Encryption method, device, computer equipment and storage medium suitable for large files

Abstract

The present application discloses an encryption method, apparatus, computer equipment, and medium suitable for large files. The method comprises the following steps: dividing the large file to be encrypted into multiple sub-data blocks according to a preset rule, encoding each sub-data block, and obtaining an index value for each sub-data block; generating a master key, and generating a sub-data key corresponding to each sub-data block based on the index value of each sub-data block and the master key; encrypting each sub-data block based on the sub-data key corresponding to each sub-data block to obtain multiple encrypted sub-data blocks; obtaining a check chain value for the large file to be encrypted based on each encrypted sub-data block; and merging the multiple encrypted sub-data blocks and the check chain value to obtain the ciphertext of the large file to be encrypted. The method can effectively cut off the association between blocks and reduce the risk of key leakage, enhance the encryption strength with dynamic sub-keys, and avoid memory overflow through block processing, thereby improving the security, reliability, and processing efficiency of large file encryption and meeting the needs of secure storage and transmission of large files.

Description

Technical Field

[0001] The present application relates to the field of encryption technology, and in particular to an encryption method, device, computer equipment and storage medium suitable for large files. Background Art

[0002] In the digital age, large files such as video footage, industrial data, and backup images are increasingly used in a wide range of scenarios. The need for secure storage and transmission is growing increasingly urgent as data volumes explode. However, traditional encryption methods for large files have numerous flaws and are unable to meet security requirements.

[0003] In traditional simple block encryption, due to the correlation between blocks, attackers can exploit this feature to launch attacks, posing the risk of key leakage. Furthermore, the lack of an effective integrity verification mechanism means that if large files are tampered with during transmission or storage, the system will not be able to detect it in time, potentially resulting in the use of incorrect data and causing losses to the data owner. Furthermore, each block in traditional schemes is encrypted with the same key. Once this key is cracked, the ciphertext of all blocks is at risk of being leaked, resulting in weak security. Furthermore, traditional encryption methods require large files to be loaded into memory all at once for encryption. When the file size exceeds the system's physical memory capacity, it can easily cause a system crash, interrupting the encryption process, affecting work efficiency and potentially causing data loss or corruption. Summary of the Invention

[0004] Based on this, it is necessary to provide an encryption method, device, computer equipment and storage medium suitable for large files to address the above technical problems, so as to solve at least one problem in the above-mentioned prior art.

[0005] In a first aspect, a method for encrypting large files is provided, comprising:

[0006] The large file to be encrypted is divided into multiple sub-data blocks according to preset rules, and each sub-data block is encoded to obtain the index value of each sub-data block;

[0007] Generate a master key, and generate a sub-data key corresponding to each sub-data block based on the index value of each sub-data block and the master key;

[0008] encrypting each sub-data block based on the sub-data key corresponding to each sub-data block to obtain a plurality of encrypted sub-data blocks;

[0009] Obtaining a checksum chain value of the large file to be encrypted based on each encrypted sub-data block;

[0010] The multiple encrypted sub-data blocks and the check chain value are combined to generate the ciphertext of the large file to be encrypted.

[0011] In one embodiment of the present application, generating a sub-data key corresponding to each sub-data block based on the index value of each sub-data block and the master key includes:

[0012] Calculate the remainder of each sub-data block index value divided by the preset value;

[0013] Based on the remainder, a corresponding encryption algorithm is used to generate a sub-data key corresponding to the corresponding sub-data block through the index value of the corresponding sub-data block and the master key, wherein different remainders use different encryption algorithms.

[0014] In one embodiment of the present application, obtaining the checksum chain value of the large file to be encrypted based on each encrypted sub-data block includes:

[0015] Calculate the hash value corresponding to each encrypted sub-data block;

[0016] Based on the hash value corresponding to each encrypted sub-data block, a checksum chain value of the large file to be encrypted is calculated.

[0017] In one embodiment of the present application, merging the multiple encrypted sub-data blocks and the check chain value to generate the ciphertext of the large file to be encrypted includes:

[0018] splicing the multiple encrypted sub-data blocks in sequence according to the index values;

[0019] The spliced ​​encrypted sub-data blocks are spliced ​​with the check chain value to obtain the ciphertext of the large file to be encrypted.

