File processing method and device and electronic equipment

Abstract

The invention provides a file processing method and device and electronic equipment, and is applied to the technical field of information processing, and the method comprises the steps: generating a key pair which comprises a public key and a private key; encrypting the received initial file according to the public key to obtain a first encrypted file; under the condition that an access request of a first user for the first encrypted file is received, the access permission value of the first user is encrypted to obtain a first encrypted permission value, and the access request carries the access permission value of the first user; encrypting an access permission threshold value of the first encrypted file to obtain a second encrypted permission value; and when the first encryption permission value is greater than or equal to the second encryption permission value, decrypting the first encrypted file based on the private key to obtain a first decrypted file, and providing the first decrypted file for the first user. The problem of low file security can be solved, and the file security is improved.

Description

Technical Field

[0001] This application relates to the field of information processing technology, and in particular to a document processing method, apparatus and electronic device. Background Technology

[0002] In today's digital office environment, files (including but not limited to official documents) can be isolated in specific environments, such as corporate private networks or independent domains under private cloud architectures, to ensure document security to a certain extent. However, with the rapid development of information technology and the increasing complexity of network threats, data breaches and malicious tampering are rampant, posing a significant threat to file security. Therefore, for the sake of file security, even files in isolated environments need to be encrypted to ensure their security.

[0003] Currently, commonly used encryption algorithms include Advanced Encryption Standard (AES), a symmetric-key encryption algorithm that processes data into fixed-length blocks. Its fixed encryption mode is easily analyzed by attackers. Attackers can analyze a large amount of ciphertext to find patterns such as the frequency of byte occurrences and specific patterns, and then use statistical methods to try to crack it, thereby gaining access to the encrypted file. The file security is relatively low. Summary of the Invention

[0004] This application provides a file processing method, apparatus, and electronic device to address the problem of low file security in existing systems.

[0005] To solve the above-mentioned technical problems, this application is implemented as follows:

[0006] In a first aspect, embodiments of this application provide a document processing method, the method comprising:

[0007] Generate a key pair, which includes a public key and a private key;

[0008] The received initial file is encrypted using the public key to obtain the first encrypted file;

[0009] Upon receiving an access request from a first user to the first encrypted file, the access permission value of the first user is encrypted to obtain a first encrypted access value, and the access request carries the access permission value of the first user.

[0010] The access permission threshold of the first encrypted file is encrypted to obtain the second encrypted permission value;

[0011] If the first encryption permission value is greater than or equal to the second encryption permission value, the first encrypted file is decrypted based on the private key to obtain the first decrypted file, and the first decrypted file is provided to the first user.

[0012] Secondly, embodiments of this application provide a document processing apparatus, the apparatus comprising:

[0013] The first generation module is used to generate key pairs, the key pairs including a public key and a private key;

[0014] The first encryption module is used to encrypt the received initial file according to the public key to obtain a first encrypted file;

[0015] The second encryption module is used to encrypt the access permission value of the first user when receiving an access request from the first user for the first encrypted file, so as to obtain a first encrypted access permission value, wherein the access request carries the access permission value of the first user.

[0016] The third encryption module is used to encrypt the access permission threshold of the first encrypted file to obtain the second encryption permission value;

[0017] The first decryption module is used to decrypt the first encrypted file based on the private key when the first encryption permission value is greater than or equal to the second encryption permission value, to obtain the first decrypted file, and to provide the first decrypted file to the first user.

[0018] Thirdly, embodiments of this application provide an electronic device, including a processor.

[0019] The processor is used for:

[0020] Generate a key pair, which includes a public key and a private key;

[0021] The received initial file is encrypted using the public key to obtain the first encrypted file;

[0022] Upon receiving an access request from a first user to the first encrypted file, the access permission value of the first user is encrypted to obtain a first encrypted access value, and the access request carries the access permission value of the first user.

[0023] The access permission threshold of the first encrypted file is encrypted to obtain the second encrypted permission value;

[0024] If the first encryption permission value is greater than or equal to the second encryption permission value, the first encrypted file is decrypted based on the private key to obtain the first decrypted file, and the first decrypted file is provided to the first user.

[0025] Fourthly, embodiments of this application provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the file processing method described in the first aspect.

[0026] Fifthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the file processing method described in the first aspect.

[0027] In a sixth aspect, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the method described in the first aspect above.

[0028] In the file processing method of this embodiment, when a user needs to access a first encrypted file, an access request can be initiated. The access request can carry the user's access permission value, which can be encrypted to obtain a first encrypted permission value. Furthermore, the access permission threshold of the first encrypted file can be encrypted to obtain a second encrypted permission value. In the ciphertext state, the permission values ​​are compared—that is, the first encrypted permission value and the second encrypted permission value are compared. If the first encrypted permission value is greater than or equal to the second encrypted permission value, it indicates that the first user has permission to access the first encrypted file. Only then can the first encrypted file be decrypted based on the private key to obtain a first decrypted file, which is then provided to the first user. In other words, only when the permission values ​​are compared in the ciphertext state and the first encrypted permission value is greater than or equal to the second encrypted permission value can the first user access the first encrypted file, and only then can the first decrypted file of the first encrypted file be provided to the first user, thereby improving file security. Attached Figure Description

[0029] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This is one of the flowcharts of a file processing method provided in the embodiments of this application;

[0031] Figure 2 This is a second flowchart of a file processing method provided in an embodiment of this application;

[0032] Figure 3 This is the third flowchart of a document processing method provided in the embodiments of this application;

[0033] Figure 4 This is a basic information interface diagram of an office system for document forms, which is an application of a document processing method provided in this embodiment of the application.

[0034] Figure 5 This is a diagram of the document viewing interface of an office system in which a document processing method provided in this application embodiment is applied;

[0035] Figure 6 This is a diagram of an office system for editing official documents, based on a document processing method provided in this application embodiment;

[0036] Figure 7 This is a document flow visualization tracking diagram of an office system in which a document processing method is applied, as provided in an embodiment of this application.

[0037] Figure 8 This is a schematic diagram of the structure of a document processing device provided in an embodiment of this application;

[0038] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0039] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0040] See Figure 1 , Figure 1 This is a flowchart illustrating a file processing method provided in an embodiment of this application, applied to an electronic device. For example... Figure 1 As shown, the file processing method provided in this embodiment includes the following steps:

[0041] Step 101: Generate a key pair, which includes a public key and a private key.

[0042] The public key can be used for file encryption, and the private key can be used for file decryption. There are various ways to generate key pairs, and this application does not limit the specific methods. For example, as an example, algorithms such as lattice cryptography (lattice encryption algorithm) can be used to generate key pairs.

[0043] Step 102: Encrypt the received initial file using the public key to obtain the first encrypted file.

