File security storage method, electronic equipment and storage medium

Abstract

The invention discloses a file security storage method, electronic equipment and a storage medium, and the method comprises the steps: extracting to-be-stored file data information, and obtaining file basic information and a file relative path set; generating a master key and a file key, configuring file storage information for the to-be-stored file data information, and taking the file basic information, the file key and the file storage information as file attribute information; encrypting the master key and the file relative path set to obtain a first ciphertext; encrypting the file attribute information by using the master key to obtain a second ciphertext; encrypting the file data information by using the file key to obtain a third ciphertext; and separately storing the first ciphertext, the second ciphertext and the third ciphertext, and configuring the third ciphertext into a component container for storage according to the file storage information. According to the method, a large number of files can be stored, meanwhile, the files are subjected to security encryption and verification to ensure the security and reliability of data, the storage speed is increased, and file information can be conveniently and rapidly looked up.

Description

Technical Field

[0001] The present invention relates to the field of secure file storage, and in particular to a secure file storage method, electronic equipment and storage medium. Background Art

[0002] With the development of information technology, more and more electronic devices such as computers and mobile phones are used, and the file data stored in these electronic devices is increasing. At the same time, the attacks on the files stored in these electronic devices are increasing. It is particularly important to improve the security of file storage and to quickly access the stored data.

[0003] When a large number of files need to be stored without modification, it is particularly important to store these files safely, reduce storage time, and prevent them from being stolen. The existing file security storage technology has the following problems:

[0004] 1. Existing data related to file attributes is often not encrypted, and this information is easily leaked.

[0005] 2. Most existing file storage is performed in blocks, which easily leads to a waste of storage space.

[0006] 3. The process of encrypting and storing a large number of files takes a long time. Summary of the invention

[0007] The main purpose of the present invention is to overcome the above-mentioned defects in the prior art and to propose a file security storage method, electronic device and storage medium, which can store a large number of files, and at the same time securely encrypt and verify the files to ensure the security and reliability of the data, improve the storage speed, and facilitate quick access to file information.

[0008] The present invention adopts the following technical solution:

[0009] A method for storing files securely, comprising:

[0010] Extract the file data information to be stored to obtain the basic file information and the file relative path set;

[0011] Generate a master key and a file key, configure file storage information for the file data information to be stored, and use the file basic information, the file key and the file storage information as file attribute information;

[0012] Encrypting the master key and the file relative path set to obtain a first ciphertext; using the master key to encrypt the file attribute information to obtain a second ciphertext; using the file key to encrypt the file data information to obtain a third ciphertext;

[0013] The first ciphertext, the second ciphertext and the third ciphertext are stored separately, and the third ciphertext is stored in a component container according to the file storage information configuration.

[0014] Furthermore, the file data information to be stored is extracted to obtain a file relative path, the file relative path is decomposed and added to a file relative path set, the id value of the file relative path in the file relative path set is obtained, and the id value of the file relative path is added to the file basic information.

[0015] Furthermore, a random master key is generated, and a check value of the master key is generated based on the master key; the master key and its check value are encrypted using an external input key to obtain ciphertext data of the master key and its check value, and the file relative path set is encrypted using the master key to obtain ciphertext data of the file relative path set, and the master key and its check value ciphertext data and the file relative path set ciphertext data constitute the first ciphertext.

[0016] Furthermore, a corresponding number of file keys are generated according to the number of files of the file data information to be stored, and a corresponding check value is generated according to the file key; the file data information is pre-processed into a number of data blocks, and then the file key is used to encrypt the data blocks to obtain a third ciphertext.

[0017] Further, the file data information is pre-processed into a plurality of data blocks, and then the plurality of data blocks are encrypted with the file key to obtain a third ciphertext, which specifically includes the following: the file data is divided into a plurality of data blocks according to a set number of bytes, and the following judgments and processing are performed respectively:

[0018] When the size of the data block is 0, no encryption is performed;

[0019] When the size of the data block is less than the set number of bytes and greater than 0, the size of the data block is padded to the set number of bytes by filling with random values;

[0020] When the size of the data block is larger than the set number of bytes and is not a multiple of the set number of bytes, retaining the data block whose tail is not a multiple of the set number of bytes;

[0021] A data block whose size is a multiple of the set number of bytes is encrypted to obtain a ciphertext, a data block whose tail is not a multiple of the set number of bytes is spliced ​​to the tail of the ciphertext, and the last set number of bytes in the tail of the ciphertext is encrypted and then overwritten, and the check value of the data block is calculated during the encryption process.

