File encryption method and device based on quantum cryptography resisting technology

Abstract

The invention discloses a file encryption method and device based on an anti-quantum cryptography technology, and the method comprises the steps: selecting a target encryption algorithm and a target signature algorithm from a preset anti-quantum cryptography algorithm library in response to a file encryption instruction; generating an asymmetric key pair corresponding to the target encryption algorithm through a secure random number generator; the asymmetric key pair comprises a target public key and a target private key, and the target private key is stored in the protected area; dividing a to-be-encrypted original data file into a plurality of file data blocks; using the target encryption algorithm and the target public key to perform hybrid encryption processing on the file data blocks in sequence to generate encrypted data blocks; performing signature processing on the encrypted data block by using a target signature algorithm to generate a digital signature corresponding to the encrypted data block; and performing data packaging on the encrypted data block and the digital signature to determine an anti-quantum encryption file corresponding to the original data file. And the encryption efficiency is considered while the file resists the quantum computing attack.

Description

Technical Field

[0001] This application relates to the field of information security, and in particular to a file encryption method and apparatus based on quantum-resistant cryptography. Background Technology

[0002] With the rapid development of quantum computing technology, its powerful parallel computing capabilities pose a serious threat to traditional public-key cryptography systems (such as RSA and ECC) based on large integer factorization and the discrete logarithm problem. Quantum attack methods, such as Shor's algorithm, can theoretically and efficiently break these traditional algorithms, leading to unprecedented security risks for sensitive information protection systems widely used in critical sectors such as finance, government, and defense. To ensure the long-term effectiveness of information security, quantum-resistant cryptography (PQC) has emerged and has become a focus of global cryptographic research and standardization.

[0003] Despite significant progress in the theoretical security of quantum-resistant cryptography algorithms, numerous challenges remain in practical engineering applications. First, directly integrating PQC algorithms into existing file encryption systems presents compatibility and performance bottlenecks. Many PQC algorithms have significantly higher computational costs and generate ciphertext / signature sizes than traditional algorithms, leading to inefficiency and increased storage and transmission burdens when directly applied to large file encryption. Second, existing solutions lack a systematic key management framework and a complete file processing workflow design, making it difficult to securely generate, store, distribute, and update quantum-resistant keys, and failing to effectively integrate encryption with integrity verification.

[0004] Application content

[0005] This application provides a file encryption method and apparatus based on quantum-resistant cryptography, which solves the problems of insufficient security of traditional encryption technology in quantum computing environment and low efficiency of existing quantum-resistant cryptography schemes in file encryption applications.

[0006] Firstly, this application provides a file encryption method based on quantum-resistant cryptography, including:

[0007] In response to a file encryption command, a target encryption algorithm and a target signature algorithm are selected from a pre-built quantum-resistant cryptographic algorithm library;

[0008] An asymmetric key pair corresponding to the target encryption algorithm is generated using a secure random number generator; the asymmetric key pair includes the target public key and the target private key, and the target private key is stored in a protected area;

[0009] Divide the original data file to be encrypted into multiple file data blocks;

[0010] Using the target encryption algorithm and the target public key, file data blocks are sequentially subjected to mixed encryption to generate encrypted data blocks;

[0011] The target signature algorithm is used to sign the encrypted data block to generate a digital signature corresponding to the encrypted data block;

[0012] Encapsulate encrypted data blocks with digital signatures to determine the quantum-resistant encrypted file corresponding to the original data file.

[0013] Secondly, this application provides a file encryption device based on quantum-resistant cryptography, comprising:

[0014] The algorithm determination module is configured to select a target encryption algorithm and a target signature algorithm from a pre-built quantum-resistant cryptographic algorithm library in response to a file encryption instruction;

[0015] The asymmetric key pair determination module is configured to generate an asymmetric key pair corresponding to the target encryption algorithm through a secure random number generator; the asymmetric key pair includes a target public key and a target private key, and the target private key is stored in a protected area.

[0016] The file data block determination module is configured to divide the original data file to be encrypted into multiple file data blocks;

[0017] The encrypted data block generation module is configured to use the target encryption algorithm and the target public key to sequentially perform mixed encryption processing on file data blocks in order to generate encrypted data blocks;

[0018] The digital signature generation module is configured to use the target signature algorithm to sign the encrypted data block in order to generate a digital signature corresponding to the encrypted data block.

[0019] The quantum-resistant encrypted file determination module is configured to encapsulate encrypted data blocks with digital signatures to determine the quantum-resistant encrypted file corresponding to the original data file.

[0020] Thirdly, this application provides a readable medium including executable instructions, which, when executed by a processor of an electronic device, cause the electronic device to perform any of the methods described in the first aspect.

[0021] Fourthly, this application provides an electronic device including a processor and a memory storing execution instructions, wherein when the processor executes the execution instructions stored in the memory, the processor performs the method as described in any of the first aspects.

