each user. The encrypted file data is constructed based on the offline ciphertext of each user, the online ciphertext of each user, and the permission tree.

[0044] Using the above example, enter the system public key PK and the permission tree. For each node in the tree, randomly select Polynomial ,in , is the threshold value of the node. Randomly select the secret , for the root node r of the tree, . And for non-leaf nodes, . Then calculate:

[0045]

[0046] where i=(1,2,…, ), y is the child node of the access tree; then the system public key PK and the file data m before encryption are input to generate the complete ciphertext CT, and the file data m is encrypted according to the following formula:

[0047]

[0048] Get the ciphertext CT = {Τ, }.

[0049] (2) Encryption method for exclusive / private files During the specific execution process, the exclusive / private file is only accessible, viewed and / or edited by the file uploader and / or user alone. For this purpose, an encryption polynomial can be set to generate an asymmetric file key through a finite field operation to improve encryption security and data privacy. In an optional implementation manner provided in this embodiment, generating a file key includes: Querying the encryption polynomial of the file encryption method, and performing polynomial calculation based on preset encryption parameters to obtain a file public key and a file private key; Generate a temporary key for file encryption. Optionally, the file key includes a file public key, a file private key and / or a temporary key.

[0050] Specifically, the encryption polynomial preset for the exclusive / private files in the exclusive / private file directory is queried, and the target parameter is selected from the number set of public parameters and / or encryption parameters, the finite field operation corresponding to the encryption polynomial is performed through the target parameter to obtain the operation result, and the operation result is mapped to obtain the asymmetric file key and the file public key.

[0051] For example, to obtain the encryption polynomial E( )= , Finite cyclic group, order is ,and is a prime number, It's a group The generator of For a random positive integer, use a mapping: K: ( )→( ); Among them: Private key , public key ; Among them, the negative element of the finite field is defined as: the negative element of P(x,y) is (x,-ymod )=(x, -y); the addition operation of a finite field is defined as: P( , )+Q( , )=R( , );in , , if P=Q, k= , if P≠Q, k= ; The multiplication of finite fields is defined as: nP(x,y)= , using mapping: ( , ) →( ); Shared elliptic curve encryption asymmetric key, input is a random number , the algorithm input is ( , ), keep it secret As a file private key, public As the file public key, and then according to the symmetric encryption algorithm configured by system parameters and key strength , randomly generate a temporary key .

[0052] In the specific encryption process, the file data can be encrypted by a temporarily generated random key to improve data security; in an optional implementation provided by this embodiment, the file encryption process includes: encrypting the file by the temporary key to obtain the file ciphertext. For example, using a randomly generated temporary key Encrypt the binary content code m corresponding to file F to obtain the ciphertext CT= ( , ).

[0053] Furthermore, after the file is encrypted using the temporary key, encryption processing may be performed on the temporary key, and the stored temporary key may be deleted after encryption is completed, so as to improve the file security and increase the data storage function. Specifically, the temporary key may be encrypted using the file private key. In an optional implementation manner provided by this embodiment, after obtaining the file ciphertext, the following is further included: The temporary key is encrypted by using the file private key to obtain an encryption key, and the file key is updated based on the encryption key.

[0054] Optionally, the file key includes: key data obtained by encrypting the temporary key with the file private key.

[0055] For example, using the system encryption key ,right Encrypt and obtain the key storage file information after system encryption: ( , )),in ( , ) is recorded as .

[0056] Step S106, querying the user authority configured for the storage location, and generating a user key matching the user authority according to the user key generation method.

[0057] This embodiment improves data storage security and file storage functionality by encrypting files stored in a file storage location, and can further configure permissions for users associated with the files, thereby improving the targeted nature of file encryption. On this basis, a user key matching the user's permissions can be generated, and the user's identity and permission information can be verified through the user key during the process of the user decrypting the encrypted file, so as to improve the verification efficiency during the encryption and decryption process and avoid online acquisition from the storage service provider.

[0058] In specific implementation, the user rights of the user associated with the file directory corresponding to the storage location are queried, the user key generation method corresponding to the file encryption method configured in the file directory is queried, and a user key matching the user rights is generated according to the user key generation method.

[0059] Specifically, when the file directory is a shared file directory, multiple user keys for multiple associated users can be generated, and when the file directory is an exclusive / private directory, a user key for a single associated user can be generated. The following describes the two user key generation methods respectively.

[0060] (1) User key generation method corresponding to the shared file In the specific execution process, the original user key of each user associated with the file and / or file directory can be obtained, and the encrypted user key of each user can be obtained by random number encryption. The encrypted user key is associated and mapped according to the node value of the permission tree of each user to obtain the user key of each user, thereby improving the pertinence of the user key and increasing the functionality of file storage. In an optional implementation manner provided in this embodiment, generating a user key includes: Obtain the original key of each user, and encrypt the original key to obtain the encrypted user key; The encrypted user key is associated and mapped through the node value of the node corresponding to each user in the permission tree to obtain the user key of each user.