[0022] Further, the third ciphertext is configured to be stored in a component container according to the file storage information, specifically: a plurality of containers of different sizes are pre-configured, each container is equipped with a corresponding id, and the file storage information includes a file storage queue and a file total check value,

[0023] According to the container ID of the file storage queue, the third ciphertext is completely stored in the corresponding container, and the offset value and the check value of the third ciphertext in the container are added to the file storage queue;

[0024] If the size of the third ciphertext is larger than the container with the largest capacity, the third ciphertext is split into several ciphertext blocks, the splitting information needs to be stored in the file queue in order, and the several ciphertext blocks are stored in several containers according to the file storage queue, and the check values ​​of the ciphertext blocks and the total file check value of the third ciphertext are calculated respectively, and the offset values ​​and check values ​​of the ciphertext blocks corresponding to the several containers are added to the file storage queue.

[0025] Furthermore, the stored file data information is viewed or downloaded, specifically:

[0026] Decrypting the first ciphertext, and after confirming that the master key is correct, decrypting the file relative path set and the file attribute information according to the master key;

[0027] Constructing a file structure tree according to the file relative path set and the file attribute information;

[0028] View or download file data in a specified directory according to the file structure tree.

[0029] When viewing file data, first verify whether the file key is correct. If correct, obtain the ciphertext corresponding to the file data from the container according to the file storage information; decrypt the ciphertext according to the file key to obtain the file data, and verify the correctness of the file data.

[0030] An electronic device comprises a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps of a method for securely storing files are implemented.

[0031] A storage medium stores computer executable instructions, which, when loaded and executed by a processor, implement the steps of a method for secure file storage.

[0032] It can be seen from the above description of the present invention that, compared with the prior art, the present invention has the following beneficial effects:

[0033] The present invention extracts file attribute information from file data information, stores the file data information and the file attribute information separately, sets a master key and a file key to encrypt the file attribute information and the file data information, thereby ensuring the security of the file data and the file attributes. At the same time, the file data information is stored in different containers to avoid storing all files in the same container, thereby improving the file storage speed.

[0034] In the present invention, the file data information is merged and stored, the block is reduced, and the waste of storage space is avoided. Each file is also provided with a separate key and a separate check, which improves the security of the file and ensures the reliability of file storage.

[0035] The file data information storage of the present invention adopts a multi-container mode, and each container is unrelated to each other. Different file data can be encrypted and stored at the same time, thereby improving the file storage speed.

[0036] The present invention can store a large number of files, and at the same time, securely encrypt and verify the files to ensure data security and reliability, improve storage speed, and facilitate rapid access to file information. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is the main framework diagram of the method of the present invention;

[0038] Figure 2 Extraction flow chart for file data information;

[0039] Figure 3 It is the encryption flow chart;

[0040] Figure 4 A schematic diagram of separate storage of file data information and file attribute information of the present invention;

[0041] Figure 5 A schematic diagram for storing the master key and relative path set;

[0042] Figure 6 A schematic diagram of the composition of file attribute information;

[0043] Figure 7 This is a schematic diagram of container management for file data;

[0044] Figure 8 This is a schematic diagram of the file structure tree.

[0045] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. DETAILED DESCRIPTION

[0046] The present invention is further described below through specific implementation modes.

[0047] See also Figure 1The main flow chart of the present invention is a method for storing files safely, comprising:

[0048] S1 extracts the file data information to be stored, obtains the basic file information and the set of relative file paths, generates a master key and a file key, configures the file storage information for the file data information to be stored, and uses the basic file information, the file key and the file storage information as the file attribute information.

[0049] See also Figure 2 , extract information from the file data information to be stored, and construct a file path set and file attribute information. Specifically, first obtain the basic information of the file data information, including the file's relative path, file name, creation time, modification time, last access time, and file size. Among them, the relative path of the file is processed first, and the file relative path is disassembled, that is, the file relative path is split according to each directory name, and added to the set of file relative paths, and the id value of this file relative path in the current file relative path set is obtained. This id value is also used as the basic information of the file data information.

[0050] In this step, the key generation module is used to generate the master key and the file key. Before generating the file key, a random master key is generated first, and the master key check value is generated based on the master key. The master key is used to encrypt each file key. The master key check value is generated by calculating the hash value of the master key 100,000 times and concatenating the first 2 bytes and the last 2 bytes of the hash value. The check value is used to subsequently verify the integrity and authenticity of the master key.