[0020] In one embodiment of the present application, dividing the large file to be encrypted into multiple sub-data blocks according to a preset rule includes:

[0021] Determining a preset block size based on the actual size of the large file to be encrypted;

[0022] Splitting the large file to be encrypted into multiple sub-data blocks of preset block sizes;

[0023] If there is a non-standard sub-data block smaller than the preset block size in the sub-data block, the non-standard sub-data block is filled with corresponding bytes.

[0024] In one embodiment of the present application, the check chain value includes a first primary check chain value and a first secondary check chain value. After merging the multiple encrypted sub-data blocks and the check chain value to generate the ciphertext of the large file to be encrypted, the following steps are performed:

[0025] Obtaining each encrypted sub-data block based on the ciphertext of the large file to be encrypted;

[0026] Calculate the hash value corresponding to each encrypted sub-data block respectively;

[0027] Calculating a second primary check chain value of the large file to be encrypted based on the hash values ​​corresponding to the encrypted sub-data blocks and a primary hash algorithm;

[0028] Calculating a second secondary checksum chain value of the large file to be encrypted based on the hash values ​​corresponding to the encrypted sub-data blocks and the secondary hash algorithm;

[0029] Comparing the first primary check chain value with the second primary check chain value, and comparing the first secondary check chain value with the second secondary check chain value;

[0030] If any comparison fails, it means the data has been tampered with or corrupted.

[0031] In an embodiment of the present application, the first main check chain and the first secondary check chain are dynamically switched based on a time period or a file type.

[0032] In a second aspect, an encryption device suitable for large files is provided, comprising:

[0033] An index value generating unit is used to divide the large file to be encrypted into multiple sub-data blocks according to a preset rule, and encode each sub-data block to obtain an index value of each sub-data block;

[0034] a sub-data key generating unit, configured to generate a master key, and generate a sub-data key corresponding to each sub-data block based on the index value of each sub-data block and the master key;

[0035] an encrypted sub-data block generating unit, configured to encrypt each sub-data block based on a sub-data key corresponding to each sub-data block to obtain a plurality of encrypted sub-data blocks;

[0036] A check chain value generating unit, configured to obtain a check chain value of the large file to be encrypted based on each encrypted sub-data block;

[0037] The ciphertext generation unit is used to combine the multiple encrypted sub-data blocks and the check chain value to generate the ciphertext of the large file to be encrypted.

[0038] In a third aspect, a computer device is provided, comprising a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, wherein when the processor executes the computer-readable instructions, the steps of the encryption method applicable to large files as described above are implemented.

[0039] In a fourth aspect, a readable storage medium is provided, wherein the readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the encryption method applicable to large files as described above are implemented.

[0040] The above-mentioned encryption method, device, computer equipment and storage medium applicable to large files, and its method implementation includes: dividing the large file to be encrypted into multiple sub-data blocks according to a preset rule, and encoding each sub-data block to obtain an index value of each sub-data block; generating a master key, and based on the index value of each sub-data block and the master key, generating a sub-data key corresponding to each sub-data block; encrypting each sub-data block based on the sub-data key corresponding to each sub-data block to obtain multiple encrypted sub-data blocks; obtaining a check chain value of the large file to be encrypted based on each encrypted sub-data block; merging the multiple encrypted sub-data blocks and the check chain value to generate the ciphertext of the large file to be encrypted. In the embodiment of the present application, by dividing the large file to be encrypted into sub-data blocks according to a preset rule and encoding them, generating a unique sub-key for each sub-block based on the master key and the sub-data block index value for encryption, and generating a check chain value based on the encrypted sub-data block, and finally merging the encrypted sub-data block and the check chain value to obtain the ciphertext. It can effectively cut off the association between blocks to reduce the risk of key leakage, enhance encryption strength with dynamic subkeys, and avoid memory overflow by processing in blocks, comprehensively improving the security, reliability and processing efficiency of large file encryption, and meeting the urgent needs of secure storage and transmission of large files. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0042] Figure 1 This is a flowchart of an encryption method applicable to large files in one embodiment of the present application;

[0043] Figure 2 This is a schematic diagram of a structure of an encryption device suitable for large files in one embodiment of the present application;

[0044] Figure 3 Schematic diagram of a computer device in one embodiment of the present application. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0046] In one embodiment, if Figure 1As shown, a method for encrypting large files is provided, comprising the following steps:

[0047] In step S110, the large file to be encrypted is divided into multiple sub-data blocks according to a preset rule, and each sub-data block is encoded to obtain an index value of each sub-data block;

[0048] Among them, the large files to be encrypted refer to files with high data volume, such as video materials, industrial data, and backup images.