[0044] The initial file can be understood as a draft document that can be input into the system. The system can then receive the input initial file and encrypt it using a public key to enhance file security. Various encryption methods exist, and this application does not limit specific methods. It should be understood that the initial file is encrypted using a cryptographic algorithm corresponding to the key pair. For example, as an example, algorithms such as lattice cryptography can be used, but not limited to, to encrypt the initial file using the public key in the generated key pair to obtain a first encrypted file. This first encrypted file is stored for subsequent user access, modification, approval, etc.

[0045] Step 103: Upon receiving an access request from the first user for the first encrypted file, encrypt the first user's access permission value to obtain the first encrypted access permission value, and carry the first user's access permission value in the access request.

[0046] Step 104: Encrypt the access permission threshold of the first encrypted file to obtain the second encrypted permission value.

[0047] Step 105: If the first encryption permission value is greater than or equal to the second encryption permission value, decrypt the first encrypted file based on the private key to obtain the first decrypted file, and provide the first decrypted file to the first user.

[0048] When a first user needs to access a file, they can initiate an access request. Upon receiving the access request, the access permission value of the first user carried in the access request can be encrypted to obtain a first encrypted permission value, and the access permission threshold of the first encrypted file can be encrypted to obtain a second encrypted permission value. Then, the first encrypted permission value and the second encrypted permission value can be compared. If the first encrypted permission value is greater than or equal to the second encrypted permission value, it means that the first user has the permission to access the first encrypted file. Only then can the first encrypted file be decrypted based on the private key to obtain the first decrypted file, which is then provided to the first user, thus improving file security. As an example, the access permission threshold of the first encrypted file can be obtained from the metadata of the first encrypted file. The access permission threshold can represent the minimum permission value allowed. The access permission threshold of the first encrypted file can be preset according to the relevant attribute information of the first encrypted file (for example, including but not limited to the sensitivity of the first encrypted file).

[0049] In the file processing method of this embodiment, when a user needs to access a first encrypted file, an access request can be initiated. The access request can carry the user's access permission value, which can be encrypted to obtain a first encrypted permission value. Furthermore, the access permission threshold of the first encrypted file can be encrypted to obtain a second encrypted permission value. In the ciphertext state, the permission values ​​are compared—that is, the first encrypted permission value and the second encrypted permission value are compared. If the first encrypted permission value is greater than or equal to the second encrypted permission value, it indicates that the first user has permission to access the first encrypted file. Only then can the first encrypted file be decrypted based on the private key to obtain a first decrypted file, which is then provided to the first user. In other words, only when the permission values ​​are compared in the ciphertext state and the first encrypted permission value is greater than or equal to the second encrypted permission value can the first user access the first encrypted file, and only then can the first decrypted file of the first encrypted file be provided to the first user, thereby improving file security.

[0050] In some embodiments, decrypting the first encrypted file based on the private key includes:

[0051] Based on the private key and the access permission value of the first user, at least a portion of the ciphertext in the first encrypted file is decrypted, wherein the at least a portion of the ciphertext is the part that has access permission under the access permission value of the first user.

[0052] A higher access permission value indicates a higher access permission. Different access permissions can access different content. For example, a higher access permission value allows access to more content. Therefore, in this embodiment, to improve file security, decryption is allowed when the first encryption permission value is greater than or equal to the second encryption permission value. During the decryption of the first encrypted file based on the private key, at least a portion of the ciphertext in the first encrypted file that is allowed to be decrypted under the first user's access permission value can be decrypted.

[0053] In some embodiments, after providing the first decrypted file to the first user, the method further includes:

[0054] Receive the second file after the first user has modified the first decrypted file;

[0055] Update at least one of the encryption parameters to obtain the updated encryption parameters. The encryption parameters include at least one of the following: key pair; encryption dimension; encryption function; number of encryption rounds; encryption padding ratio.

[0056] The second file is encrypted using the updated encryption parameters to obtain the second encrypted file.

[0057] After providing the first decrypted file to the first user, the first user can view and review the first decrypted file. During the review process, modifications can be made to the first decrypted file, such as changing content or adding review comments, resulting in a second file. The encryption parameters can then be updated, and the updated encryption parameters are used to encrypt the second file, resulting in a second encrypted file. Because the encryption parameters can be continuously updated during the file encryption process, the security of the encrypted file is further enhanced. It can be understood that during the encryption of the initial file, the initial encryption parameters can be used for encryption; upon receiving the second file after modifications to the first decrypted file, the initial encryption parameters can be updated to obtain the updated encryption parameters, which are then used to encrypt the second file.

[0058] In some embodiments, updating at least one of the encryption parameters includes:

[0059] Update at least one of the encryption parameters based on at least one of the following:

[0060] The modifications made to the second file compared to the first decrypted file;

[0061] Sensitivity of the second document;

[0062] The weight of the department where the first user is located;

[0063] Document review process progress.

[0064] During the process of updating the encryption parameters, at least one of the following factors is considered: the modified content of the second file relative to the first decrypted file, the sensitivity of the second file, the weight of the department where the first user is located, and the progress of the file review process. This can improve the rationality of the encryption parameter update.

[0065] In some embodiments, a first encrypted file is stored in a blockchain, a second encrypted file is stored in a blockchain, and the blockchain is used to store the file and at least one of the following: file modification time, file modifier identifier, and file modification type.

[0066] In other words, a blockchain can not only store files, such as all encrypted files, including but not limited to the first encrypted file and the second encrypted file, but also store at least one of the following: file modification time, file modifier identifier, and file modification type, so as to facilitate subsequent understanding of file modification time, locating modifier, modification type, etc.

[0067] In some embodiments, after encrypting the second file based on the updated encryption parameters to obtain the second encrypted file, the method further includes:

[0068] Provide a second decrypted file to the second user. The second decrypted file is the file after decrypting the third encrypted file. The third encrypted file is the encrypted file that has been modified or reviewed by at least one user after the second encrypted file.

[0069] Receive a signing instruction for the second decrypted file input by the second user. The signing instruction carries access structure information, which is used to represent object information that has access permissions.

[0070] In response to the issuance command, an encryption key is generated;

[0071] Based on the encryption key and access structure information, the second decrypted file is encrypted to obtain the fourth encrypted file.