[0051] For generating file keys, one file corresponds to one key. The corresponding number of file keys is generated according to the number of files in the file data information to be stored. The corresponding check value is generated according to the file key, which is convenient for quick access when encrypting files in the file data information. The check value of the file key is generated by concatenating the first 2 bytes and the last 2 bytes of the hash value of the file key. The check value of the file key is used to subsequently verify the integrity and authenticity of the file key.

[0052] The file storage information is configured for the file data information to be stored. The file storage information includes the file storage queue and the total file check value. The file storage queue includes the container ID for ciphertext storage. The ciphertext is stored in the offset position of the container. The container ID for ciphertext storage and the offset position of the current container for ciphertext storage make it convenient to quickly locate the ciphertext according to the offset value. The file storage queue also includes the size of the container for ciphertext storage and the check value of the current container for ciphertext storage. Among them, for the check value of the ciphertext, if the file storage queue is 1, the check value of the ciphertext is not filled in, and the check value of the ciphertext is already reflected in the total file check value. If the file storage queue is greater than 1, the check value of the ciphertext needs to be filled in.

[0053] See also Figure 6 The file attribute structure information of the present invention mainly includes the above three parts of data content: basic information, file key and its check value, and file storage information. Among them, the basic information includes file name, creation time, modification time, last access time, file size, file relative path id in the file relative path set, etc.

[0054] S2 encrypts the master key and the file relative path set to obtain the first ciphertext. The master key is used to encrypt the file attribute information to obtain the second ciphertext. The file key is used to encrypt the file data information to obtain the third ciphertext;

[0055] In this step, an external input key is used to encrypt the master key and its check value to obtain the master key and its check value ciphertext data, and the master key is used to encrypt the file relative path set to obtain the file relative path set ciphertext data. The master key and its check value ciphertext data and the file relative path set ciphertext data constitute the first ciphertext.

[0056] Specifically, the master key and its check value ciphertext data are stored first, and the master key and the master key check value are encrypted by an external input key, and the external input key is hashed to obtain the key and then encrypted. The master key and the master key check value are encrypted in the following way: first encrypt the master key data to obtain the master key ciphertext, then splice the key check value to the tail M1 of the master key ciphertext, and then encrypt the set (e.g. 16) bytes at the tail of the master key ciphertext M1 and directly overwrite the tail set (e.g. 16) bytes. The file relative path set is encrypted by the master key, and if the tail data is less than the set bytes (16 bytes), the PKCS7 filling mode is used for filling.

[0057] In this step, see Figure 6 It also includes using the master key to encrypt the file attribute information to obtain a second ciphertext, wherein the tail part is insufficient and stored using PKCS7.

[0058] The file data information is encrypted using the file key to obtain the third ciphertext, see Figure 3 , including pre-processing the file data information into a number of data blocks, and then using the file key to encrypt the number of data blocks to obtain a third ciphertext.

[0059] Specifically, the file data information is divided into blocks according to the set number of bytes to obtain a number of data blocks (for example, the set number of bytes is 16 bytes, but not limited thereto), and the following judgments and processes are performed respectively:

[0060] When the size of the data block is 0 bytes, no encryption is performed;

[0061] When the size of a data block is less than the set number of bytes and greater than 0, the size of the data block is padded to the set number of bytes by filling with random values;

[0062] When the data block size is larger than the set number of bytes and is not a multiple of the set number of bytes, the data block whose tail is not a multiple of the set number of bytes is retained.

[0063] When using the file key for encryption, encrypt the data block whose size is a multiple of the set number of bytes to obtain the ciphertext. The data block whose tail is not a multiple of the set number of bytes is spliced ​​to the tail of the ciphertext, and the last set number of bytes of data in the tail of the spliced ​​ciphertext is encrypted and overwritten. During the encryption process, the check value of the data block is calculated, and this empirical value is used to verify the integrity and authenticity of the data block.

[0064] S3 stores the first ciphertext, the second ciphertext and the third ciphertext separately, and the third ciphertext is stored in a component container. Figure 4 Schematic diagram of separate storage of data corresponding to the three parts of ciphertext, wherein the master key and relative path information correspond to the first ciphertext, the file attribute information corresponds to the second ciphertext, and the file data container management corresponds to the third ciphertext.