[0049] Optionally, the large file to be encrypted can be divided into blocks using a fixed-size block strategy or a dynamic-size block strategy. The fixed-size block strategy refers to cutting the large file to be encrypted into fixed sizes such as 1MB, 4MB, or 16MB to obtain data blocks of the same size. The dynamic-size block strategy refers to dividing the file based on the content characteristics of the file, such as key frames of a video, paragraphs of a text, etc., and the size of each data block obtained can be different. In addition, the fixed-size block strategy or the dynamic-size block strategy can be selected for block processing according to the type of file. For example, a fixed-size block strategy can be used for video files, and a dynamic-size block strategy can be used for database files.

[0050] It should be noted that if a fixed-size block strategy is used to divide a large encrypted file into blocks, each sub-block can be The size of the data block is checked and sub-data blocks smaller than a fixed size, such as 1MB, are padded to ensure block integrity. Padding can be performed using fixed bytes, such as 0x80, or random bytes (such as those generated by a cryptographically secure random number generator). Once padding is complete, a hash value is calculated for the padded sub-data block and embedded into the ciphertext of the large file to be encrypted. During decryption, the hash value is recalculated and compared with the original calculated hash value. If the comparison is consistent, the data has not been tampered with, preventing attackers from maliciously modifying the padding content and ensuring data integrity.

[0051] Furthermore, if the segmentation is paused due to an abnormal event, the current segmentation position can be recorded. When the segmentation is resumed, it can be continued based on the recorded current segmentation position without having to restart the segmentation. Furthermore, when the large file to be encrypted is incrementally updated, only the incrementally updated content is re-segmented, and the segmentation results of the unchanged blocks do not need to be re-segmented.

[0052] Optionally, after the segmentation is completed, multiple sub-data blocks can be obtained. , and then each sub-data block can be encoded according to the preset coding rules Encoding is performed to obtain the index value of each sub-data block. The index value can be understood as the unique digital fingerprint of each sub-data block, and different data blocks have different index values. The index value can be determined according to the position of the data block, for example, the block number can be directly used. ,like The value (1, 2, ..., n) can be used as the index value, or a preset algorithm such as SHA-256, BLAKE3, etc. can be used to calculate the index value of each sub-data block, for example, index value = SHA-256 (sub-data block content), or the block number and sub-data block content can be used together to calculate the index value, such as index value = SHA-256 (block number || sub-data block content). In this way, even if the sub-data block content is the same, its index value is different due to different block numbers.

[0053] In step S120, a master key is generated, and a sub-data key corresponding to each sub-data block is generated based on the index value of each sub-data block and the master key;

[0054] The master key (MK) serves as the core trust foundation of the large-file encryption system. Its security directly impacts the effectiveness of the entire encryption system. Therefore, a random generation mechanism is employed to ensure its high degree of unpredictability. This random generation typically utilizes a true random number generator (TRNG). This generates unpredictable random bits from physical entropy sources such as hardware circuit thermal noise and quantum tunneling, or software entropy sources such as system keyboard stroke time and disk I / O latency. After rigorous entropy evaluation and verification, a key that meets security strength requirements, such as 128 or 256 bits, is generated. To further enhance security, a salt (such as a 16-byte random number) is introduced. The key derivation process is optimized using a key derivation function (KDF) and an iterative mechanism. The KDF may include a salt, c (number of iterations), a hash function (e.g., HMAC-SM3), and length (the desired length of the derived key), ultimately outputting the derived key. Furthermore, the master key is rotated regularly to ensure security throughout its generation, use, and storage.

[0055] Optionally, after obtaining the master key MK and index value, the master key MK and index value can be mapped to the key of the sub-data block through the key derivation function (KDF). Each sub-data block corresponds to a unique sub-key to ensure that the leakage of a single block key does not affect other blocks.

[0056] The sub-data block key can be calculated using the following formula:

[0057] ;

[0058] in, Represents the master key, Represents the index value, Represents a key derivation function.

[0059] In step S130, each sub-data block is encrypted based on the sub-data key corresponding to each sub-data block to obtain multiple encrypted sub-data blocks;

[0060] Optionally, for each sub-data block Use the corresponding encryption algorithm alg, such as 3DES algorithm, SM4 algorithm, AES algorithm, etc., to encrypt block by block to obtain the corresponding ciphertext ,The ciphertext stream is output in real time during the encryption process, avoiding caching the entire large file data.