[0061] For example, the user's original key is key, the user's key salt is salt, and the command is: is a secure one-way hash function that uses the mapping: :Hash(key,salt)→ , generate user keys. This algorithm can be executed by the user terminal. The algorithm input is (key, salt), where key is the user key, which is kept secret by the user, and salt is the user key salt. The server randomly generates the corresponding key salt for each user when the user initializes it, and binds it to the user. Before the user uses it, it is obtained from the cloud storage service according to the user name. , get user and use it as the public key ,generate , the algorithm is executed by the cloud disk. For offline attribute verification attribute-based encryption, the mapping is used: , the permission tree in this mapping, the attributes owned by the user Reserved, this user does not have Set to empty, get the user storage key and Append to the end of the key block after public key encryption.

[0062] (2) User key generation method for exclusive / private files During the specific execution process, the exclusive / private file is only accessible, viewable and / or editable to the file uploader. To this end, the user's original key may be encrypted and bound to the user so that the user's identity can be verified through the user key. In an optional implementation manner provided in this embodiment, generating the user key includes: Obtain the original key of each user, and encrypt the original key with a random number to obtain the user key.

[0063] For example, the user's original key is key, the user's key salt is salt, and the command is: is a secure one-way hash function that uses the mapping: :Hash(key,salt)→ Generate user keys. This algorithm can be executed by the user terminal. The algorithm input is (key, salt). The key is the user key, which is kept secret by the user. Salt is the user key salt. When the user initializes the cloud disk, the cloud disk randomly generates the corresponding key salt for each user and binds it to the user. Before using it, the user obtains it from the cloud storage service according to the user name, and then obtains the secret key in the above example. , using mapping: = Get the user key and Append to the end of the key block after public key encryption. You can also map: Get the user key and Append to the end of the key block after public key encryption.

[0064] In actual applications, the encrypted file data, file keys, user keys and / or other parameter information obtained during the encryption process can also be packaged into an encrypted data set and stored, so that the encrypted data set can be obtained when the user downloads it, thereby realizing offline identity verification, key verification and key decryption, avoiding the online verification process, improving data processing efficiency, and enhancing file security while increasing convenience; an optional implementation manner provided by this embodiment also includes: constructing an encrypted data set of the file based on the encrypted file data, the file key and the user key and storing it.

[0065] For example, the encrypted file data and the encrypted content encoding ciphertext are encapsulated to form the data structure of the encrypted file package as shown in Table 1: Table 1

[0066] In actual applications, the authorization of user rights can also be cancelled. Specifically, the user key corresponding to the user can be deleted so that the user cannot pass the key verification when decrypting. For example, to obtain the current logged-in user key of the user: ( ), in the key block encrypted by the user key, through If the match is consistent, find the corresponding key encryption result ( ), which is deleted in the key block after the user key is encrypted ( ).

[0067] In summary, the one or more file processing methods provided in this embodiment, during the file encryption process, respond to an encrypted storage request for file storage at a storage location, determine the file encryption method and user key generation method corresponding to the storage location, generate a file key corresponding to the file encryption method, and perform file encryption processing using the file key according to the file encryption method to obtain encrypted file data, determine the file encryption method through the file storage location, quickly and stably determine the encryption strategy, and improve the encryption efficiency, then query the user permissions configured for the storage location, generate a user key matching the user permissions according to the key generation method, and represent the user's file access permissions through the generated user key, so that permission verification can also be performed in offline scenarios, thereby improving the security of file encryption, and through the joint use of the file key and the user key, the encryption efficiency is improved while improving the security of the file.

[0068] The following combination Figure 3 , taking the application of the file processing method provided by this embodiment in the first encryption scenario as an example, the file processing method provided by this embodiment is further described. Figure 3 The file processing method applied to the first encryption scenario specifically includes steps S302 to S314.

[0069] Step S302: obtaining an encrypted storage request for storing files in a shared file directory at a storage location, and determining a file encryption method and a user key generation method corresponding to the shared file directory.

[0070] Step S304, obtaining a permission tree configured for the shared file directory, and querying the node value of each user node in the permission tree.

[0071] Step S306: Associating the system key with the user identification of each user to obtain the file private key of each user.

[0072] Step S308: Match the node value and file private key corresponding to each user to obtain the file public key of each user.

[0073] Step S310: encrypt the file using the file public key and the file private key according to the file encryption method to obtain sub-encrypted file data corresponding to each user.

[0074] Step S312, constructing encrypted file data according to each sub-encrypted file data and the permission tree.

[0075] Step S314, determining the user authority of each user according to the authority tree, and generating a user key for each user according to the user key generation method.

[0076] Furthermore, after step S314 is executed, it may also include: constructing and storing an encrypted data set of the file based on the encrypted file data, the file public key, the file private key and the user key.