[0072] Throughout the document review process, as the review workflow progresses, after one user completes their review, the file is moved to the next node for review. This allows for continuous modification of the file, following the sequential review process. For example, the second encrypted file will be moved to the next user for review. After review, the next encrypted file is generated, and so on. The second user can be understood as the reviewer following the first user in the review process. The third encrypted file is the encrypted file that has been modified or reviewed by at least one user after the second encrypted file. The number of at least one user is related to the second user; that is, the reviewers between the first and second users in the review process. When the review progress reaches the second user, the third encrypted file has been modified or reviewed by at least one of these users after the second encrypted file. The second user needs to access the third encrypted file for review. At this point, the decrypted version of the third encrypted file and the decrypted version of the second encrypted file can be provided to the second user. As an example, the second user can be a user with countersigning permissions, such as a leader. For example, a third encrypted access permission value (e.g., obtained by encrypting the second user's access permission value using a homomorphic encryption algorithm) can be compared with a fourth encrypted access permission value of the third encrypted file's access permission threshold (e.g., obtained by encrypting the second user's access permission value using a homomorphic encryption algorithm). If the third encrypted access permission value is greater than or equal to the fourth encrypted access permission value, the third encrypted file can be decrypted to obtain a second decrypted file, and the second decrypted file can be provided to the second user.

[0073] After the second user verifies that the second decrypted file is correct, they can initiate a signing instruction. The system receives the signing instruction for the second decrypted file from the second user, which carries access structure information representing the objects with access permissions. In response to the signing instruction, an encryption key is generated. Then, based on the encryption key and the access structure information, the second decrypted file is encrypted to obtain a fourth encrypted file, thus improving file security. As an example, in each embodiment of this application, the encrypted files can be stored in the enterprise's private cloud and can also be stored in a blockchain.

[0074] In some embodiments, generating a key pair includes: generating a key pair based on a lattice cryptography algorithm;

[0075] Encrypting the access permission value of the first user to obtain the first encrypted access permission value includes: encrypting the access permission value of the first user based on a homomorphic encryption algorithm to obtain the first encrypted access permission value;

[0076] Encrypting the access permission threshold of the first encrypted file to obtain a second encrypted permission value includes: encrypting the access permission threshold of the first encrypted file based on a homomorphic encryption algorithm to obtain a second encrypted permission value.

[0077] It is understandable that, in the initial document drafting stage, a dedicated encryption key pair can be generated based on the principles of lattice cryptography. This process leverages the mathematical structure of the lattice problem, selecting specific vector combinations from the lattice space and performing complex calculations to form a public-private key pair. Its security is rooted in the discrete problem of lattice vectors, making it difficult to crack and ensuring strong encryption of the document from the source. Furthermore, in the access permission verification stage, homomorphic encryption algorithms can be used in conjunction to compare the ciphertext with the permission value processed by lattice cryptography and the permission threshold, strictly controlling access and thus strengthening data privacy protection, safeguarding the security of official documents at each stage, and improving overall security efficiency.

[0078] In some embodiments, the method further includes:

[0079] Build a multi-dimensional index for the stored encrypted files;

[0080] Encrypt the multi-dimensional index to generate a multi-dimensional encrypted index.

[0081] As an example, a multi-dimensional index can include, but is not limited to, at least two dimensions of indexes: subject keywords, generation time interval, and department. Encryption processing forms an encrypted index structure to ensure data security and facilitate searching. As an example, a general homomorphic cryptographic algorithm can be used to encrypt the multi-dimensional index.

[0082] In some embodiments, after encrypting the multi-dimensional index and generating the multi-dimensional encrypted index, the method further includes:

[0083] Upon receiving the input search character, the search character is encrypted to obtain the encrypted search character;

[0084] Matching is performed in a multi-dimensional encrypted index based on the search for encrypted characters;

[0085] Locate the encrypted file corresponding to the matching encrypted index.

[0086] In this embodiment, when searching for encrypted files, the user can enter search characters, which are then encrypted. The search is then performed in ciphertext mode to find the matching encrypted index, thus locating the corresponding encrypted file and completing the file search. This approach ensures data security while facilitating rapid file retrieval. As an example, a general homomorphic cryptographic algorithm can be used to encrypt the search characters.

[0087] The process of the above method will be specifically described below with some specific embodiments.

[0088] This application involves the following technical descriptions:

[0089] In today's digital office environment, official documents can be placed in specific isolated environments, such as corporate private networks or independent domains under private cloud architectures, to ensure document security to a certain extent. However, with the rapid development of information technology and the increasing complexity of cyber threats, data breaches and malicious tampering are rampant, posing a significant threat to document security. Therefore, for the sake of document security, even documents in specific isolated environments need to be encrypted to ensure their security.

[0090] In existing technologies, official documents can be encrypted using traditional encryption algorithms such as RSA and AES. The RSA encryption algorithm, built upon a specific mathematical problem, works by selecting two large prime numbers and deriving a public and private key through complex calculations. During encryption, plaintext is converted into ciphertext using the public key, while decryption relies on the private key to reconstruct the plaintext. However, with increasing security requirements and the continuous expansion of key sizes, the complexity of prime number factorization and related operations has skyrocketed, resulting in an exponential increase in computational load. In practical document encryption scenarios, such as processing important business documents or confidential government documents, this computational burden makes the encryption and decryption processes extremely slow, severely delaying document processing and significantly reducing office efficiency.

[0091] The AES encryption algorithm uses a symmetric encryption mode, processing data in fixed-length blocks. It performs well when encrypting static data, such as data stored in a database that remains unchanged for a long time, completing encryption tasks stably and efficiently. However, official document processing is often highly dynamic, frequently involving additions, deletions, modifications, and format adjustments. AES's fixed block pattern cannot flexibly adapt to these changes; each change may require re-encrypting large amounts of data, consuming excessive computing resources and creating complex key management challenges. Furthermore, its fixed encryption mode is easily analyzed by attackers. Attackers can analyze large amounts of ciphertext, uncovering patterns such as byte frequency and specific patterns, and then attempt to crack it using statistical methods, thus jeopardizing document security and failing to provide reliable security protection for official documents in dynamic office environments.

[0092] Traditional encryption techniques, such as RSA and AES, are used to encrypt official documents. However, RSA encryption relies on solving specific mathematical problems, and the computational cost increases with the key size, resulting in low encryption efficiency. AES, on the other hand, is difficult to handle dynamic document processing needs, and its fixed encryption pattern makes it easy to extract patterns and leave opportunities for attackers.

[0093] To address the problems in related technologies, this application proposes a document security management method based on lattice cryptography and federated computing, integrating the overall process of official document operations. This innovative approach combines lattice cryptography and federated computing technologies to construct a comprehensive document security management solution. During document creation, a public and private key is generated using a polynomial selected based on lattice cryptography, and the content is encrypted using the public key combined with a random polynomial. Departmental review verifies permissions through homomorphic encryption and dynamically adjusts parameters based on document sensitivity. Document changes are recorded using blockchain, and encryption parameters are updated according to the scope for re-encryption. In the signing stage, attribute encryption controls permissions, and an identifier is generated and embedded in the ciphertext during processing. For archiving, a multi-dimensional encrypted index system is constructed, and ciphertext data blocks are linked and integrated. This achieves a full-cycle, multi-layered, precise, flexible, and robust encryption protection architecture from source to archive, effectively mitigating risks, ensuring document confidentiality, integrity, and availability, and adapting to the needs of complex office scenarios.