[0022] This application provides a file encryption method and apparatus based on quantum-resistant cryptography. Responding to a file encryption command, a target encryption algorithm and a target signature algorithm are selected from a pre-built quantum-resistant cryptographic algorithm library. An asymmetric key pair corresponding to the target encryption algorithm is generated using a secure random number generator. The asymmetric key pair includes a target public key and a target private key, with the target private key stored in a protected area. The original data file to be encrypted is divided into multiple file data blocks. Using the target encryption algorithm and the target public key, the file data blocks are sequentially subjected to mixed encryption processing to generate encrypted data blocks. The encrypted data blocks are signed using the target signature algorithm to generate a digital signature corresponding to the encrypted data blocks. The encrypted data blocks and the digital signature are then encapsulated to determine the quantum-resistant encrypted file corresponding to the original data file. This ensures that the file resists quantum computing attacks while maintaining encryption efficiency.

[0023] The further effects of the aforementioned non-conventional preferred method will be explained below in conjunction with specific embodiments. Attached Figure Description

[0024] To more clearly illustrate the embodiments of this application or the existing technical solutions, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 A schematic flowchart illustrating a file encryption method based on quantum-resistant cryptography, provided as an embodiment of this application;

[0026] Figure 2 A schematic flowchart of another file encryption method based on quantum-resistant cryptography provided in an embodiment of this application;

[0027] Figure 3 A schematic flowchart of another file encryption method based on quantum-resistant cryptography provided in an embodiment of this application;

[0028] Figure 4 This is a schematic diagram of a file encryption device based on quantum-resistant cryptography provided in an embodiment of this application;

[0029] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] With the rapid development of quantum computing technology, its powerful parallel computing capabilities pose a serious threat to traditional public-key cryptography systems (such as RSA and ECC) based on large integer factorization and the discrete logarithm problem. Quantum attack methods, such as Shor's algorithm, can theoretically and efficiently break these traditional algorithms, leading to unprecedented security risks for sensitive information protection systems widely used in critical sectors such as finance, government, and defense. To ensure the long-term effectiveness of information security, quantum-resistant cryptography (PQC) has emerged and has become a focus of global cryptographic research and standardization.

[0032] Despite significant progress in the theoretical security of quantum-resistant cryptography algorithms, numerous challenges remain in practical engineering applications. First, directly integrating PQC algorithms into existing file encryption systems presents compatibility and performance bottlenecks. Many PQC algorithms have significantly higher computational costs and generate ciphertext / signature sizes than traditional algorithms, leading to inefficiency and increased storage and transmission burdens when directly applied to large file encryption. Second, existing solutions lack a systematic key management framework and a complete file processing workflow design, making it difficult to securely generate, store, distribute, and update quantum-resistant keys, and failing to effectively integrate encryption with integrity verification.

[0033] Furthermore, there is currently a lack of a unified technical solution that can smoothly transition and balance efficiency and security. Most solutions either focus solely on replacing the algorithm itself, neglecting compatibility with existing systems (such as various operating systems and cloud platforms); or they are rigidly designed, unable to dynamically adjust algorithm strategies according to different file characteristics and security requirements, lacking flexibility and scalability. These shortcomings limit the large-scale promotion and application of quantum-resistant cryptography in the fundamental and critical application scenario of file encryption.

[0034] To address this issue, this application proposes a file encryption method based on quantum-resistant cryptography, aiming to solve the problems of insufficient security of traditional encryption technologies in quantum computing environments and the low efficiency of existing quantum-resistant cryptographic schemes in file encryption applications. In this embodiment, a file encryption method based on quantum-resistant cryptography includes:

[0035] Step 101: In response to the file encryption command, select the target encryption algorithm and the target signature algorithm from the preset quantum-resistant cryptographic algorithm library.

[0036] When the system receives a file encryption command, it first initiates an algorithm selection mechanism. The system comprehensively analyzes the basic attributes of the file to be encrypted, including the file's actual size, data content type, file format, and user-preset security level requirements. This attribute information serves as a crucial basis for algorithm selection, ensuring that the chosen algorithm combination maximally meets the specific needs of the current encryption task.

[0037] Based on the file size, file type, and preset security level requirements of the original data file, determine the algorithm selection parameters; based on the algorithm selection parameters, determine the target encryption algorithm and target signature algorithm from the quantum-resistant cryptographic algorithm library.

[0038] The system incorporates multiple algorithm evaluation strategies, dynamically adjusting the selection logic based on different application scenarios. For example, for large multimedia files or frequently accessed business documents, the system prioritizes quantum-resistant algorithm combinations with relatively high computational efficiency and faster processing speed to ensure a smooth user experience. Conversely, for highly sensitive files involving trade secrets, personal privacy, or national security, the system tends to select algorithm combinations with higher security strength and stronger resistance to attacks, even if it may sacrifice some processing speed.

[0039] The quantum-resistant cryptographic algorithm library, as the core technical resource of the system, includes a variety of mature algorithms certified by international standardization organizations, such as CRYSTALS-Kyber, Dilithium, and FALCON. These algorithms have undergone rigorous security analysis and performance testing, effectively resisting various quantum attack methods, including Shor's algorithm. Based on the aforementioned determined algorithm selection parameters, the system precisely matches the most suitable target encryption and signature algorithms from this rich algorithm library for the current task. This intelligent algorithm matching mechanism not only improves the overall security of the encryption system but also ensures optimal performance in different application environments.

[0040] The algorithm selection process also considers the availability and compatibility requirements of system resources. The system evaluates key resource indicators such as computing power, memory capacity, and storage space of the current hardware environment to ensure that the selected algorithm can run stably under existing resource conditions. At the same time, the system also checks the target platform's support for different algorithms, prioritizing algorithm combinations with good cross-platform compatibility to facilitate subsequent file transfer, storage, and decryption operations.