[0077] It should be noted that any one of steps S302 to S314 or a combination of any multiple steps can be selected from steps S102 to S106 to form a new implementation method according to the needs of implementation deployment; and any one or multiple technical features in the technical scheme composed of steps S302 to S314 can be selected from steps S102 to S106 to form a new implementation method according to the needs of actual deployment, or the technical features in one or more optional implementation methods provided by steps S102 to S106 can be selected to form a new implementation method, which will not be described one by one here.

[0078] The following combination Figure 4 , taking the application of the file processing method provided by this embodiment in the first encryption scenario as an example, the file processing method provided by this embodiment is further described. Figure 4 The file processing method applied to the second encryption scenario specifically includes steps S402 to S412.

[0079] Step S402: obtaining an encrypted storage request for storing files in a private file directory at a storage location, and determining a file encryption method for the private file directory and a user key generation method.

[0080] Step S404, query the encryption polynomial configured for the private file directory, and perform polynomial calculation based on preset encryption parameters to obtain the file public key and the file private key.

[0081] Step S406, generating a temporary key for encrypting the file, and encrypting the file using the temporary key to obtain the file ciphertext.

[0082] Step S408: encrypt the temporary key using the file key to obtain key data, and use the key data as the file key.

[0083] Step S410, encrypt the user's original key to obtain the user's key.

[0084] Step S412: construct an encrypted data set of the file based on the file ciphertext, the file public key, the file private key and the user key and store it.

[0085] It should be noted that any one of steps S402 to S412 or any combination of multiple steps can be combined into a new implementation method by selecting any one of steps S102 to S106 as the above according to the needs of implementation and deployment; and any one or multiple technical features in the technical scheme composed of steps S402 to S412 can be combined into a new implementation method by selecting any one of the technical features in the technical scheme composed of steps S102 to S106 as the above according to the needs of actual deployment, or the technical features in one or more optional implementation methods provided by steps S102 to S106 can be combined into a new implementation method, which will not be elaborated here one by one.

[0086] It should also be noted that the file processing method provided above can also refer to Figure 5 The specific implementation method is carried out by referring to the embodiment of one or more file processing methods provided above, which will not be described in detail here.

[0087] Another file processing method embodiment provided in this specification: Reference Figure 6 , which shows a processing flow chart of another file processing method provided by this embodiment. Another file processing method provided by this embodiment can be applied to the user's terminal device, specifically including the following steps S602 to S608, refer to Figure 7 , which shows a processing flow chart of a file processing method applied to the first decryption scenario provided by this embodiment, referring to Figure 8 , which shows a processing flow chart of a file processing method provided by this embodiment and applied to the second decryption scenario.

[0088] Step S602: parse the encrypted data set of the acquired file to obtain encrypted file data and key data, and determine a file decryption method for the encrypted file data.

[0089] In specific implementation, an encrypted data set of the file is obtained, the encrypted data set is parsed to obtain encrypted file data, key data and / or encryption parameter information, and a file decryption method for the encrypted file data is determined according to the parsing result of the encrypted data set.

[0090] In actual applications, files can be obtained through a variety of channels, such as direct download and / or user forwarding; for this purpose, users can download encrypted data sets of files from cloud storage services and / or storage services, and can also obtain encrypted data sets forwarded and / or transmitted by other users. Cloud storage services and / or storage services provide encrypted file data to each user, which improves the security of files. At the same time, offline decryption is realized through encrypted data sets, which improves data processing efficiency.

[0091] In the specific execution process, the file type of the file can be obtained by parsing the encrypted data set, and the corresponding file decryption method can be determined according to the file type; in an optional implementation manner provided in this embodiment, determining the file decryption method includes: Extracting the file type contained in the encrypted data set, and searching for a file encryption method matching the file type; A decryption method adapted to the file encryption method is determined as the file decryption method.

[0092] Specifically, the encrypted data set can store the file header corresponding to the file type, and the file type of the file can be determined based on the file header. When the file type is a shared file type, the file decryption method corresponding to the shared file type is determined; when the file type is an exclusive / private file type, the file decryption method corresponding to the exclusive / private file type is determined.

[0093] For example, when the file type is a shared file type, the decryption method corresponding to ABE (Attribute-Based Encryption) is used as the file decryption method; when the file type is an exclusive / private file type, the decryption method corresponding to ECC (Elliptic curve cryptography) is used as the file decryption method.

[0094] Step S604: parse the key data according to the key parameters to obtain a file key and a user key.

[0095] In a specific implementation, the key data is parsed according to the key parameters corresponding to the determined file decryption method to obtain a file key for decrypting the file and a user key for verifying the user identity and / or user authority.

[0096] Specifically, the key data may be parsed according to the key strength of the encryption method corresponding to the file type to obtain the first key data corresponding to the user key and the second key data corresponding to the file key. The following describes the decryption methods corresponding to the two file types respectively.