[0061] It's important to note that different encryption algorithms can be used for different sub-data blocks, and different encryption algorithms can be assigned to different blocks based on their index values. By using different encryption algorithms for different sub-data blocks, data security and processing efficiency can be improved in multiple dimensions. This can also reduce the risk of a single algorithm being cracked, protect against targeted attacks, and dynamically adjust encryption strategies based on the data's sensitivity level, further enhancing security.

[0062] In step S140, a checksum chain value of the large file to be encrypted is obtained based on each encrypted sub-data block;

[0063] Optionally, a preset hash algorithm, such as SM3, SHA-256, BLAKE3, etc., may be used to calculate the hash value of each encrypted sub-data block. The hash calculation must cover the entire contents of the encrypted sub-data block (including the ciphertext data, authentication tag, and initialization vector). Then, after obtaining the hash values ​​of all encrypted blocks, they are concatenated according to a set of rules to form a checksum chain value. For example, a chained hash structure or Merkle tree structure can be used: A chained structure starts with the hash of the first ciphertext block, and each subsequent node is a concatenation of the previous node's hash and the current block's hash, ultimately forming a root hash. A Merkle tree, on the other hand, groups the ciphertext block hashes into layers, calculating them upwards layer by layer, ultimately yielding a unique root hash. This results in the checksum chain value.

[0064] In step S150, the multiple encrypted sub-data blocks and the check chain value are merged to generate the ciphertext of the large file to be encrypted.

[0065] Optionally, the plurality of encrypted sub-data blocks And the check chain value h is combined into the complete ciphertext data, and the ciphertext data of the large file to be encrypted File can be obtained, specifically ,Then, the ciphertext stream of the large file can be output, avoiding caching the entire file.

[0066] In an embodiment of the present application, an encryption method suitable for large files is provided, comprising: dividing the large file to be encrypted into multiple sub-data blocks according to a preset rule, and encoding each sub-data block to obtain an index value of each sub-data block; generating a master key, and generating a sub-data key corresponding to each sub-data block based on the index value of each sub-data block and the master key; encrypting each sub-data block based on the sub-data key corresponding to each sub-data block to obtain multiple encrypted sub-data blocks; obtaining a check chain value of the large file to be encrypted based on each encrypted sub-data block; merging the multiple encrypted sub-data blocks and the check chain value to generate a ciphertext of the large file to be encrypted. In an embodiment of the present application, by dividing the large file to be encrypted into sub-data blocks according to a preset rule and encoding them, generating a unique sub-key for each sub-block based on the master key and the sub-data block index value for encryption, and generating a check chain value based on the encrypted sub-data block, the encrypted sub-data block and the check chain value are finally merged to obtain a ciphertext. It can effectively cut off the association between blocks to reduce the risk of key leakage, enhance encryption strength with dynamic subkeys, and avoid memory overflow by processing in blocks, comprehensively improving the security, reliability and processing efficiency of large file encryption, and meeting the urgent needs of secure storage and transmission of large files.

[0067] In one embodiment of the present application, generating a sub-data key corresponding to each sub-data block based on the index value of each sub-data block and the master key includes:

[0068] Calculate the remainder of each sub-data block index value divided by the preset value;

[0069] Based on the remainder, a corresponding encryption algorithm is used to generate a sub-data key corresponding to the corresponding sub-data block through the index value of the corresponding sub-data block and the master key, wherein different remainders use different encryption algorithms.

[0070] Exemplarily, if the remainder is 0, a first encryption algorithm is used to generate a sub-data key corresponding to the corresponding sub-data block based on the index value of the corresponding sub-data block and the master key;

[0071] If the remainder is 1, a second encryption algorithm is used to generate a sub-data key corresponding to the sub-data block based on the index value of the sub-data block and the master key;

[0072] If the remainder is 2, a third encryption algorithm is used to generate a sub-data key corresponding to the sub-data block based on the index value of the sub-data block and the master key;

[0073] If the remainder is 4, a fourth encryption algorithm is used to generate a sub-data key corresponding to the sub-data block based on the index value of the sub-data block and the master key; ......