[0041] Step 102: Generate an asymmetric key pair corresponding to the target encryption algorithm using a secure random number generator; the asymmetric key pair includes the target public key and the target private key, and store the target private key in a protected area.

[0042] An asymmetric key pair corresponding to the target encryption algorithm is generated using a secure random number generator. The asymmetric key pair includes a target public key and a target private key, with the private key stored in a protected area. The generation of the asymmetric key pair is the cornerstone of the entire quantum-resistant encryption system; its quality and security directly determine whether the entire encryption system can effectively resist various attack methods. The system employs a cryptographically secure random number generator, which can generate random number sequences with high unpredictability and sufficient entropy, providing a reliable randomness basis for subsequent key generation.

[0043] Call the secure random number generator to generate a random seed that meets the requirements of the target encryption algorithm; based on the random seed and the target encryption algorithm, generate an asymmetric key pair.

[0044] The system first invokes a secure random number generator to produce a high-quality random seed that meets the specific parameter requirements of the target encryption algorithm. The random seed must satisfy several stringent security standards, including statistical randomness testing, entropy evaluation, and unpredictability verification. The quality of the random seed directly affects the security strength of the generated key; therefore, the system performs multiple rounds of quality checks on the generated random numbers to ensure they meet the security standards for cryptographic applications.

[0045] Based on a verified random seed and a selected target encryption algorithm, the system executes a standardized key generation algorithm, strictly adhering to relevant international standards and algorithm specifications to generate asymmetric key pairs. During the generation process, the system monitors various security parameters in real time to ensure the integrity and correctness of the key generation process. The generated asymmetric key pair includes a target public key for encryption and a target private key for decryption; these two keys have a strict mathematical correspondence and together constitute the core components of a quantum-resistant encryption system.

[0046] The system immediately stores the target private key in a specially designed protected area, such as a trusted execution environment, hardware security module, or other storage device with hardware-level security capabilities. These protected areas employ multiple security mechanisms, including physical protection, access control, encrypted storage, and tamper-proof detection, effectively preventing unauthorized access, copying, or theft of the private key. Simultaneously, the system establishes a robust key backup and recovery mechanism to ensure secure recovery of the target private key in the event of device failure or other anomalies, guaranteeing system availability and business continuity.

[0047] Step 103: Divide the original data file to be encrypted into multiple file data blocks.

[0048] The system employs an intelligent block-splitting algorithm that dynamically determines the optimal block-splitting scheme based on the specific characteristics of the file and the system's resource status. For example, a 100MB high-definition video file might be divided into 200 500KB blocks; while a 10MB PDF document might be divided into 50 200KB blocks. The block-splitting process not only considers the processing power limitations of the encryption algorithm but also memory efficiency, network transmission characteristics, and the performance characteristics of the storage system to ensure the entire encryption process runs efficiently and stably.

[0049] The chunk size is determined following a dynamic optimization principle. The system adopts different chunking strategies based on file type and application scenario. For multimedia files such as audio and video, which are typically large and require high transmission efficiency, the system uses larger chunk sizes (e.g., 1MB-2MB) to reduce the number of chunks and management overhead. For small files such as office documents and configuration files that require frequent modification and access, the system tends to choose smaller chunk sizes (e.g., 64KB-256KB) to support more flexible partial updates and random access functions. This adaptive chunking mechanism also considers network bandwidth limitations, automatically adjusting to smaller chunk sizes in low-bandwidth environments to improve transmission success rates.

[0050] Each file data block is assigned complete metadata information during the generation process, including a unique block identifier, sequence number, and integrity check value. The block identifier uses a UUID (Universally Unique Identifier) ​​generation algorithm to ensure global uniqueness even in a distributed environment.

[0051] Step 104: Using the target encryption algorithm and the target public key, perform mixed encryption processing on the file data blocks in sequence to generate encrypted data blocks.

[0052] The hybrid encryption mechanism combines the security advantages of quantum-resistant asymmetric encryption with the efficiency of traditional symmetric encryption. This design effectively solves the problem of inefficiency when using quantum-resistant algorithms alone to process large files, while maintaining strong resistance to quantum attacks. The hybrid encryption architecture enables the system to significantly improve file encryption processing speed and user experience while ensuring high security.

[0053] In its implementation, the system first generates a 256-bit AES symmetric key independently for each file data block. For example, for a file divided into 100 data blocks, the system will generate 100 completely different AES keys. Then, it uses AES-GCM mode to encrypt each data block at high speed. This process can achieve a processing speed of GB / s, far exceeding the direct encryption speed of quantum-resistant algorithms.

[0054] The system utilizes quantum-resistant key encapsulation (KEM) algorithms such as CRYSTALS-Kyber to securely encapsulate each generated AES symmetric key. Taking Kyber-1024 as an example, the system uses a 2048-bit public key to encapsulate and encrypt a 256-bit AES key, resulting in a ciphertext length of approximately 1568 bytes. This encapsulation process ensures that even in a quantum computing environment, attackers cannot obtain the AES key through decryption, thus protecting the security of the entire encrypted data. Each data block's AES key undergoes independent quantum-resistant encapsulation; even if one key is accidentally leaked, it will not affect the security of other data blocks.