[0094] The proposed solution integrates lattice cryptography with federated computing. Lattice cryptography uses public and private keys generated based on lattice puzzles to build an encryption foundation, which is then applied throughout the entire data interaction process of federated computing across multiple data sources. In the authorization verification stage, homomorphic encryption is used to compare the authorization value processed by lattice cryptography with the threshold in the ciphertext state, thereby strictly controlling access. This strengthens data privacy protection, safeguards the security of official documents at each stage, and improves overall security efficiency.

[0095] Furthermore, the embodiments of this application have made innovative improvements in the encryption and archiving storage stages. In the encryption stage, an encryption strength measurement standard is introduced that comprehensively considers the sensitivity of the document content, the importance of the departments involved, and the processing stage. Encryption parameters are adjusted based on this standard, such as increasing lattice dimensions and extending key length to improve security. When a document is changed, an adjustment coefficient is derived by combining the proportion of the change range, the encryption strength measurement results, the correlation between the changed content and the review opinions, and the sensitivity coefficient. This allows for precise adjustment of encryption parameters in the changed area, avoiding global re-encryption, improving encryption efficiency, and adapting to frequent change scenarios. In the archiving storage stage, an encrypted index system is constructed, including dimensions such as subject keywords, generation time interval, and department. After encryption processing, an encrypted index tree structure is formed to ensure data security and facilitate searching. An improved Bloom filter search encryption algorithm is used, mapping index information to the bitmap through multiple hash functions. The encrypted index tree nodes store relevant information. During retrieval, the search terms are encrypted and hashed before being compared in the bitmap ciphertext state. The algorithm can automatically adjust parameters and bitmap size according to the data volume, reducing false positives. This significantly improves the efficiency of quickly and accurately retrieving target documents from a large number of archived documents while ensuring data security.

[0096] The following is a general overview of the entire process of government business:

[0097] The official document workflow (also known as the document review process) mainly includes the following steps: drafting at headquarters or office, internal departmental review, countersigning, office verification, leadership signing, office processing, and archiving by the responsible department. Figure 2 As shown, each link is closely connected and operates in coordination, forming a rigorous and orderly system that ensures the efficient circulation and accurate processing of official documents.

[0098] In the drafting stage, the drafter initiates document creation via a designated path, edits the application form and main text, uploads attachments as needed, saves the initial draft, and submits it to initiate the approval process. In the internal departmental review stage, department heads review the document, focusing on content quality, compliance, and business relevance, recording their opinions and deciding whether to submit, return for revision, or reject it based on its status. In the inter-departmental review stage, relevant departments review the document in sequence, evaluating it from a professional perspective, extracting opinions, and then summarizing them before proceeding with the process. In the office review stage, a comprehensive check is conducted to ensure format compliance, accurate wording, logical coherence, and policy basis, with strict quality control. In the company leadership signing stage, core leaders conduct a final review, performing a macro-level assessment; if approved, it is signed off; otherwise, it is returned for adjustments. In the office processing stage, after signing, the document is assigned a special office number and sent according to the process, giving the document an identity identifier. In the organizing department archiving stage, the organizing department collects all versions of the document, approval opinions, processing records, and other materials, and stores them in a catalog according to archiving standards for easy retrieval and backtracking.

[0099] To enhance the security of official documents and achieve comprehensive security management, this application proposes a document security management method combining lattice cryptography and federated computing, which mainly includes the following five steps:

[0100] I. Encryption of Official Document Creation:

[0101] During the document drafting stage, a dedicated encryption key pair is generated based on the principles of lattice cryptography. This process leverages the mathematical structure of lattice cryptography, which is based on the lattice problem, to select specific vector combinations from the lattice space and form a public-private key pair through complex calculations. Its security is rooted in the lattice vector discrete problem, making it difficult to crack and ensuring strong encryption of documents from the source.

[0102] When drafters edit official documents, the system encrypts them in real time using a public key. For application forms, the main text, and attachments, the text is decomposed into vector elements according to the lattice dimension. A lattice basis reduction algorithm is used to obfuscate the element positions and values, transforming them into high-dimensional random ciphertext stored in a dedicated encryption container. The complex ciphertext structure significantly increases the cost of decryption, thus enhancing document security.

[0103] II. Encrypted Collaboration for Departmental Review:

[0104] The internal departmental review and countersigning process incorporates federated computing. When participating departmental nodes connect, the system uses federated computing to verify the matching degree between the node's identity and permissions and the encryption parameters. For example, when a department head reviews the application, their identity is verified through multi-factor authentication and associated with the corresponding lattice encryption level. Only compliant nodes can decrypt and view / annotate local ciphertext (such as specific chapters or fields) within the encryption framework according to their permissions. Annotations are circulated in an encrypted state, ensuring data privacy throughout the process and preventing information leakage and unauthorized access.

[0105] During the review process, federated computing dynamically adjusts encryption parameters based on multiple factors, including process progress, departmental professional weight, and document sensitivity. If the document involves critical decisions, highly classified data, or is transferred to core departments, it will automatically increase encryption parameters such as key dimension and change lattice basis vector, enabling the encryption space complexity to adaptively increase with the criticality of the process.

[0106] III. Management of Dynamic Changes to Official Documents:

[0107] When official documents are dynamically modified in content or format, federated computing leverages distributed ledger technology to accurately capture the details of the changes and the corresponding changes in encryption parameters. Each modification triggers a local encryption update strategy, determining the smallest encryption unit based on the scope of the modification. The federated computing nodes then collaboratively re-encrypt and adjust the documents, significantly reducing computational redundancy and ensuring dynamic and efficient adaptation to the pace of office work.

[0108] IV. Encryption Enhancement for Issuance Processing:

[0109] During the leadership signing process, the system strengthens encryption by integrating multiple factors (leadership authority, document attributes, and enterprise encryption strategies) based on the signing instructions. For example, it expands the lattice dimension and embeds digital signatures and timestamp encryption to doubly reinforce the authenticity, integrity, and non-repudiation of the document.

[0110] During office processing, documents are marked with serial numbers and other identifiers. These are then encrypted and embedded into the ciphertext through federated computing, forming a password string that identifies the document's flow, enabling full-process tracking and traceability. The encrypted identifiers work in tandem with the encrypted document body, being added, deleted, and updated according to process nodes. This ensures a transparent, orderly, and auditable processing flow, preventing process errors and misuse or theft of documents, and solidifying the encrypted order of office processes.