[0097] (1) Shared file type In the specific implementation process, the second key data can be determined as the file key, the first key data can be decrypted according to the user private key and the file key stored by the user to obtain the user keys containing multiple users, and the user key of the user can be screened out from each user key according to the user identifier. Key verification, authority verification and / or user verification can be performed offline.

[0098] (2) Exclusive / private file types In the specific execution process, the first key data may be parsed according to the user private key stored by the user to obtain the user key, and the remaining key data may be determined as the file key. The user's file key may be queried in the storage service and / or cloud storage service according to the user identifier, and the second key data may be decrypted according to the file key to obtain a temporary key for file encryption. In an optional implementation manner provided in this embodiment, the file key may be obtained in the following manner: Querying the user's file private key according to the user identifier, and decrypting the file key using the file private key and the file public key of the file to obtain a temporary key; The temporary key is used as the file key to perform file decryption processing.

[0099] Step S606: decrypt the encrypted file data using the file key according to the file decryption method to obtain the file data of the file.

[0100] In specific implementation, the encrypted file data is decrypted using the file key according to the file decryption method corresponding to the file type to obtain the file data of the file. Specifically, for shared files, the sub-file data of each user can be decrypted, and the file data is constructed based on the sub-file data. For private files, the file data of the file can be decrypted.

[0101] (1) Shared files In the specific execution process, the encrypted file data of the shared file contains data such as permission information of multiple users. After the encrypted file data is decrypted by the file key, the obtained sub-file data of each user is used as the file data. In an optional implementation manner provided by this embodiment, the file decryption includes: Decrypting the encrypted file data using the file private key and file public key of each user in the file key to obtain the sub-file data of each user; The sub-file data is used as the file data.

[0102] For example, the following calculation is performed based on the node value of each node in the file's permission tree, the system public key PK, the file ciphertext CT, and the file public key SK:

[0103]

[0104]

[0105]

[0106] For the child node y of node x, the user needs to save the output Indicates that the key is correct, is a set of any child nodes of x, and the element size in the set is ,and If such a set does not exist, the algorithm stops and outputs , which means that node x cannot satisfy the access structure. Otherwise, the data user can calculate it using the Lagrange interpolation method:

[0107]

[0108]

[0109]

[0110]

[0111] where i=index(y), . Using the above formula, we can recursively calculate from bottom to top in the access tree to get the value contained in the root node r: ; Then perform the pairing operation as follows:

[0112] Finally, it is calculated according to the following formula:

[0113]

[0114] Get file data.

[0115] (2) Exclusive / private files In the specific execution process, after decrypting the temporary key used to encrypt the file, the file is decrypted using the file decryption method corresponding to the exclusive / private file. For example, based on the current user's public and private keys: ), in the key block encrypted by the user's public key, find the corresponding public key encryption result ( ), and use Decrypt and decrypt to get the original file = .

[0116] Step S608: Filter out target file data that matches the user authority corresponding to the user key from the file data.

[0117] In the specific implementation, the key of the decryption user is first verified based on the user key, that is, the identity verification process is performed. After the verification, the user's access, viewing and / or editing permissions are verified, and the target file data that matches the user's permissions is selected from the file data for the user to access, view and / or edit.

[0118] In the specific execution process, for shared files, target file data that matches the user permissions can be screened out from the file data according to the user permissions of different users. For example, the file data of the files in the secondary directory is used as the target file data. Specifically, the user permissions can be determined according to the file key and the permission tree; for example, according to the file key PK and the permission tree: = At this time, the permission tree will have the attributes owned by the user Reserved, this user does not have Leave it empty.

[0119] In addition, for exclusive / private files, the user identity can be verified by the user key, and the file can be saved after the verification is passed. That is, step S608 can be omitted and replaced by the following between step S604 and step S606: verify the user identity according to the user key, and execute step S606 after the verification is passed.

[0120] To summarize, the one or more file processing methods provided in the present embodiment obtain an encrypted data set of a file during a file decryption process, parse the encrypted data set to obtain encrypted file data and key data, determine a file decryption method corresponding to the encrypted file data, parse the key data according to key parameters to obtain a file key and a user key, decrypt the encrypted file data using the file key according to the file decryption method to obtain the file data of the file, determine the file decryption method using the data in the encrypted data set, and realize decryption in an offline state, thereby improving the decryption processing efficiency and adding the offline function of the decryption processing, and then screen out target file data that matches the user authority corresponding to the user key from the file data, and by using the user key and the file key together, improve the security of file decryption and improve the file decryption efficiency at the same time.

[0121] It should be noted that the file processing method provided in the above embodiment can be applied to a user terminal, and another file processing method provided in this embodiment can be applied to a server. The file processing method provided in this embodiment and can be applied to a server and the file processing method provided in the above embodiment and can be applied to a user terminal have a coordination relationship during the execution process. Therefore, when reading this embodiment, you can refer to the relevant content of the above embodiment. The relevant content of this embodiment is similar to the relevant content of the above embodiment, and this embodiment will not be repeated here.