[0074] Specifically, the index value of each sub-data block can be calculated by dividing it by a preset value. For example, when the preset value N = 3, the remainders 0, 1, and 2 correspond to the 3DES, AES, and SM4 algorithms, respectively, forming a circular mapping relationship. For example, if the remainder is 0, the 3DES algorithm can be selected to calculate the sub-data key corresponding to the sub-data block. If the remainder is 1, the AES algorithm can be selected to calculate the sub-data key corresponding to the sub-data block. If the remainder is 2, the SM4 algorithm can be selected to calculate the sub-data key corresponding to the sub-data block. For example, the index value can be the block number of the sub-data block. The algorithm used by the sub-data block with an index value of 6 is 3DES, the algorithm used by the sub-data block with an index value of 7 is AES, and the algorithm used by the sub-data block with an index value of 8 is SM4. Adjacent blocks use different algorithms to prevent attackers from performing batch cracking on a single algorithm mode.

[0075] In one embodiment of the present application, obtaining the checksum chain value of the large file to be encrypted based on each encrypted sub-data block includes:

[0076] Calculate the hash value corresponding to each encrypted sub-data block;

[0077] Based on the hash value corresponding to each encrypted sub-data block, a checksum chain value of the large file to be encrypted is calculated.

[0078] Optionally, a preset hash algorithm, such as SM3, may be used to calculate the hash value of each encrypted sub-data block. , which can be specifically expressed as The hash values ​​are then concatenated in sequence according to the block numbers of the sub-data blocks, and the preset hash algorithm, such as SM3, is used again to calculate the check chain value h of the entire large file to be encrypted.

[0079] The check chain value h can be expressed as:

[0080] ;

[0081] In one embodiment of the present application, merging the multiple encrypted sub-data blocks and the check chain value to generate the ciphertext of the large file to be encrypted includes:

[0082] splicing the multiple encrypted sub-data blocks in sequence according to the index values;

[0083] The spliced ​​encrypted sub-data blocks are spliced ​​with the check chain value to obtain the ciphertext of the large file to be encrypted.

[0084] Optionally, the plurality of encrypted sub-data blocks Splice in sequence according to the index value to ensure that the ciphertext can accurately restore the original file structure. After the splicing is completed, the check chain value is integrated into it to generate the complete ciphertext data, and the encrypted ciphertext data of the large file to be encrypted can be obtained. It is specifically expressed as Then, the ciphertext stream of the large file can be output to avoid caching the entire file. Based on the generation of all encrypted blocks, it is possible to effectively detect whether the ciphertext has been tampered with during storage or transmission. This not only achieves the orderly integration of large files after block encryption, but also gives the ciphertext self-verification capabilities.

[0085] In one embodiment of the present application, dividing the large file to be encrypted into multiple sub-data blocks according to a preset rule includes:

[0086] Determining a preset block size based on the actual size of the large file to be encrypted;

[0087] Splitting the large file to be encrypted into multiple sub-data blocks of preset block sizes;

[0088] If there is a non-standard sub-data block smaller than the preset block size in the sub-data block, the non-standard sub-data block is filled with corresponding bytes.

[0089] Optionally, the large file to be encrypted can be divided into n sub-data blocks according to preset rules. For example, each sub-data block is divided into 1MB in size, or each sub-data block is divided into 1GB in size. The preset block size, such as 1MB, 1GB or other values, can be dynamically adjusted according to the size of the large file. For example, a 10GB file can be divided into 1GB blocks (a total of 10 blocks), and a 500MB file can be divided into 1MB blocks (a total of 500 blocks) to avoid too many small blocks affecting efficiency.

[0090] It should be noted that if a fixed-size block strategy is used to divide a large encrypted file into blocks, each sub-block can be The size of the data block is checked and sub-data blocks smaller than a fixed size, such as 1MB, are padded to ensure block integrity. Padding can be performed using fixed bytes, such as 0x80, or random bytes (such as those generated by a cryptographically secure random number generator). Once padding is complete, a hash value is calculated for the padded sub-data block and embedded into the ciphertext of the large file to be encrypted. During decryption, the hash value is recalculated and compared with the original calculated hash value. If the comparison is consistent, the data has not been tampered with, preventing attackers from maliciously modifying the padding content and ensuring data integrity.