[0111] V. Encrypted Integration of Archive Storage:

[0112] When the organizing department archives documents, the federated computing system optimizes the encrypted storage architecture. It archives encrypted metadata based on the entire lifecycle of the document and integrates the encrypted storage structure, constructing an index that associates encrypted data blocks. For example, using subject, date, and department as index dimensions, the encrypted index and encrypted data are interlocked, achieving a balance between efficient retrieval and high-strength secure storage. This facilitates long-term archiving management while strictly protecting document confidentiality and avoiding the risk of data loss during the archiving period.

[0113] The embodiments of this application cover the entire lifecycle of official documents, with five closely linked steps from creation to archiving, forming a logically coherent and progressive encryption / decryption process.

[0114] The following example, using Company A's preparation for a new product launch project, illustrates the overall process of this solution. Assume that the company has drafted an official document involving the core functions of the new product, the launch plan, and the market strategy. During this process, the technical solutions in the document from step one to step five work closely together to ensure the security of the official document.

[0115] In the document creation encryption step of step one, a public-private key pair is generated based on the NTRU encryption scheme using a specific small polynomial. Assuming the company sets the parameter n=256, a polynomial public-private key is generated. When the drafter writes the document, the system groups the document content by bytes, maps it to a polynomial, and then encrypts it using the public key and a random polynomial. For example, if the document contains the sentence "The new product has facial recognition unlocking functionality," after grouping and mapping, it is encrypted using the public key and a random polynomial, transforming it into a complex ciphertext polynomial for storage. This ciphertext becomes the foundational data for subsequent processes.

[0116] Step two involves departmental review and encrypted collaboration, using the encrypted text from the previous step as the processing object. Relevant nodes, such as the marketing and technical departments, connect to the federated computing system. After multi-factor authentication, the reviewer's identity is verified, and the system uses homomorphic encryption technology to compare their permission value with the document's permission threshold in the encrypted state. For example, if the marketing manager has the authority to review the marketing strategy section, the system verifies their permission and allows them to decrypt, view, and annotate that section of the encrypted text; the annotations also circulate in encrypted form. Simultaneously, the federated computing system adjusts encryption parameters based on factors such as document sensitivity, departmental weight, and process progress, such as increasing the lattice dimension to enhance encryption effectiveness. The reviewed encrypted text then proceeds to the next step.

[0117] In step three, dynamic change management of official documents, if the technical department finds that the description of new product features in an official document needs to be modified, the federated computing uses the blockchain to record the modification information. For example, if the modification "improves the recognition speed of the facial recognition unlock function from 0.5 seconds to 0.3 seconds," the blockchain records the modification time, personnel, and content. At the same time, based on factors such as the modification range coefficient, the volatility of the changed content, and the complexity of the format change, the encryption coefficient is optimized in conjunction with the encryption strength coefficient in step two. The modified area is re-encrypted to avoid global re-encryption. The processed ciphertext then enters the signing stage.

[0118] Step four involves enhanced encryption during the issuance process. When a senior leader issues a document, the system strengthens encryption based on the leader's authority, document attributes, and the company's encryption strategy. For example, it expands the lattice dimension and embeds digital signatures and timestamps for encryption. During office processing, serial numbers and other identifiers are added to the document, and these are then encrypted and embedded into the ciphertext through federated computation. For example, if the serial number is "20240101001" and the document number is "XM-001", these identifiers are encrypted and embedded, forming a traceable cipher string to ensure a secure and orderly process. The processed ciphertext then enters the archiving stage.

[0119] The final step, step five, involves encrypted archiving and storage integration. When the organizing department archives documents, the federated computing system optimizes the encrypted storage architecture. A multi-dimensional encrypted index system is constructed, using themes (new product launches), dates (launch times), and departments (involved departments) as index dimensions. For example, indexing by theme allows for quick location of documents related to new product launches. An improved Bloom filter is used to search for encrypted algorithms, optimizing storage and retrieval performance. Ciphertext is subdivided into data blocks, generating unique identifiers, and an association matrix is ​​constructed to store the relationships between data blocks, relying on enhanced encryption graph database technology for storage. If the new product launch strategy needs to be reviewed later, the ciphertext blocks can be quickly located through the index, and the documents can be reassembled according to the association matrix, achieving efficient retrieval and secure storage.

[0120] From creation to archiving, the output of each step becomes the input of the next step. The encryption of the previous step provides a security foundation for the next step, and the next step deepens encryption and improves management based on the former. Different encryption and decryption steps are closely linked to comprehensively protect the security of official documents and ensure that information related to the release of new products is securely transferred and stored within the enterprise.

[0121] The specific technical process is as follows: Figure 3 As shown below, in conjunction with Figure 3 Each of these five technical steps will be explained in detail:

[0122] Step 1: Create and encrypt official documents:

[0123] First, an initial encryption key needs to be generated. This scheme uses the NTRU encryption scheme and selects two small polynomials. and Their coefficients are defined on a specific integer ring. Inside. Among them, `u[i]` is a positive integer, and its value determines the degree of the polynomial and the dimension of the encryption. Typically, in practical applications, to balance security and computational efficiency, `u[i]` is used... 256 or 512 are commonly chosen. For example, ,in for The coefficient, and Similarly, , value range and same.

[0124] Private key Set directly to public key The calculation requires the use of formulas. The conclusion is as follows. Among them, For example, a small integer Its main function is to control the scaling ratio during the encryption process, ensuring the reversibility of subsequent calculations and the rationality of the ciphertext. express In the ring The multiplicative inverses within the polynomial ring are solved using the extended Euclidean algorithm, which is based on the Euclidean algorithm principle. Find satisfaction of Thus, the public key is obtained. This enables the use of public keys later. Encryption, and private key Decrypt.

[0125] For example, a technology company plans to release a confidential business document containing new product development plans and core technical specifications. First, n=256 is set, and the results are randomly generated according to specific rules. and .For example, (This is just an example; the actual generation will be more complex.) (This is just an example; the actual generation process is more complex.) Following the calculation process described above, a public-private key pair is derived. Subsequently, from its initial drafting to final archiving, this confidential business document relies entirely on this key pair to strictly control access permissions. The drafter uses the public key. The encrypted files are stored in a highly secure private cloud environment within the enterprise, accessible only to those holding the private key. Only authorized personnel can access and process the contents of documents by performing decryption operations based on the strict mathematical relationships in the NTRU encryption system, thereby effectively ensuring the security of confidential documents.

[0126] After generating the public-private key pair, the generated public key is used through text grouping and multinomial mapping. The document content is encrypted. First, the document content is grouped into bytes, and each byte sequence is treated as a coefficient vector of a polynomial, i.e. .here, This represents the byte value at the corresponding position after byte grouping, and its range depends on the byte encoding method (such as ASCII or UTF-8). For example, for a byte group of [0x41, 0x42, 0x43] (corresponding to ASCII 'ABC'), if n=8, then... (For simplicity, the filling of a complete nth-degree polynomial is not considered here).