[0122] The following combination Figure 7 , taking the application of the file processing method provided by this embodiment in the first decryption scenario as an example, the file processing method provided by this embodiment is further described. Figure 7 The file processing method applied to the first decryption scenario specifically includes steps S702 to S714.

[0123] Step S702: Obtain an encrypted data set of the file.

[0124] Step S704: parse the encrypted data set to obtain encrypted file data and key data.

[0125] Step S706: extract the shared file type contained in the encrypted data set, and use the decryption method corresponding to the shared file type as the file decryption method.

[0126] Step S708: extract the file key contained in the encrypted data set, and decrypt the key data based on the file key to obtain the user key of each user.

[0127] Step S710: determining the user key of the user according to the user identification.

[0128] Step S712: decrypt the encrypted file data using the file key in a file decryption manner to obtain the file data.

[0129] Step S714: Filter out target file data that matches the user authority corresponding to the user key from the file data.

[0130] It should be noted that any one of steps S702 to S714 or a combination of any multiple steps can be selected from steps S602 to S608 to form a new implementation method according to the needs of implementation deployment; and any one or multiple technical features in the technical scheme composed of steps S702 to S714 can be selected from steps S602 to S608 to form a new implementation method according to the needs of actual deployment, or the technical features in one or more optional implementation methods provided by steps S602 to S608 can be selected to form a new implementation method, which will not be described one by one here.

[0131] The following combination Figure 8 , taking the application of the file processing method provided by this embodiment in the first encryption scenario as an example, the file processing method provided by this embodiment is further described. Figure 8 The file processing method applied to the first encryption scenario specifically includes steps S802 to S812.

[0132] Step S802: Obtain an encrypted data set of the file, and parse the encrypted data set to obtain encrypted file data and key data.

[0133] Step S804: extract the private file type contained in the encrypted data set, and use the decryption method corresponding to the private file type as the file decryption method.

[0134] Step S806: query the user's file public key and file private key in the storage service and / or cloud storage service, and decrypt the key data according to the file public key and file private key to obtain the file key and user key.

[0135] Step S808, verifying the user identity according to the user key; If the verification is passed, execute step S810 to step S812; If the verification fails, no action will be taken.

[0136] Step S810: decrypt the file key according to the file private key to obtain a temporary key.

[0137] Step S812: decrypt the encrypted file data using the temporary key in a file decryption manner to obtain the file data of the file.

[0138] It should be noted that any one of steps S802 to S812 or any combination of multiple steps can be selected from steps S602 to S608 to form a new implementation method according to the needs of implementation deployment; and any one or multiple technical features in the technical scheme composed of steps S802 to S812 can be selected from steps S602 to S608 to form a new implementation method according to the needs of actual deployment, or the technical features in one or more optional implementation methods provided by steps S602 to S608 can be selected to form a new implementation method, which will not be described one by one here.

[0139] It should be noted that the file processing method provided above can also refer to Fig. 9 The specific implementation method is carried out by referring to one or more embodiments of another file processing method provided above, which will not be described in detail here.

[0140] Fig.10 A schematic diagram of a file processing device provided by an embodiment of the present invention is shown in FIG. Fig.10 As shown, the device comprises: The encryption method determination module 1002 is used to obtain an encryption storage request for storing a file at a storage location, and determine a file encryption method and a user key generation method corresponding to the storage location; The file encryption module 1004 is used to generate a file key adapted to the file encryption method, and perform file encryption processing using the file key according to the file encryption method to obtain encrypted file data; The key generation module 1006 is used to query the user authority configured for the storage location and generate a user key matching the user authority according to the user key generation method.

[0141] A file processing device provided by this embodiment, during the file encryption process, first runs an encryption method determination module 1002 in response to an encryption storage request for file storage at a storage location, determines the file encryption method and user key generation method corresponding to the storage location, then runs a file encryption module 1004 to generate a file key corresponding to the file encryption method, and performs file encryption processing according to the file encryption method using the file key to obtain encrypted file data, determines the file encryption method according to the file storage location, quickly and stably determines the encryption strategy, and improves the encryption efficiency, then runs a key generation module 1006 to query the user rights configured for the storage location, generates a user key matching the user rights according to the key generation method, and represents the user's file access rights through the generated user key, so that permission verification can also be performed in offline scenarios, thereby improving the security of file encryption, and through the joint use of the file key and the user key, the encryption efficiency is improved while improving the security of the file.

[0142] The file processing device provided in one embodiment of the present specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0143] Fig.11 A schematic diagram of another file processing device provided by an embodiment of the present invention is shown in FIG. Fig.11 As shown, the device comprises: The decryption method determination module 1102 is used to parse the encrypted data set of the acquired file to obtain the encrypted file data and key data, and determine the file decryption method of the encrypted file data; The key data parsing module 1104 is used to parse the key data according to the key parameters in the encrypted data to obtain a file key and a user key; A file decryption module 1106, configured to decrypt the encrypted file data using the file key in accordance with the file decryption method to obtain the file data of the file; The file data screening module 1108 is used to screen out target file data that matches the user authority corresponding to the user key from the file data.