[0091] In one embodiment of the present application, the check chain value includes a first primary check chain value and a first secondary check chain value. After merging the multiple encrypted sub-data blocks and the check chain value to generate the ciphertext of the large file to be encrypted, the following steps are performed:

[0092] Obtaining each encrypted sub-data block based on the ciphertext of the large file to be encrypted;

[0093] Calculate the hash value corresponding to each encrypted sub-data block respectively;

[0094] Calculating a second primary check chain value of the large file to be encrypted based on the hash values ​​corresponding to the encrypted sub-data blocks and a primary hash algorithm;

[0095] Calculating a second secondary checksum chain value of the large file to be encrypted based on the hash values ​​corresponding to the encrypted sub-data blocks and the secondary hash algorithm;

[0096] Comparing the first primary check chain value with the second primary check chain value, and comparing the first secondary check chain value with the second secondary check chain value;

[0097] If any comparison fails, it means the data has been tampered with or corrupted.

[0098] Optionally, the complete ciphertext is split into encrypted sub-blocks according to preset rules (such as fixed size or index markers), ensuring that each block is identical to the divisions used during encryption. A primary hash value and a secondary hash value are calculated for each encrypted sub-block. All primary hash values ​​are concatenated in a specific order (such as a Merkle tree or chained hashing) to ultimately generate a second primary check chain value. A second secondary check chain value is then calculated based on the secondary hash values ​​using the same order and rules. The second primary check chain value generated during decryption is then compared with the first primary check chain value stored during encryption, and the second secondary check chain value is also compared with the first secondary check chain value. If both check chains match, the data is intact and untampered. If the primary check chain matches but the secondary check chain fails, it indicates a targeted attack on the secondary hash algorithm. If both check chains fail to match, the data has been tampered with or corrupted during transmission. Check chains are constructed using both the primary and secondary hash algorithms. The first check chain generated during encryption is compared with the recalculated second check chain during decryption, achieving dual verification of ciphertext integrity. Even if an attacker cracks or tampered with the verification chain of a single algorithm, the other algorithm can still detect the anomaly, greatly improving the ability to resist attacks.

[0099] Among them, the primary hash algorithm and the secondary hash algorithm are different, such as SHA-256 and BLAKE3.

[0100] Among them, the first main verification chain and the first secondary verification chain can automatically switch the algorithm combination based on the time period (such as time granularity such as hours, days, and weeks), or dynamically switch based on the file type (such as sensitivity level, file type), thereby effectively increasing the difficulty of cracking by attackers and avoiding pattern leakage caused by the long-term fixed use of a single algorithm.

[0101] In this embodiment, a large file to be encrypted is divided into sub-data blocks according to preset rules and encoded. A unique sub-key is generated for each sub-data block based on the master key and the sub-data block index value for encryption. A check chain value is generated based on the encrypted sub-data block, and the encrypted sub-data block and the check chain value are finally combined to produce the ciphertext. This effectively cuts off inter-block associations, reduces the risk of key leakage, enhances encryption strength with dynamic sub-keys, and avoids memory overflows through block processing. This comprehensively improves the security, reliability, and processing efficiency of large file encryption, meeting the urgent need for secure large file storage and transmission.

[0102] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0103] In one embodiment, an encryption device for large files is provided, which corresponds one-to-one to the encryption method for large files in the above embodiment. Figure 2 As shown, the encryption device for large files includes an index value generation unit 10, a sub-data key generation unit 20, an encrypted sub-data block generation unit 30, a check chain value generation unit 40, and a ciphertext generation unit 50. The functional modules are described in detail as follows:

[0104] The index value generating unit 10 is used to divide the large file to be encrypted into multiple sub-data blocks according to a preset rule, and encode each sub-data block to obtain an index value of each sub-data block;

[0105] The sub-data key generation unit 20 is used to generate a master key, and generate a sub-data key corresponding to each sub-data block based on the index value of each sub-data block and the master key;

[0106] The encrypted sub-data block generating unit 30 is configured to encrypt each sub-data block based on the sub-data key corresponding to each sub-data block to obtain a plurality of encrypted sub-data blocks;

[0107] A check chain value generating unit 40 is configured to obtain a check chain value of the large file to be encrypted based on each encrypted sub-data block;

[0108] The ciphertext generation unit 50 is configured to combine the multiple encrypted sub-data blocks and the check chain value to generate the ciphertext of the large file to be encrypted.

[0109] In one embodiment of the present application, the sub-data key generation unit 20 is further configured to:

[0110] Calculate the remainder of each sub-data block index value divided by the preset value;

[0111] Based on the remainder, a corresponding encryption algorithm is used to generate a sub-data key corresponding to the corresponding sub-data block through the index value of the corresponding sub-data block and the master key, wherein different remainders use different encryption algorithms.