[0065] The third ciphertext is configured to be stored in component containers, specifically: a number of containers of different sizes are pre-configured (for example, 65536, each container size is as balanced as possible according to the specific ciphertext data, there is no correlation between different containers, and they can be stored at the same time. Theoretically, 65536 files can be stored at one time at the same time), and each container is equipped with a corresponding id. When storing the third ciphertext, the container with less space in the storable container is preferentially used as the storage container. The file storage method of the third ciphertext generally uses complete files for storage.

[0066] According to the container id of the file storage queue, the third ciphertext is completely stored in the container corresponding to the id, and the offset value and the check value of the third ciphertext in the container are added to the file storage queue of the file storage information.

[0067] When the file data of the third ciphertext is too large to be stored in different containers, the third ciphertext needs to be split. Specifically, if the size of the third ciphertext is larger than the available container with the largest capacity, the third ciphertext is split into several ciphertext blocks, and the split information is stored in an orderly manner in the file storage queue (ordered storage according to the storage order of the original file data information), and the several ciphertext blocks are stored in several containers according to the file storage queue, and the check value of the ciphertext block and the total file check value of the third ciphertext are calculated respectively, and the offset values ​​corresponding to the several containers and the check value of the ciphertext block are added to the file storage queue of the file storage information.

[0068] Specifically, the container IDs are 0 to 65535. After the third ciphertext is split, the container with less space is used for storage first. The container ID is obtained and the offset value of the data storage size after the current container has been used is obtained, that is, according to the size of the ciphertext block, the size of the current ciphertext block is added to the container to obtain the offset value. The file data corresponding to the ciphertext block of the current container is hashed to obtain the check value of the ciphertext block.

[0069] After the third ciphertext is stored, if the third ciphertext is split, the total checksum of the entire file needs to be calculated. When the number of file storage queues in the file attribute information is 1, the current total checksum of the file is not filled in. When the number of file queues in the file storage queue is greater than 1, the total checksum of the file needs to be filled in.

[0070] Furthermore, the present invention also includes: S4 viewing or downloading the stored file data information, specifically:

[0071] Decrypt the first ciphertext, and after confirming that the master key is correct, decrypt the file relative path set and file attribute information according to the master key. Decrypt the first ciphertext by inputting an external key (the external key is the key used to encrypt the first ciphertext, and other keys can be set as needed). Verify whether the master key is correct based on the check value of the master key. If the master key is verified to be correct, load the file relative path and file attribute information. Construct a file structure tree based on the file relative path set and file attribute information;

[0072] View or download the file data in the specified directory according to the file structure tree. Figure 8 As shown, the file structure tree includes a root directory and several directories. According to the directory structure of the file structure tree, you can view or download the file contents in the specified directory. All file names can be sorted for easy search, viewing and downloading.

[0073] When checking the file content, first check whether the file key is correct, and verify it through the check value of the file key. If it is correct, obtain the ciphertext corresponding to the file data from the container according to the file storage queue of the file storage information. Use the file key to decrypt the ciphertext to obtain the file data, and verify the correctness of the file data.

[0074] Among them, file data decryption is differentiated according to the file size. When the file data size is 0, there is no need to obtain the file data from the container. When the file data size is less than the set byte (for example, 16 bytes), read the set byte (for example, 16 bytes) of the file data of the corresponding container in the file attribute information, decrypt it with the file key of the current file, and then take out the data of the file size. When the file data size is greater than the set byte (for example, 16 bytes), read it directly and decrypt it. When the file data size is a multiple of (16) of the set byte, decrypt it directly. When the file data size is not a multiple of the set byte, for example, 16*n+k, the first n-1 data is directly decrypted, and the last block of 16 bytes+k is specially decrypted. Special decryption processing means decrypting the last 16 bytes of data first and then decrypting the first 16 bytes of data. After the data decryption is completed, the file data is checked for correctness, and the check value is calculated by hashing the decrypted plaintext data, and compared with the check value stored in the file attribute information. If they are the same, it means that the file data is correct.

[0075] Based on this, the present invention also proposes an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps of the above-mentioned file security storage method are implemented.

[0076] The present invention also provides a storage medium, in which computer executable instructions are stored. When the computer executable instructions are loaded and executed by a processor, the steps of the above-mentioned method for secure file storage are implemented.

[0077] The storage medium of the present invention may be included in the electronic device described in the above embodiments; or may exist independently without being assembled into the electronic device.

[0078] The storage medium carries one or more programs. When the one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.

[0079] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0080] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure.

[0081] The above is only a specific implementation of the present invention, but the design concept of the present invention is not limited thereto. Any non-substantial changes to the present invention using this concept shall be deemed as an infringement of the protection scope of the present invention.