[0144] Another file processing device provided by this embodiment, during the file decryption process, first runs the decryption method determination module 1102 to obtain the encrypted data set of the file, parses the encrypted data set to obtain the encrypted file data and key data, determines the file decryption method corresponding to the encrypted file data, and then runs the key data parsing module 1104 to parse the key data according to the key parameters to obtain the file key and the user key, runs the file decryption module 1106 to decrypt the encrypted file data according to the file decryption method using the file key to obtain the file data of the file, determines the file decryption method based on the data in the encrypted data set, realizes decryption in an offline state, improves the decryption processing efficiency, and adds the offline function of the decryption processing, and then runs the file data screening module 1108 to screen out the target file data that matches the user authority corresponding to the user key in the file data, and through the joint use of the user key and the file key, improves the security of file decryption and improves the file decryption efficiency.

[0145] Another file processing device provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0146] Furthermore, an embodiment of the present specification also provides a file processing device, Fig.12 A schematic diagram of a file processing device provided in an embodiment of the present specification is shown in FIG. Fig.12 As shown, the device includes: a memory 1201, a processor 1202, a bus 1203 and a communication interface 1204. The memory 1201, the processor 1202 and the communication interface 1204 communicate through the bus 1203, and the communication interface 1204 may include an input and output interface, which includes but is not limited to a keyboard, a mouse, a display, a microphone, a loudspeaker, etc.

[0147] Fig.12 In the embodiment, the memory 1201 stores computer executable instructions that can be run on the processor 1202, and when the computer executable instructions are executed by the processor 1202, the following process is implemented: Obtain an encrypted storage request for storing a file at a storage location, and determine a file encryption method and a user key generation method corresponding to the storage location; Generate a file key suitable for the file encryption method, and perform file encryption processing using the file key according to the file encryption method to obtain encrypted file data; The user authority configured for the storage location is queried, and a user key matching the user authority is generated according to the user key generation method.

[0148] The file processing device provided in this embodiment, through the cooperation of the memory 1201, the processor 1202, the bus 1203 and the communication interface 1204, in the file encryption process, responds to the encryption storage request for file storage at the storage location, determines the file encryption method and the user key generation method corresponding to the storage location, generates a file key corresponding to the file encryption method, and performs file encryption processing according to the file encryption method using the file key to obtain encrypted file data, determines the file encryption method through the file storage location, quickly and stably determines the encryption strategy, improves the encryption efficiency, and then queries the user rights configured for the storage location, generates a user key matching the user rights according to the key generation method, and represents the user's file access rights through the generated user key, so that the authority verification can also be performed in offline scenarios, thereby improving the security of file encryption, and through the joint use of the file key and the user key, the encryption efficiency is improved while improving the security of the file.

[0149] The file processing device provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0150] Furthermore, an embodiment of the present specification also provides another file processing device, Fig.13 A schematic diagram of the structure of another file processing device provided in an embodiment of this specification, such as Fig.13 As shown, the device includes: a memory 1301, a processor 1302, a bus 1303 and a communication interface 1304. The memory 1301, the processor 1302 and the communication interface 1304 communicate through the bus 1303, and the communication interface 1304 may include an input and output interface, which includes but is not limited to a keyboard, a mouse, a display, a microphone, a loudspeaker, etc.

[0151] Fig.13 In the embodiment, the memory 1301 stores computer executable instructions that can be run on the processor 1302, and when the computer executable instructions are executed by the processor 1302, the following process is implemented: Parsing the encrypted data set of the acquired file to obtain encrypted file data and key data, and determining a file decryption method for the encrypted file data; Parsing the key data according to the key parameters in the encrypted data set to obtain a file key and a user key; Decrypting the encrypted file data using the file key in accordance with the file decryption method to obtain the file data of the file; Target file data matching the user authority corresponding to the user key is screened out from the file data.

[0152] Another file processing device provided by this embodiment, through the cooperation of the memory 1301, the processor 1302, the bus 1303 and the communication interface 1304, obtains the encrypted data set of the file during the file decryption process, parses the encrypted data set to obtain the encrypted file data and the key data, determines the file decryption method corresponding to the encrypted file data, parses the key data according to the key parameters to obtain the file key and the user key, decrypts the encrypted file data according to the file decryption method by using the file key to obtain the file data of the file, determines the file decryption method by using the data in the encrypted data set, realizes decryption in an offline state, improves the decryption processing efficiency, and adds the offline function of the decryption processing, and then screens out the target file data that matches the user authority corresponding to the user key in the file data, and through the joint use of the user key and the file key, improves the security of file decryption and improves the file decryption efficiency.