[0112] In one embodiment of the present application, the check chain value generation unit 40 is further configured to:

[0113] Calculate the hash value corresponding to each encrypted sub-data block;

[0114] Based on the hash value corresponding to each encrypted sub-data block, a checksum chain value of the large file to be encrypted is calculated.

[0115] In one embodiment of the present application, the ciphertext generation unit 50 is further configured to:

[0116] splicing the multiple encrypted sub-data blocks in sequence according to the index values;

[0117] The spliced ​​encrypted sub-data blocks are spliced ​​with the check chain value to obtain the ciphertext of the large file to be encrypted.

[0118] In one embodiment of the present application, the index value generating unit 10 is further configured to:

[0119] Determining a preset block size based on the actual size of the large file to be encrypted;

[0120] Splitting the large file to be encrypted into multiple sub-data blocks of preset block sizes;

[0121] If there is a non-standard sub-data block smaller than the preset block size in the sub-data block, the non-standard sub-data block is filled with corresponding bytes.

[0122] In one embodiment of the present application, the check chain value includes a first primary check chain value and a first secondary check chain value, and the apparatus further includes a verification unit configured to:

[0123] Obtaining each encrypted sub-data block based on the ciphertext of the large file to be encrypted;

[0124] Calculate the hash value corresponding to each encrypted sub-data block respectively;

[0125] Calculating a second primary check chain value of the large file to be encrypted based on the hash values ​​corresponding to the encrypted sub-data blocks and a primary hash algorithm;

[0126] Calculating a second secondary checksum chain value of the large file to be encrypted based on the hash values ​​corresponding to the encrypted sub-data blocks and the secondary hash algorithm;

[0127] Comparing the first primary check chain value with the second primary check chain value, and comparing the first secondary check chain value with the second secondary check chain value;

[0128] If any comparison fails, it means the data has been tampered with or corrupted.

[0129] In an embodiment of the present application, the first main check chain and the first secondary check chain are dynamically switched based on a time period or a file type.

[0130] In this embodiment, a large file to be encrypted is divided into sub-data blocks according to preset rules and encoded. A unique sub-key is generated for each sub-data block based on the master key and the sub-data block index value for encryption. A check chain value is generated based on the encrypted sub-data block, and the encrypted sub-data block and the check chain value are finally combined to produce the ciphertext. This effectively cuts off inter-block associations, reduces the risk of key leakage, enhances encryption strength with dynamic sub-keys, and avoids memory overflows through block processing. This comprehensively improves the security, reliability, and processing efficiency of large file encryption, meeting the urgent need for secure large file storage and transmission.

[0131] The specific limitations of encryption devices suitable for large files can be found in the limitations of encryption methods suitable for large files described above and will not be repeated here. Each module in the aforementioned encryption device suitable for large files can be implemented in whole or in part through software, hardware, or a combination thereof. Each of the aforementioned modules can be embedded in or independent of a processor in a computer device in hardware form, or can be stored in a memory in the computer device in software form, so that the processor can call and execute the corresponding operations of each of the aforementioned modules.

[0132] In one embodiment, a computer device is provided. The computer device may be a terminal device, and its internal structure diagram may be as follows: Figure 3 As shown. The computer device includes a processor, a memory, and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a readable storage medium. The readable storage medium stores computer-readable instructions. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer-readable instructions are executed by the processor, an encryption method suitable for large files is implemented. The readable storage medium provided in this embodiment includes a non-volatile readable storage medium and a volatile readable storage medium.

[0133] In an embodiment of the present application, a computer device is provided, including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor. When the processor executes the computer-readable instructions, the steps of the encryption method applicable to large files as described above are implemented.

[0134] In an embodiment of the application, a readable storage medium is provided, which stores computer-readable instructions. When the computer-readable instructions are executed by a processor, the steps of the encryption method applicable to large files as described above are implemented.