[0055] The system organically combines AES-encrypted data with corresponding Kyber key-encapsulated data to form a complete hybrid encrypted data block. A typical structure for each encrypted data block includes: a block header (containing encryption parameters, timestamps, and other metadata), Kyber key-encapsulated data, and variable-length AES-encrypted data content. This self-contained design allows each data block to be decrypted independently, supports parallel decryption and partial file recovery, and also facilitates data management and access control in distributed storage environments.

[0056] Step 105: Use the target signature algorithm to sign the encrypted data block to generate a digital signature corresponding to the encrypted data block.

[0057] Digital signature mechanisms ensure the integrity, authenticity, and non-repudiation of documents, playing a crucial security role in quantum-resistant encryption systems. The system can employ quantum-resistant digital signature algorithms such as Dilithium, effectively resisting various quantum attacks, including Grover's algorithm. The signing process strictly adheres to cryptographic security principles, ensuring the signature is unforgeable and verifiable.

[0058] The encrypted data block is hashed using a preset hash algorithm to generate a hash digest value corresponding to the encrypted data block; based on the target signature algorithm, the hash digest value is digitally signed using the signature private key corresponding to the target signature algorithm to generate a digital signature corresponding to the encrypted data block.

[0059] Hash digest calculation is a fundamental step in digital signature generation. The system can use, for example, the SHA-3-256 hash algorithm to perform a complete digest calculation on each encrypted data block, generating a 256-bit hash value. This hash value exhibits the avalanche effect; even if only one bit of the original data is changed, the resulting hash value will be completely different. The one-way nature of hash algorithms ensures that the original data content cannot be deduced from the digest value, while collision resistance guarantees that different data contents will not produce the same hash value.

[0060] The system uses a pre-generated and securely stored signing private key to perform digital signature operations on the hash digest value. The signing process involves complex polynomial and modular operations, including multiple steps such as random number generation, commitment calculation, and challenge response. For example, the Dilithium signature algorithm requires multiple rounds of rejection sampling to ensure the security and correctness of the signature. The generated digital signature is not only closely related to the data content but also uniquely bound to the signer's private key, providing strong authentication and non-repudiation guarantees. The recipient can use the corresponding public key to verify the signature, confirming the integrity of the data and the trustworthiness of its source; the entire verification process is efficient and reliable.

[0061] Step 106: Encapsulate the encrypted data block with the digital signature to determine the quantum-resistant encrypted file corresponding to the original data file.

[0062] The data encapsulation process employs a layered structure design to ensure the generated encrypted files have good organization and scalability. The file header uses a fixed-length structured format, containing a basic metadata area that records key information such as the encryption algorithm identifier, file version information, total number of blocks, and timestamps. For example, a file containing 150 data blocks will explicitly indicate "TOTAL_BLOCKS:150" in its header, facilitating accurate processing by the decryption program. This standardized header design not only supports automated processing but also reserves expansion space for future algorithm upgrades and format evolution.

[0063] The encrypted data area employs a linear storage model of "data block + signature," where each storage unit contains the complete encrypted data block content and its corresponding digital signature. For example, the first data block might occupy 524,000 bytes of encrypted data plus 2,420 bytes of signature, totaling approximately 526KB of storage space. This design ensures that each data block is fully self-contained, supporting parallel verification and partial decryption. The system also adds a CRC32 checksum at the end of each storage unit, providing rapid data integrity verification capabilities.

[0064] File integrity protection employs a multi-layered verification mechanism. In addition to the independent digital signatures of each data block, the system generates global integrity verification information for the entire encrypted file, stored in a dedicated area at the end of the file. This multi-layered protection design ensures rapid detection and location of data corruption even in harsh network or storage conditions. For example, if an error occurs in the 50th data block during transmission, the system can quickly locate the problematic area through global verification, and then perform detailed verification using the block's independent signature, achieving efficient error diagnosis and recovery.

[0065] As can be seen from the above technical solutions, the beneficial effects of this embodiment are:

[0066] This application provides a file encryption method based on quantum-resistant cryptography. In response to a file encryption command, it selects a target encryption algorithm and a target signature algorithm from a pre-built quantum-resistant cryptographic algorithm library; generates an asymmetric key pair corresponding to the target encryption algorithm using a secure random number generator; the asymmetric key pair includes a target public key and a target private key, and the target private key is stored in a protected area; the original data file to be encrypted is divided into multiple file data blocks; the file data blocks are sequentially subjected to mixed encryption processing using the target encryption algorithm and the target public key to generate encrypted data blocks; the encrypted data blocks are signed using the target signature algorithm to generate a digital signature corresponding to the encrypted data blocks; and the encrypted data blocks and the digital signature are encapsulated to determine the quantum-resistant encrypted file corresponding to the original data file. This ensures that the file resists quantum computing attacks while maintaining encryption efficiency.

[0067] Figure 1 The example shown is only a basic embodiment of a file encryption method based on quantum-resistant cryptography in this application. With certain optimizations and extensions, other preferred embodiments of a file encryption method based on quantum-resistant cryptography can be obtained.

[0068] like Figure 2 The image shows another specific embodiment of a file encryption method based on quantum-resistant cryptography according to this application.

[0069] In this embodiment, a file encryption method based on quantum-resistant cryptography includes the following steps:

[0070] Step 201: In response to the file encryption command, select the target encryption algorithm and the target signature algorithm from the preset quantum-resistant cryptographic algorithm library.