[0153] The file processing device provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0154] Furthermore, another embodiment of the present specification provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the following process is implemented: Obtain an encrypted storage request for storing a file at a storage location, and determine a file encryption method and a user key generation method corresponding to the storage location; Generate a file key suitable for the file encryption method, and perform file encryption processing using the file key according to the file encryption method to obtain encrypted file data; The user authority configured for the storage location is queried, and a user key matching the user authority is generated according to the user key generation method.

[0155] The computer-readable storage medium provided in this embodiment, during the file encryption process, responds to an encrypted storage request for storing a file at a storage location, determines a file encryption method and a user key generation method corresponding to the storage location, generates a file key corresponding to the file encryption method, and performs file encryption processing using the file key in accordance with the file encryption method to obtain encrypted file data, determines the file encryption method through the file storage location, quickly and stably determines the encryption strategy, and improves encryption efficiency, then queries the user rights configured for the storage location, generates a user key matching the user rights according to the key generation method, and represents the user's file access rights through the generated user key, so that permission verification can also be performed in offline scenarios, thereby improving the security of file encryption, and through the joint use of the file key and the user key, the encryption efficiency is improved while improving the security of the file.

[0156] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0157] The computer-readable storage medium provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0158] Furthermore, another embodiment of the present specification provides another computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the following process is implemented: Parsing the encrypted data set of the acquired file to obtain encrypted file data and key data, and determining a file decryption method for the encrypted file data; Parsing the key data according to the key parameters in the encrypted data set to obtain a file key and a user key; Decrypting the encrypted file data using the file key in accordance with the file decryption method to obtain the file data of the file; Target file data matching the user authority corresponding to the user key is screened out from the file data.

[0159] Another computer-readable storage medium provided by the present embodiment obtains an encrypted data set of the file during a file decryption process, parses the encrypted data set to obtain encrypted file data and key data, determines a file decryption method corresponding to the encrypted file data, parses the key data according to key parameters to obtain a file key and a user key, decrypts the encrypted file data using the file key according to the file decryption method to obtain the file data of the file, determines the file decryption method using the data in the encrypted data set, implements decryption in an offline state, improves the decryption processing efficiency, and adds the offline function of the decryption processing, then screens out target file data that matches the user authority corresponding to the user key from the file data, and uses the user key and the file key together to improve the security of file decryption and the efficiency of file decryption.

[0160] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0161] The computer-readable storage medium provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0162] Furthermore, another embodiment of the present specification also provides a computer program product, which implements the following process when executed by a processor: Obtain an encrypted storage request for storing a file at a storage location, and determine a file encryption method and a user key generation method corresponding to the storage location; Generate a file key suitable for the file encryption method, and perform file encryption processing using the file key according to the file encryption method to obtain encrypted file data; The user authority configured for the storage location is queried, and a user key matching the user authority is generated according to the user key generation method.

[0163] The computer program product provided by the present embodiment, during the file encryption process, responds to an encrypted storage request for storing a file at a storage location, determines a file encryption method and a user key generation method corresponding to the storage location, generates a file key corresponding to the file encryption method, and performs file encryption processing using the file key in accordance with the file encryption method to obtain encrypted file data, determines the file encryption method through the file storage location, quickly and stably determines the encryption strategy, and improves encryption efficiency, then queries the user rights configured for the storage location, generates a user key matching the user rights according to the key generation method, and represents the user's file access rights through the generated user key, so that permission verification can also be performed in offline scenarios, thereby improving the security of file encryption, and through the joint use of the file key and the user key, the encryption efficiency is improved while improving the security of the file.

[0164] The computer program product provided in one embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0165] Furthermore, another embodiment of the present specification provides another computer program product, which implements the following process when executed by a processor: Parsing the encrypted data set of the acquired file to obtain encrypted file data and key data, and determining a file decryption method for the encrypted file data; Parsing the key data according to the key parameters in the encrypted data set to obtain a file key and a user key; Decrypting the encrypted file data using the file key in accordance with the file decryption method to obtain the file data of the file; Target file data matching the user authority corresponding to the user key is screened out from the file data.

[0166] Another computer program product provided by this embodiment obtains an encrypted data set of the file during a file decryption process, parses the encrypted data set to obtain encrypted file data and key data, determines a file decryption method corresponding to the encrypted file data, parses the key data according to key parameters to obtain a file key and a user key, decrypts the encrypted file data using the file key according to the file decryption method to obtain the file data of the file, determines the file decryption method using the data in the encrypted data set, implements decryption in an offline state, improves the decryption processing efficiency, and adds the offline function of the decryption processing, then screens out target file data that matches the user authority corresponding to the user key from the file data, and uses the user key and the file key together to improve the security of file decryption and the efficiency of file decryption.

[0167] Another computer program product provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0168] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0169] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0170] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0171] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0172] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0173] Memory may include non-permanent storage in a computer-readable storage medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable storage medium.