[0127] Then, the encryption function is performed, and the encryption function is: ,in The generated ciphertext polynomial; It is a random polynomial with coefficients Randomly select from a specific value range. For example, it can be set to... The ciphertext is encrypted by uniformly selecting random values ​​within the range [0, 255] (matching the byte value range), the purpose of which is to greatly increase the randomness and unpredictability of the ciphertext. For the byte block encryption example "ABC" above, if the public key... Known, and randomly generated ,but The complex ciphertext polynomial is obtained after calculation. The actual document content is encrypted group by group, completely losing the original logic and pattern, presenting as a series of complex and disordered polynomial combinations, stored in an encrypted storage area. Decryption is performed using the private key. Through reverse operation Accurately restores the original text. Leveraging the unique characteristics of lattice encryption, official document content is efficiently transformed from intuitive text into a high-dimensional, complex polynomial encrypted storage space, effectively resisting various common attack methods, including brute-force attacks and statistical analysis, and providing full protection for the flow of confidential business documents within the complex office environment of an enterprise.

[0128] Step Two: Departmental Review and Encrypted Collaboration

[0129] Homomorphic encryption is used for permission verification and encrypted data processing during authorization review and encryption. The homomorphic encryption function is set to... ,in This is plaintext data. Its core characteristic lies in the fact that performing specific operations on the ciphertext yields a result that, after decryption, is equivalent to performing the same operations on the corresponding plaintext. and ,satisfy (Additive homomorphism) or Properties such as (multiplicative homomorphism) can be specifically determined based on the homomorphic encryption scheme used. This characteristic ensures data privacy during the audit process.

[0130] Set the reviewer's permission value to In the federated computing system, it is uniquely identified. Identification; Access thresholds embedded in encrypted metadata of official documents This is to define access permissions for different areas. When an audit is initiated, the system uses a homomorphic encryption algorithm. right Encryption Subsequently, with encrypted document permission parameters The comparison operation is performed in the ciphertext state according to the homomorphic encryption property, such as using a specific homomorphic comparison function for judgment. Is the condition met? If the condition is met, the reviewer can decrypt the corresponding encrypted area according to the established rules after authorization verification; otherwise, access will be denied to ensure that only authorized personnel can process the corresponding sensitive content of the document during the review process, preventing data leakage and unauthorized alteration.

[0131] When optimizing dynamic encryption parameters, first consider the sensitivity of the official document. Departmental weight and process progress stages To optimize encryption strength, the core formula is: .in, The encryption strength coefficient directly determines the adjustment range of the encryption parameters. As the value increases, the lattice dimension will increase accordingly, the key length will be extended, the core parameters of the encryption function will be updated, or the encryption algorithm will be switched. This is especially relevant when handling highly sensitive documents in critical review stages. The value will increase significantly. At this point, the original 128-bit key may be expanded to 256 bits. At the same time, the lattice encryption dimension is increased, and the initial value of the encryption function is changed, so that the ciphertext block is upgraded from low-dimensional lattice structure encryption to high-dimensional encryption, which greatly enhances the encryption level, effectively resists potential security threats, and ensures the security of official documents during the review process. This serves as the initial encryption strength coefficient, providing a baseline value for adjustment. , , These are weighting coefficients, precisely set according to the enterprise's security strategy and business characteristics, such as risk control being prioritized for financial enterprises. A high (corresponding department weight) value indicates a greater degree of collaborative shaping and adjustment.

[0132] Sensitivity A quantitative score is assigned based on the breadth, depth, and commercial value of the information's potential impact, ranging from 0 to 10, with higher values ​​indicating greater sensitivity; departmental weighting is also considered. The weighting is determined based on the criticality of departmental functions and the proportion of decision-making levels; for example, core R&D departments have a higher departmental weighting. (Process stages...) The process is scored based on the criticality of each stage, with values ​​ranging from 0 to 1. For example, the decision-making and approval stage has a higher value. Substituting the parameter values ​​into the formula yields... ,according to Precisely adjust encryption parameters, such as increasing lattice dimension, extending key length, updating core encryption function parameters, or switching encryption algorithms, to ensure that the encryption strength of official documents throughout the entire process matches the dynamics of business, dynamically enhance information protection, and adapt to the diverse needs of complex office processes.

[0133] For example, based on the sensitivity of confidential research and development documents Departmental weight and process progress stages Optimized encryption, core formula , Sensitivity of core technology documents for new products (Involving breakthroughs in cutting-edge technologies); Departmental weight of the R&D department (For core departments); Technical Committee final review stage (For key decisions). Substituting into the core formula yields... According to this The value, along with a preset encryption strength coefficient threshold, determines whether to upgrade the encryption strength. When the value exceeds the preset encryption strength threshold, the encryption strength will be upgraded, expanding the original 128-bit key to 256 bits and increasing the lattice encryption dimension (the specific increase can be customized) to dynamically enhance the encryption level. For example, the ciphertext block is upgraded from 4-dimensional to 8-dimensional lattice structure encryption to prevent leakage in highly sensitive processes and optimize the encryption strength to adapt to the business rhythm.

[0134] Step 3: Dynamic Change Management of Official Documents

[0135] In this step, a document modification tracking system is constructed using the decentralized and immutable characteristics of blockchain. Its data structure consists of a block header and a block body. Key parameters in the block header include a timestamp. It uses Unix timestamps to precisely record the time of modification, accurate to the millisecond level (e.g., 1640995200123), ensuring the uniqueness of the time and accurately anchoring the modification time; modifier identifier. The unique identifier, derived from the enterprise's employee identity authentication database, accurately identifies the person who made the modification; the hash value of the previous block. By using algorithms such as SHA-256 to calculate all data in the preceding blocks, a fixed 256-bit hash value is generated, forming the core link of the chain structure to ensure the integrity and continuity of the block order; Merklegen hash value It is calculated by constructing a Merkle tree from the hash values ​​of all modified record data blocks in the block body, and is used to quickly verify data integrity and consistency, and improve the efficiency of tamper detection.

[0136] The block stores modification details, including a strict classification coding system (such as '001' for text insertion, '002' for paragraph deletion, '003' for formatting changes, and '004' for image replacement) to accurately identify the modification type of the modification action. The document character or byte offset marks the start and end positions of the modification (e.g., text modification starting at byte 100 and ending at byte 200 is marked as [100, 200]), to accurately locate the modification position index of the modification range. ;Regarding the hash value of the ciphertext fragment before modification Hash value of the modified ciphertext fragment Strong hash algorithms such as SHA-3 are used to ensure accurate and reliable verification of the integrity of encrypted fragments. Modified blocks are chained together in timestamp order, forming a complete, traceable, and attack-resistant ledger recording the modification trajectory from the creation of the document.