[0071] Step 202: Generate an asymmetric key pair corresponding to the target encryption algorithm using a secure random number generator; the asymmetric key pair includes the target public key and the target private key, and store the target private key in a protected area.

[0072] Step 203: Divide the original data file to be encrypted into multiple file data blocks.

[0073] Step 204: Using the target encryption algorithm and the target public key, perform mixed encryption processing on the file data blocks in sequence to generate encrypted data blocks.

[0074] Step 205: Generate an independent symmetric encryption key for each file data block, and use the AES algorithm to perform the first layer of encryption on the file data block to determine the first layer of encrypted data corresponding to the file data block.

[0075] A cryptographically compliant secure random number generator is used to generate a high-entropy random bit string, which serves as the source of the symmetric key. The output of the secure random number generator exhibits unpredictability and uniform distribution, making the generated key statistically close to an ideal random number. In this way, the symmetric key for each data block is independent, avoiding the risk of cascading attacks caused by a single point of key leakage.

[0076] Subsequently, the system invokes the AES algorithm to perform the first layer of encryption on the data block. The AES algorithm works by transforming plaintext blocks into ciphertext blocks through multiple rounds of iterative byte substitution, row shifting, column obfuscation, and round key addition. As a block cipher algorithm, AES has a fixed block length and is often used in conjunction with different operating modes (such as CBC, GCM, etc.) when processing large-scale files. Here, the role of the AES algorithm is to quickly and reliably convert file data blocks into ciphertext data, making it impossible for unauthorized entities to recover the original content.

[0077] The encryption process for each data block is independent, which can significantly improve processing efficiency in a parallel computing environment. Furthermore, even if an attacker obtains the key to one data block, they cannot decrypt other data blocks, thus effectively enhancing the overall system security.

[0078] Step 206: Encapsulate and encrypt the symmetric encryption key using the target encryption algorithm and the target public key to generate key encapsulation data.

[0079] The system treats the symmetric encryption key as the object to be protected and encapsulates and encrypts it using the target encryption algorithm and the target public key. This is a typical key encapsulation mechanism. Under this mechanism, an asymmetric encryption algorithm is used to generate a random ciphertext, which can establish a unique mapping relationship with the recipient's private key, thereby ensuring that only the legitimate user holding the private key can decapsulate and recover the symmetric key.

[0080] Encapsulation encryption involves more than simply encrypting the key; it also involves the internal mathematical structure of the algorithm and key mapping. For example, in lattice-based quantum-resistant encryption algorithms, the system embeds the symmetric key into a specific mathematical problem, making it decryptable only with the private key. In this way, a one-way and strong binding relationship is formed between the key-encapsulated data and the original symmetric key.

[0081] The final generated key-encapsulated data is encapsulated together with the first layer of encrypted data in the file data blocks. At this point, even if an attacker intercepts the entire encrypted file, they cannot directly recover the symmetric key because decapsulation requires possession of the legitimate target private key. This mechanism ensures the confidentiality and uniqueness of the key distribution process, laying the foundation for subsequent secure decryption.

[0082] Step 207: Combine the first layer of encrypted data with the key-encapsulated data to form an encrypted data block.

[0083] The system combines the first layer of encrypted data in a file data block with the corresponding key-encapsulated data according to a predetermined format. Employing a dual-structure storage layout of "ciphertext + key encapsulation" ensures a logically close link between the data content and key information. In this way, each encrypted data block possesses complete self-containment, meaning it simultaneously contains the necessary conditions for data recovery.

[0084] During the assembly process, the system sets fixed structural boundaries for data blocks. For example, metadata such as offsets and lengths between the encrypted data and key encapsulation parts can be defined, allowing the decryption end to quickly locate the contents of both parts. This design based on structured storage principles gives file parsing a high degree of determinism and compatibility. Even on cross-platform or different version systems, the decryption end can rely on this metadata to achieve correct file parsing and decryption.

[0085] This combination not only enhances the system's flexibility but also improves the file's adaptability to complex application scenarios. For example, in distributed storage or network segmented transmission, the receiving end can process data block by block, thereby improving transmission efficiency and fault tolerance. If an error occurs in a data block during transmission, the system can retransmit only that block without retransmitting the entire file.

[0086] Finally, the combined encrypted data blocks will serve as a crucial component of the quantum-resistant encrypted file in the subsequent signing and encapsulation stages. Through this design, the entire encryption system forms a multi-layered security structure of "data protection—key protection—block-level combination," ensuring both the confidentiality of the file content and the security of key management and the controllability of the decryption process.

[0087] Step 208: Use the target signature algorithm to sign the encrypted data block to generate a digital signature corresponding to the encrypted data block.

[0088] Step 209: Encapsulate the encrypted data block and digital signature to determine the quantum-resistant encrypted file corresponding to the original data file.

[0089] As can be seen from the above technical solutions, the beneficial effects of this embodiment are as follows: by generating a symmetric encryption key independently for each file data block and using the AES algorithm for the first layer of encryption, combined with the quantum-resistant key encapsulation mechanism to protect the symmetric key, and the structured data combination encapsulation technology, a balance between high efficiency and high security is achieved. This not only ensures long-term security under the threat of quantum computing, but also significantly improves the processing speed and system performance of large file encryption through the hybrid encryption architecture.