[0174] Computer-readable storage media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer-readable storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable storage media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0175] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0176] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0177] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A file processing method, characterized in that: The method comprises: Obtain an encrypted storage request for storing a file at a storage location, and determine a file encryption method and a user key generation method corresponding to the storage location; Generate a file key suitable for the file encryption method, and perform file encryption processing using the file key according to the file encryption method to obtain encrypted file data; The user authority configured for the storage location is queried, and a user key matching the user authority is generated according to the user key generation method.

2. The file processing method according to claim 1, characterized in that: The generating of a file key adapted to the file encryption method comprises: Obtaining a permission tree configured for the shared file at the storage location, and querying a node value of each user node in the permission tree; Associating the system key with the user ID of each user to obtain the file private key of each user; The node value corresponding to each user and the file private key are matched and calculated to obtain the file public key of each user.

3. The file processing method according to claim 2, characterized in that: The step of performing file encryption processing by using the file key in accordance with the file encryption method to obtain encrypted file data includes: The file is encrypted by using the file public key and the file private key to obtain sub-encrypted file data corresponding to each user; The encrypted file data is constructed according to each sub-encrypted file data and the permission tree.

4. The file processing method according to claim 1, characterized in that: The generating of a file key adapted to the file encryption method comprises: Querying the encryption polynomial configured for the storage location, and performing polynomial calculation based on preset encryption parameters to obtain a file public key and a file private key; Generate a temporary key for file encryption.

5. The file processing method according to claim 4, characterized in that: The step of performing file encryption processing by using the file key in accordance with the file encryption method to obtain encrypted file data includes: Encrypt the file using the temporary key to obtain a ciphertext of the file; Correspondingly, after encrypting the file by using the temporary key to obtain the ciphertext of the file, the method further includes: The temporary key is encrypted by using the file private key to obtain an encryption key, and the file key is updated based on the encryption key.

6. The file processing method according to claim 1, characterized in that: After querying the user authority configured for the storage location and generating a user key matching the user authority according to the user key generation method, the method further includes: An encrypted data set of the file is constructed and stored based on the encrypted file data, the file key and the user key.

7. A file processing method, characterized in that: The method comprises: Parsing the encrypted data set of the acquired file to obtain encrypted file data and key data, and determining a file decryption method for the encrypted file data; Parsing the key data according to the key parameters in the encrypted data set to obtain a file key and a user key; Decrypting the encrypted file data using the file key in accordance with the file decryption method to obtain the file data of the file; Target file data matching the user authority corresponding to the user key is screened out from the file data.

8. The file processing method according to claim 7, characterized in that: The determining of the file decryption method of the encrypted file data includes: Extracting the file type contained in the encrypted data set, and searching for a file encryption method matching the file type; A decryption method adapted to the file encryption method is determined as the file decryption method.

9. The file processing method according to claim 7, characterized in that: Decrypting the encrypted file data using the file key according to the file decryption method to obtain the file data of the file includes: Decrypting the encrypted file data using the file private key and file public key of each user in the file key to obtain the sub-file data of each user; The sub-file data is used as the file data.

10. The file processing method according to claim 7, characterized in that: The file key is obtained in the following way: Querying the user's file private key according to the user identifier, and decrypting the file key using the file private key and the file public key of the file to obtain a temporary key; The temporary key is used as the file key to perform file decryption processing.

11. A file processing device, characterized in that: The device comprises: An encryption method determination module is used to obtain an encrypted storage request for storing a file at a storage location, and determine a file encryption method and a user key generation method corresponding to the storage location; A file encryption module, used to generate a file key adapted to the file encryption method, and perform file encryption processing using the file key according to the file encryption method to obtain encrypted file data; The key generation module is used to query the user authority configured for the storage location and generate a user key matching the user authority according to the user key generation method.

12. A file processing device, characterized in that: The device comprises: A decryption method determination module, used to parse the encrypted data set of the acquired file to obtain the encrypted file data and key data, and determine the file decryption method of the encrypted file data; A key data parsing module, used to parse the key data according to the key parameters in the encrypted data set to obtain a file key and a user key; A file decryption module, used to decrypt the encrypted file data using the file key according to the file decryption method to obtain the file data of the file; The file data screening module is used to screen out target file data that matches the user authority corresponding to the user key from the file data.

13. A file processing device, characterized in that: The device includes a memory and a processor, wherein the memory stores computer executable instructions, and when the computer executable instructions are executed on the processor, the steps of the file processing method described in any one of claims 1 to 6 or 7 to 10 can be implemented.

14. A computer-readable storage medium having computer-executable instructions stored therein, characterized in that: When the computer executable instructions are executed by a processor, the steps of the file processing method described in any one of claims 1-6 or 7-10 can be implemented.

15. A computer program product, characterized in that The computer program product includes a file processing program, and when the file processing program is executed by a processor, it can implement the steps of the file processing method described in any one of claims 1-6 or 7-10.

Images