[0137] During the dynamic encryption update process, a set of encrypted parameters for official documents is constructed. Furthermore, by quantifying the modification range coefficient, determining the adjustment coefficient based on the encryption strength coefficient, and comprehensively considering the correlation degree and sensitivity coefficient, the encryption parameters are precisely adjusted to achieve efficient re-encryption of the modified area. The key length of the core symmetric encryption algorithm (such as AES) (which can be 128 bits, 256 bits, etc.) directly determines the size of the encryption key space and the resistance to brute-force attacks. The lattice encryption dimension parameter (the value range is set to 4-16 dimensions depending on the encryption strength requirements) is used to control the complexity and concealment of the ciphertext distribution in the lattice space; This is the number of encryption rounds parameter (common values ​​are 6-14 rounds). Multiple rounds of encryption improve the data obfuscation and diffusion effect and enhance security. Set the random padding factor (value 0.1-0.5) to add a random byte padding amount to the encrypted data block, increasing the randomness of the ciphertext and making it more resistant to analysis attacks.

[0138] Quantify the modification range coefficient based on the modification range. It needs to be accurate to two decimal places (e.g., if you modify 23.56% of the document content, then...). The local encryption update formula is: ; ; ; Adjustment coefficient The initial value is determined by the encryption strength coefficient in step 2. The value is determined. That is, when The larger the value, The closer to 1, the more due to A higher value indicates a higher security risk to the document during the review stage, requiring stronger encryption protection. The closer the value is to 1, the greater the adjustment range of encryption parameters when official documents are changed, which can perfectly match the high security requirements of the review stage and ensure the security of official documents throughout their entire life cycle.

[0139] When official documents are amended, the correlation between the amended content and the key points highlighted in the review comments can also be analyzed. Text comparison technology can be used to calculate the overlap ratio between the amended content and the key content marked in the review comments. (The value range is [0,1]), then .

[0140] In addition, a sensitivity coefficient can be introduced. Among them, the sensitivity coefficient Determined based on the company's risk appetite and the sensitivity level of the document (e.g., for highly sensitive documents, For moderately sensitive official documents, For low-sensitivity official documents, The final formula is: This ensures that each parameter is adapted to the modification range, accurately improving encryption strength. According to Re-encrypting the modified area can avoid wasting resources on global re-encryption.

[0141] Step 4: Encryption and Enhancement of Issuance Processing:

[0142] In this step, strong encryption can be applied during the issuance process. Attribute set. middle, For departmental attributes, use a 32-bit globally unique identifier (GUID) for encoding, such as the R&D department code as "{12345678-1234-1234-1234-123456789012}"; It is a job level attribute, which is assigned an 8-digit code according to the company's job level system, starting from "00000001" and incrementing. "00000100" represents a middle management level. Project role attributes are encoded using 16-bit characters; "PROJ_LEAD" represents the project leader. The access structure T is a Boolean logic tree, where nodes are combinations of attributes and threshold values, such as... This indicates that middle and senior management in the R&D department or project leaders can access the corresponding encrypted text.

[0143] Then, the system determines the access structure. With master key (Generated and securely stored by the enterprise key management system, it is an attribute encryption root key generated from a 256-bit symmetric key using a complex derivation algorithm), representing a ciphertext fragment of an official document. Generate encryption key The encryption algorithm is... , The plaintext fragment is represented by Enc, which is the CP-ABE encryption function that converts the plaintext into ciphertext. and Strong binding, only attribute matching Users can unbind their accounts, allowing for fine-grained control of access permissions based on attribute encryption, thus enhancing the security of accessing sensitive content in issued official documents.

[0144] After generating the encryption key, an encryption identifier is generated and embedded. A unique identifier for the document is then generated. Use version 4 UUID (format: xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx; x is 0-9 or a random character; y is 8, 9, a or b). Construct an encrypted identifier set. , The process step is coded as an 8-digit number. According to the enterprise's BPMN process model definition, "00000100" represents project approval. It is about processing timestamps. Precision is achieved using the ISO8601 high-precision format, accurate to the nanosecond (e.g., 2023-09-15T12:30:00.123456789Z). For personnel identification Extract the 32-bit numeric code from the enterprise LDAP directory service. Encrypt using the AES-256 algorithm. key The key is periodically updated and distributed by the enterprise key management module, and then encrypted. .

[0145] Then, based on the document format, embed the identifiers, such as the XML structure of an Office document, and add custom elements. <encryptedmarker>Placed in the document metadata area, the content is PDF documents are written using Acrobat's predefined extended fields; binary format documents reserve 256 bytes of space in the header, with the first 128 bytes stored. The last 128 bytes are stored It accurately embeds identifiers into encrypted text, tracks the entire processing trajectory, protects the encryption integrity and auditability of office processes, and improves the accuracy of process management and the depth of secure collaboration.

[0146] Step 5: Encrypted Integration of Archive Storage

[0147] In this step, we first construct a multi-dimensional index encryption system, which includes a set of index dimensions. middle, For the keyword indexing dimension, deep natural language processing technology is used to accurately extract core keywords from official document content. These keywords are then converted into a machine-processable format through one-hot encoding or more compact distributed word vector encoding. Taking a corporate market research report as an example, keywords such as "consumer preferences" and "competitive analysis" are extracted and encoded as... Index values ​​improve the accuracy of semantic retrieval; For the time interval index dimension, a high-precision timestamp processing algorithm is used to divide the intervals. In addition to the regular year, month and quarter intervals, custom intervals can be set as needed (such as a specific time range within the "major project cycle"). After time zone calibration and timestamp difference encoding storage, the flexibility of time dimension retrieval is enhanced. For the departmental affiliation index dimension, the unique departmental identifier assigned by the enterprise identity management system is used to locate the document affiliation, ensuring the accuracy and uniqueness of the departmental index. Each dimension's index value is encrypted using an advanced homomorphic encryption algorithm to construct an encrypted index tree structure. During searches, the encrypted block is located within the encrypted value range through efficient comparison in the encrypted state, ensuring data confidentiality while optimizing retrieval efficiency.

[0148] Then, an improved Bloom filter searchable encryption algorithm is selected to construct a Bloom filter bitmap structure for the index values. Multiple independent hash functions (such as a combination of MurmurHash functions) are used to hash and map the index values ​​to the bitmap. The encrypted index tree nodes store the bitmap and corresponding ciphertext block pointers. During a search, the user enters search terms, which are then encrypted and hashed. The results are compared in the bitmap's ciphertext state to determine if a match is found, and the decryption is returned when a ciphertext block pointer is matched. This algorithm reduces the false positive rate of ciphertext retrieval while dynamically adjusting the hash function parameters and bitmap size to adaptively optimize storage and retrieval performance according to data growth, ensuring that enterprise archived documents can be retrieved quickly, accurately, and securely even under long-term, massive storage.