[0090] like Figure 3 The image shows another specific embodiment of a file encryption method based on quantum-resistant cryptography according to this application. This embodiment is further described based on the foregoing embodiments.

[0091] In this embodiment, a file encryption method based on quantum-resistant cryptography includes the following steps:

[0092] Step 301: In response to the file encryption command, select the target encryption algorithm and the target signature algorithm from the preset quantum-resistant cryptographic algorithm library.

[0093] Step 302: Generate an asymmetric key pair corresponding to the target encryption algorithm using a secure random number generator; the asymmetric key pair includes the target public key and the target private key, and store the target private key in a protected area.

[0094] Step 303: Divide the original data file to be encrypted into multiple file data blocks.

[0095] Step 304: Using the target encryption algorithm and the target public key, perform mixed encryption processing on the file data blocks in sequence to generate encrypted data blocks.

[0096] Step 305: Use the target signature algorithm to sign the encrypted data block to generate a digital signature corresponding to the encrypted data block.

[0097] Step 306: Encapsulate the encrypted data block and digital signature to determine the quantum-resistant encrypted file corresponding to the original data file.

[0098] Step 307: Construct the file header structure of the quantum-resistant encrypted file; the file header structure includes the encryption algorithm identifier, signature algorithm identifier, key length information, and file block number information.

[0099] The system first needs to generate the file header structure of the quantum-resistant encrypted file. The file header uses self-describing metadata to strongly bind the algorithm to the file content. It typically contains encryption algorithm identifiers and signature algorithm identifiers, which correspond to unique markers (such as OIDs or version numbers) in the algorithm library. When parsing the file at the decryption end, the file header can be read directly to accurately match the required decryption algorithm and signature verification algorithm, avoiding decryption failures caused by incorrect algorithm selection.

[0100] In addition to the above, the file header also contains key length information and the number of file blocks. The key length information reflects the security level adopted by the encryption system, facilitating subsequent key parsing and security strength verification. Different quantum-resistant encryption algorithms have significantly different key lengths; for example, the public key length of a lattice-based KEM algorithm can reach several kilobytes, while a traditional ECC public key is only a few hundred bytes. By explicitly recording the key length, the decryption end can quickly allocate buffers and load parameters during algorithm initialization, thereby ensuring the efficiency and correctness of the parsing process.

[0101] The file block count information provides essential reference for the decryption end to reassemble the file, enabling the system to quickly locate and correct data blocks in distributed or parallel decryption scenarios. This information significantly improves data processing efficiency, especially in distributed storage and parallel decryption applications. In this way, the file header ensures a clear file structure while also enhancing the scalability and compatibility of the decryption process.

[0102] Step 308: Arrange the encrypted data blocks in their original order and append a corresponding digital signature to each encrypted data block to generate an encrypted data area.

[0103] The system arranges encrypted data blocks sequentially according to the original file order to maintain data logical consistency. This sequential mapping ensures that encrypted data can be correctly reconstructed into the original file during decryption. The block order is aided by a block count field in the file header, allowing the decryption end to assemble the file sequentially based on the sequence numbers. Thus, even in a distributed environment where data blocks are transmitted separately, correct assembly can be achieved using this sequence information.

[0104] Simultaneously, the system appends a corresponding digital signature to each encrypted data block. First, a hash operation is performed on the encrypted data block to obtain a digest value; then, the digest is signed using the signing private key to generate a digital signature. Because hash functions are collision-resistant and have avalanche resistance, even slight alterations to the data block content will cause a significant change in its digest value, leading to signature verification failure. This mechanism ensures the immutability of each data block during storage and transmission.

[0105] In this way, the receiving end can perform signature verification block by block during decryption. If the signature verification of a data block fails, it can be immediately determined that the data block has been tampered with or corrupted without affecting other normal data blocks. Through this block-level independent signature verification mechanism, the system effectively improves data integrity and resistance to attacks, while also enhancing fault tolerance and availability in large-scale file transfer and storage environments.

[0106] Step 309: Integrate and encapsulate the file header structure and the encrypted data area to generate a quantum-resistant encrypted file.

[0107] After constructing the file header and generating the encrypted data area, the system enters the final integration and encapsulation stage. During this process, the file header is placed at the beginning of the file, ensuring that any decryption operation can obtain the necessary algorithm information and structural parameters by reading the header. The encrypted data area then follows sequentially, forming a complete encrypted file format. This layout not only conforms to the parsing habits of common file formats but also facilitates cross-platform and cross-system adaptation, enhancing file portability.

[0108] For example, fixed file header length fields, partition offsets, and checksums can be defined, making the entire file both parsable and verifiable. This structured format allows the decryption end to quickly segment and locate the file header and data areas, avoiding parsing errors caused by formatting issues. This fundamental design ensures the compatibility of encrypted files across different operating systems and application environments.

[0109] The resulting quantum-resistant encrypted file possesses high self-descriptiveness and integrity protection characteristics. The file contains both metadata for algorithm identification and key management, and core data areas protected by encryption and signature. This integrated encapsulation method ensures that the file remains tamper-proof during long-term storage and network transmission, and provides a clear parsing path for subsequent decryption and verification. This structured design lays a solid foundation for the widespread application of quantum-resistant encryption technology in practical engineering environments.