Claims

1. A method for storing files securely, characterized in that: include: Extract the file data information to be stored to obtain the basic file information and the file relative path set; Generate a master key and a file key, configure file storage information for the file data information to be stored, and use the file basic information, the file key and the file storage information as file attribute information; Encrypting the master key and the file relative path set to obtain a first ciphertext; Encrypting the file attribute information using the master key to obtain a second ciphertext; Encrypting the file data information using the file key to obtain a third ciphertext; The first ciphertext, the second ciphertext and the third ciphertext are stored separately, and the third ciphertext is stored in a component container according to the file storage information configuration.

2. A method for storing files securely as claimed in claim 1, characterized in that: Extract the file data information to be stored to obtain a file relative path, decompose the file relative path and add it to a file relative path set, obtain the id value of the file relative path in the file relative path set, and add the id value of the file relative path to the file basic information.

3. A method for storing files securely as claimed in claim 1, characterized in that: Generate a random master key, and generate a check value of the master key according to the master key; The master key and its check value are encrypted using an external input key to obtain ciphertext data of the master key and its check value, and the file relative path set is encrypted using the master key to obtain ciphertext data of the file relative path set. The master key and its check value ciphertext data and the file relative path set ciphertext data constitute the first ciphertext.

4. A method for storing files securely as claimed in claim 1, characterized in that: Generate a corresponding number of file keys according to the number of files of the file data information to be stored, and generate a corresponding check value according to the file keys; The file data information is pre-processed to be divided into a plurality of data blocks, and then the file key is used to encrypt the plurality of data blocks to obtain a third ciphertext.

5. A method for storing files securely as claimed in claim 1, characterized in that: The file data information is pre-processed to be divided into a plurality of data blocks, and then the plurality of data blocks are encrypted with the file key to obtain a third ciphertext, specifically including the following: the file data is divided into a plurality of data blocks according to a set number of bytes, and the following judgments and processing are performed respectively: When the size of the data block is 0, no encryption is performed; When the size of the data block is less than the set number of bytes and greater than 0, the size of the data block is padded to the set number of bytes by filling with random values; When the size of the data block is larger than the set number of bytes and is not a multiple of the set number of bytes, retaining the data block whose tail is not a multiple of the set number of bytes; A data block whose size is a multiple of the set number of bytes is encrypted to obtain a ciphertext, a data block whose tail is not a multiple of the set number of bytes is spliced ​​to the tail of the ciphertext, and the last set number of bytes in the tail of the ciphertext is encrypted and then overwritten, and the check value of the data block is calculated during the encryption process.

6. A method for storing files securely as claimed in claim 1, characterized in that: The third ciphertext is configured to be stored in a component container according to the file storage information, specifically: a plurality of containers of different sizes are pre-configured, each container is equipped with a corresponding id, and the file storage information includes a file storage queue and a file total check value, According to the container ID of the file storage queue, the third ciphertext is completely stored in the corresponding container, and the offset value and the check value of the third ciphertext in the container are added to the file storage queue; If the size of the third ciphertext is larger than the container with the largest capacity, the third ciphertext is split into several ciphertext blocks, the splitting information is stored in the file queue in order, and the several ciphertext blocks are stored in several containers according to the file storage queue, and the check values ​​of the ciphertext blocks and the total file check value of the third ciphertext are calculated respectively, and the offset values ​​and check values ​​of the ciphertext blocks corresponding to the several containers are added to the file storage queue.

7. A method for storing files securely as claimed in claim 1, characterized in that: It also includes viewing or downloading the stored file data information, specifically: Decrypting the first ciphertext, and after confirming that the master key is correct, decrypting the file relative path set and the file attribute information according to the master key; Constructing a file structure tree according to the file relative path set and the file attribute information; View or download the file data in the specified directory according to the file structure tree.

8. A method for storing files securely as claimed in claim 7, characterized in that: When viewing file data, first verify whether the file key is correct. If correct, obtain the ciphertext corresponding to the file data from the container according to the file storage information; decrypt the ciphertext according to the file key to obtain the file data, and verify the correctness of the file data.

9. An electronic device, characterized in that: The method comprises a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps of a file security storage method described in any one of claims 1 to 8 are implemented.

10. A storage medium, characterized in that: The storage medium stores computer executable instructions, and when the computer executable instructions are loaded and executed by the processor, the steps of a file security storage method described in any one of claims 1 to 8 are implemented.

Images