[0135] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through computer-readable instructions. The computer-readable instructions can be stored in a non-volatile readable storage medium or a volatile readable storage medium. When the computer-readable instructions are executed, they can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0136] Those skilled in the art will clearly understand that for the sake of convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0137] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. An encryption method suitable for large files, characterized in that: The method comprises: The large file to be encrypted is divided into multiple sub-data blocks according to preset rules, and each sub-data block is encoded to obtain the index value of each sub-data block; Generate a master key, and generate a sub-data key corresponding to each sub-data block based on the index value of each sub-data block and the master key; encrypting each sub-data block based on the sub-data key corresponding to each sub-data block to obtain a plurality of encrypted sub-data blocks; Obtaining a checksum chain value of the large file to be encrypted based on each encrypted sub-data block; Merging the multiple encrypted sub-data blocks and the check chain value to generate a ciphertext of the large file to be encrypted; The step of generating a sub-data key corresponding to each sub-data block based on the index value of each sub-data block and the master key includes: Calculate the remainder of each sub-data block index value divided by the preset value; Based on the remainder, a corresponding encryption algorithm is used to generate a sub-data key corresponding to the corresponding sub-data block through the index value of the corresponding sub-data block and the master key, wherein different remainders use different encryption algorithms.

2. The encryption method for large files according to claim 1, wherein: The step of obtaining a checksum chain value of the large file to be encrypted based on each encrypted sub-data block includes: Calculate the hash value corresponding to each encrypted sub-data block; Based on the hash value corresponding to each encrypted sub-data block, a checksum chain value of the large file to be encrypted is calculated.

3. The encryption method for large files according to claim 1, wherein: The step of merging the plurality of encrypted sub-data blocks and the check chain value to generate the ciphertext of the large file to be encrypted includes: splicing the multiple encrypted sub-data blocks in sequence according to the index values; The spliced ​​encrypted sub-data blocks are spliced ​​with the check chain value to obtain the ciphertext of the large file to be encrypted.

4. The encryption method for large files according to claim 1, wherein: The method of dividing the large file to be encrypted into multiple sub-data blocks according to a preset rule includes: Determining a preset block size based on the actual size of the large file to be encrypted; Splitting the large file to be encrypted into multiple sub-data blocks of preset block sizes; If there is a non-standard sub-data block smaller than the preset block size in the sub-data block, the non-standard sub-data block is filled with corresponding bytes.

5. The encryption method for large files according to any one of claims 1 to 4, characterized in that: The check chain value includes a first primary check chain value and a first secondary check chain value. After merging the plurality of encrypted sub-data blocks and the check chain value to generate the ciphertext of the large file to be encrypted, the method includes: Obtaining each encrypted sub-data block based on the ciphertext of the large file to be encrypted; Calculate the hash value corresponding to each encrypted sub-data block respectively; Calculating a second primary check chain value of the large file to be encrypted based on the hash values ​​corresponding to the encrypted sub-data blocks and a primary hash algorithm; Calculating a second secondary checksum chain value of the large file to be encrypted based on the hash values ​​corresponding to the encrypted sub-data blocks and the secondary hash algorithm; Comparing the first primary check chain value with the second primary check chain value, and comparing the first secondary check chain value with the second secondary check chain value; If any comparison fails, it means the data has been tampered with or corrupted.

6. The encryption method for large files according to claim 5, wherein: The first main check chain and the first secondary check chain are dynamically switched based on a time period or a file type.

7. An encryption device suitable for large files, characterized in that: The device comprises: An index value generating unit is used to divide the large file to be encrypted into multiple sub-data blocks according to a preset rule, and encode each sub-data block to obtain an index value of each sub-data block; a sub-data key generating unit, configured to generate a master key, and generate a sub-data key corresponding to each sub-data block based on the index value of each sub-data block and the master key; an encrypted sub-data block generating unit, configured to encrypt each sub-data block based on a sub-data key corresponding to each sub-data block to obtain a plurality of encrypted sub-data blocks; A check chain value generating unit, configured to obtain a check chain value of the large file to be encrypted based on each encrypted sub-data block; a ciphertext generation unit, configured to combine the plurality of encrypted sub-data blocks and the check chain value to generate a ciphertext of the large file to be encrypted; The sub-data key generation unit is further used for: Calculate the remainder of each sub-data block index value divided by the preset value; Based on the remainder, a corresponding encryption algorithm is used to generate a sub-data key corresponding to the corresponding sub-data block through the index value of the corresponding sub-data block and the master key, wherein different remainders use different encryption algorithms.

8. A computer device comprising a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, wherein: When the processor executes the computer-readable instructions, the steps of the encryption method applicable to large files as described in any one of claims 1 to 6 are implemented.

9. A readable storage medium storing computer-readable instructions, characterized in that: When the computer-readable instructions are executed by a processor, the steps of the encryption method applicable to large files as described in any one of claims 1 to 6 are implemented.

Images