[0110] It also includes: responding to a file decryption command, determining the target decryption algorithm and target signature verification algorithm required for decryption based on the encryption algorithm identifier and the signature algorithm identifier; verifying the digital signature using the target signature verification algorithm and the target public key; extracting the target private key from the protected area when the verification is successful; decrypting the key-encapsulated data using the target decryption algorithm and the target private key to obtain the corresponding symmetric encryption key; decrypting the first-layer encrypted data using the symmetric encryption key and the AES algorithm to restore the file data blocks; and rearranging the file data blocks in their original order to determine the original data file.

[0111] When the system receives a file decryption command, it first parses the file header of the encrypted file. The file header stores the encryption algorithm identifier and the signature algorithm identifier. Based on these identifiers, the system can quickly locate and determine the target decryption algorithm and the target signature verification algorithm to be used, thus providing a clear algorithmic basis for subsequent decryption and signature verification operations. This process ensures the adaptability and compatibility of the decryption process, enabling the system to uniformly process encrypted files with different algorithm combinations.

[0112] After determining the decryption and signature verification algorithms, the system uses the target signature verification algorithm and its corresponding target public key to verify the digital signature attached to each encrypted data block in the file. Only if the digital signature verification passes will the system proceed to the subsequent decryption process, thereby ensuring that the received data has not been tampered with and guaranteeing the integrity and trustworthiness of the file during transmission and storage.

[0113] Once signature verification is successful, the system securely extracts the corresponding target private key from the protected area. This private key is stored in the secure area throughout its usage period and is protected by hardware isolation or encryption mechanisms to prevent leakage or unauthorized access. After extracting the private key, the system uses the target decryption algorithm and the target private key to decrypt the key-encapsulated data, thereby obtaining the symmetric encryption key encapsulated within. This symmetric encryption key is a crucial parameter used for decrypting the first layer of encrypted data; its correctness and security directly affect whether the entire file can be completely restored.

[0114] After successfully obtaining the symmetric encryption key, the system invokes the AES algorithm to decrypt the first layer of encrypted data stored in the encrypted data blocks block by block. Through AES decryption, the original content of the file data blocks is recovered, maintaining the same integrity as before encryption. Subsequently, the system rearranges and reassembles the decrypted file data blocks in their original order, ultimately generating the original data file that is completely identical to the original data file before encryption.

[0115] As can be seen from the above technical solutions, the beneficial effects of this embodiment are as follows: by constructing a standardized file header structure, the encryption parameters are accurately recorded and quickly identified; by adopting an ordered data area organization method, data integrity and efficient access are ensured; and by combining global encapsulation technology and multi-layer integrity protection mechanisms, standardized storage, cross-platform compatibility and all-round security protection of quantum-resistant encrypted files are achieved, laying a solid technical foundation for the widespread application of quantum-resistant cryptography in the field of file encryption.

[0116] like Figure 4 The image shown is a specific embodiment of a file encryption device based on quantum-resistant cryptography according to this application. This embodiment describes a file encryption device based on quantum-resistant cryptography, specifically used for executing... Figures 1-3 A physical device for a file encryption method based on quantum-resistant cryptography is provided. Its technical solution is essentially the same as the embodiments described above, and the corresponding descriptions in the embodiments above also apply to this embodiment. This embodiment of a file encryption device based on quantum-resistant cryptography includes:

[0117] The algorithm determination module 401 is configured to select a target encryption algorithm and a target signature algorithm from a pre-set quantum-resistant cryptographic algorithm library in response to a file encryption instruction.

[0118] The asymmetric key pair determination module 402 is configured to generate an asymmetric key pair corresponding to the target encryption algorithm through a secure random number generator; the asymmetric key pair includes a target public key and a target private key, and the target private key is stored in a protected area.

[0119] The file data block determination module 403 is configured to divide the original data file to be encrypted into multiple file data blocks;

[0120] The encrypted data block generation module 404 is configured to use the target encryption algorithm and the target public key to perform mixed encryption processing on the file data blocks in sequence to generate encrypted data blocks;

[0121] The digital signature generation module 405 is configured to use a target signature algorithm to sign the encrypted data block in order to generate a digital signature corresponding to the encrypted data block.

[0122] The quantum-resistant encrypted file determination module 406 is configured to encapsulate encrypted data blocks with digital signatures to determine the quantum-resistant encrypted file corresponding to the original data file.

[0123] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include RAM, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk storage device. Of course, the electronic device may also include other hardware required for other services.

[0124] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 5 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0125] Memory is used to store instructions for execution. Specifically, instructions for execution are computer programs that can be executed. Memory can include main memory and non-volatile memory, and it provides the processor with execution instructions and data.

[0126] In one possible implementation, the processor reads the corresponding execution instructions from non-volatile memory into main memory and then executes them. Alternatively, it may obtain the corresponding execution instructions from other devices to logically form a file encryption device based on quantum-resistant cryptography. The processor executes the execution instructions stored in the memory to implement the file encryption method based on quantum-resistant cryptography provided in any embodiment of this application.

[0127] The above is as stated in this application. Figure 4 The method implemented by the file encryption device based on quantum cryptography provided in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor.

[0128] The steps of the method disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0129] This application also proposes a readable medium that stores executable instructions. When these instructions are executed by a processor of an electronic device, the electronic device can perform a file encryption method based on quantum-resistant cryptography provided in any embodiment of this application, specifically for executing, for example... Figure 1 or Figure 2 or Figure 3 The method shown.

[0130] The electronic devices in the foregoing embodiments may be computers.

[0131] Those skilled in the art will understand that the embodiments of this application can be provided as methods or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or a combination of software and hardware.

[0132] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0133] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0134] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A file encryption method based on quantum-resistant cryptography, characterized in that, include: In response to a file encryption command, a target encryption algorithm and a target signature algorithm are selected from a pre-built quantum-resistant cryptographic algorithm library; An asymmetric key pair corresponding to the target encryption algorithm is generated by a secure random number generator; the asymmetric key pair includes a target public key and a target private key, and the target private key is stored in a protected area. Divide the original data file to be encrypted into multiple file data blocks; Using the target encryption algorithm and the target public key, the file data blocks are sequentially subjected to mixed encryption processing to generate encrypted data blocks; The encrypted data block is signed using the target signature algorithm to generate a digital signature corresponding to the encrypted data block; The encrypted data block is encapsulated with the digital signature to determine the quantum-resistant encrypted file corresponding to the original data file.

2. The method according to claim 1, characterized in that, The selection of the target encryption algorithm and target signature algorithm from a pre-set quantum-resistant cryptographic algorithm library includes: The algorithm selection parameters are determined based on the file size, file type, and preset security level requirements of the original data file; Based on the algorithm selection parameters, the target encryption algorithm and the target signature algorithm are determined from the quantum-resistant cryptographic algorithm library.

3. The method according to claim 1, characterized in that, The step of generating the asymmetric key pair corresponding to the target encryption algorithm using a secure random number generator includes: The secure random number generator is invoked to generate a random seed that meets the requirements of the target encryption algorithm; The asymmetric key pair is generated based on the random seed and the target encryption algorithm.

4. The method according to claim 1, characterized in that, The step of using the target encryption algorithm and the target public key to sequentially perform mixed encryption processing on the file data blocks to generate encrypted data blocks includes: A unique symmetric encryption key is generated for each file data block, and the AES algorithm is used to perform a first-level encryption process on the file data block to determine the first-level encrypted data corresponding to the file data block; The symmetric encryption key is encapsulated and encrypted using the target encryption algorithm and the target public key to generate key encapsulation data; The first layer of encrypted data is combined with the key-encapsulated data to form the encrypted data block.

5. The method according to claim 1, characterized in that, The step of using the target signature algorithm to sign the encrypted data block to generate a digital signature corresponding to the encrypted data block includes: The encrypted data block is hashed using a preset hash algorithm to generate a hash digest value corresponding to the encrypted data block. Based on the target signature algorithm, the hash digest value is digitally signed using the signature private key corresponding to the target signature algorithm to generate the digital signature corresponding to the encrypted data block.

6. The method according to claim 4, characterized in that, The step of encapsulating the encrypted data block with the digital signature to determine the quantum-resistant encrypted file corresponding to the original data file includes: Construct the file header structure of the quantum-resistant encrypted file; the file header structure includes encryption algorithm identifier, signature algorithm identifier, key length information, and file block number information; The encrypted data blocks are arranged in their original order, and a corresponding digital signature is appended to each encrypted data block to generate an encrypted data area. The file header structure and the encrypted data area are integrated and encapsulated to generate the quantum-resistant encrypted file.

7. The method according to claim 6, characterized in that, Also includes: In response to a file decryption command, the target decryption algorithm and target signature verification algorithm required for decryption are determined based on the encryption algorithm identifier and the signature algorithm identifier. The digital signature is verified using the target signature verification algorithm and the target public key; When the verification is successful, the target private key is extracted from the protected area; The key-encapsulated data is decrypted using the target decryption algorithm and the target private key to obtain the corresponding symmetric encryption key; Using the symmetric encryption key and the AES algorithm, the first layer of encrypted data is decrypted to restore the file data block; The file data blocks are rearranged and reassembled in the original order to determine the original data file.

8. A file encryption device based on quantum-resistant cryptography, characterized in that, include: The algorithm determination module is configured to select a target encryption algorithm and a target signature algorithm from a pre-built quantum-resistant cryptographic algorithm library in response to a file encryption instruction; An asymmetric key pair determination module is configured to generate an asymmetric key pair corresponding to the target encryption algorithm through a secure random number generator; the asymmetric key pair includes a target public key and a target private key, and the target private key is stored in a protected area; The file data block determination module is configured to divide the original data file to be encrypted into multiple file data blocks; The encrypted data block generation module is configured to use the target encryption algorithm and the target public key to sequentially perform mixed encryption processing on the file data block to generate an encrypted data block; The digital signature generation module is configured to use the target signature algorithm to sign the encrypted data block in order to generate a digital signature corresponding to the encrypted data block. A quantum-resistant encrypted file determination module is configured to encapsulate the encrypted data block with the digital signature to determine the quantum-resistant encrypted file corresponding to the original data file.

9. A computer-readable storage medium storing a computer program, characterized in that, The computer program is used to execute a file encryption method based on quantum-resistant cryptography as described in any one of claims 1-7.

10. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the file encryption method based on quantum-resistant cryptography as described in any one of claims 1-7.

Images