[0149] The encrypted official document is subdivided into sets of data blocks. Generate a unique identifier for each block. The data block content is hashed using the SHA-3 hash algorithm, and then protected for identifier security and uniqueness using RSA encryption (public key from an enterprise certificate authority). An association matrix is ​​then constructed. The logical relationships between data blocks are mined and their correlation is quantified using text structure analysis algorithms (such as dependency parsing and semantic role labeling). For example, in corporate annual financial reports, the balance sheet and income statement data blocks are closely related due to data references. The note explains that the block relevance is set to a value between 0.4 and 0.7 based on content relevance. The matrix is ​​stored in a dedicated encrypted database table (such as a relational database table structure using AES-256 encryption or a NoSQL database architecture adapted for encrypted storage) to ensure the confidentiality and integrity of the associated information.

[0150] Leveraging enhanced encryption graph database technology (such as the JanusGraph graph database encryption plugin integration), and employing encrypted graph database storage technology, data blocks are treated as nodes, and their association is stored as edge weights. This encrypted graph structure ensures data logic and confidentiality. During retrieval and access, the starting block is located based on the index, and the encrypted block links are traversed according to the association matrix to decrypt and reconstruct the complete document. This ensures that archived documents are logically intact and traceable under encrypted storage, facilitating future auditing and reuse, and enhancing the security of the entire enterprise document management lifecycle.

[0151] This application's embodiments innovatively integrate lattice cryptography and federated computing technologies, optimizing them from multiple aspects. In the encryption stage, key pairs are generated based on lattice cryptography principles, such as using the NTRU encryption system to select small polynomials to generate public and private keys, improving encryption efficiency and security. During departmental review, federated computing and homomorphic encryption technologies are used to accurately compare permission values ​​and thresholds in ciphertext, achieving refined permission control. When official documents are dynamically changed, blockchain records modification details, and encryption parameters are locally optimized and adjusted based on the modification range, avoiding global re-encryption and improving processing efficiency. During archiving and storage, a multi-dimensional encrypted index system is constructed combined with an improved Bloom filter searchable encryption algorithm, enhancing retrieval efficiency and data confidentiality. These improvements comprehensively enhance the level of official document security management and effectively solve the shortcomings of related technologies.

[0152] Furthermore, in the encryption process, a standard for measuring encryption strength based on multiple factors is introduced. This standard comprehensively considers factors such as the sensitivity of the document content, the importance of the departments involved, and the stage of the document processing workflow. The results calculated based on these factors determine the adjustment range of encryption parameters, such as increasing the lattice dimension used for encryption or extending the key length, thereby improving encryption security. When the document content changes, a proportional value is determined based on the size of the change. Simultaneously, combined with the previously calculated encryption strength measurement results, the correlation between the changed content and previous review comments, and the sensitivity coefficient set according to the document's sensitivity level, an adjustment coefficient is derived. Using this adjustment coefficient, various parameters in the encryption process are precisely adjusted, encrypting only the changed areas of the document, avoiding re-encrypting the entire document. This reduces the waste of computational resources, improves encryption efficiency, and allows the encryption process to better adapt to office scenarios with frequent document changes.

[0153] Furthermore, in the document archiving and storage stage, a multi-dimensional encrypted index system was created. These dimensions include the document's subject keywords, generation time range, and department. After encrypting this index information, an encrypted index tree structure is constructed, ensuring data security while facilitating rapid document retrieval. An improved Bloom filter searchable encryption algorithm is also employed, using multiple different hash functions to transform and map the index information into bitmaps. The nodes of the encrypted index tree store these bitmaps and pointers to the corresponding ciphertext blocks. When retrieving a document, the user's search terms are first encrypted and hashed, then compared against the ciphertext state of the bitmap. Once a matching ciphertext block pointer is found, the document is decrypted and read. This algorithm automatically adjusts the hash function parameters and bitmap size according to changes in data volume, reducing erroneous judgments during retrieval and significantly improving the efficiency of quickly and accurately retrieving target documents from a large number of archived documents while ensuring data security.

[0154] The solutions implemented in this application can achieve the following:

[0155] In the encryption process, based on the principle of lattice cryptography, the NTRU encryption system selects a small polynomial to generate public and private keys, significantly improving encryption efficiency. This allows for the encryption of a large number of documents in a short time, and its lattice-problem-based nature ensures extremely high security, effectively resisting various attacks. During departmental review, federated computing and homomorphic encryption technology are used to accurately compare permission values ​​and thresholds in ciphertext, achieving precise access control. Different personnel can only operate within their authorized scope, greatly reducing the risk of information leakage. When documents are dynamically changed, blockchain records the modification details and performs local encryption adjustments, avoiding global re-encryption and significantly saving computing resources and time, enabling encryption processing to keep pace with business changes. For archiving and storage, a multi-dimensional encrypted index system combined with an improved Bloom filter searchable encryption algorithm not only ensures data confidentiality but also makes retrieval fast and accurate, improving document management efficiency.

[0156] By comprehensively considering factors such as document sensitivity, the importance of the departments involved, and the stage of the processing flow, the encryption strength can be flexibly adjusted according to the actual risk status of the document. For highly sensitive documents in critical processes, increasing the encryption strength coefficient, improving the lattice dimension, and extending the key length significantly enhances encryption security. When a document is amended, an adjustment coefficient is derived by combining the scope of the amendment, the relevance to the review comments, and the sensitivity coefficient. Encryption parameters are optimized and re-encrypted only in the amended area, avoiding the waste of resources from global re-encryption. This improves encryption efficiency and allows for precise adjustments to encryption strength based on the specific circumstances of each amendment, better adapting to complex and ever-changing office scenarios.

[0157] The multi-dimensional encrypted indexing system indexes official documents based on keywords, time intervals, and department affiliation, and encrypts the index values, significantly improving retrieval accuracy and speed while ensuring data security. The improved Bloom filter searchable encryption algorithm maps index information to a bitmap using multiple hash functions, encrypts the index tree node storage bitmap and ciphertext block pointers, and performs comparisons in the ciphertext state during searches, enabling rapid location of the target ciphertext block. This algorithm can also automatically optimize based on changes in data volume, reducing false positives and achieving efficient, accurate, and secure retrieval of massive amounts of archived documents, thus enhancing enterprises' management and utilization capabilities of archived documents.

[0158] The solutions proposed in this application can be applied to multiple key areas. Leveraging the deep integration of advanced technologies such as lattice cryptography and federated computing, they can build data security barriers for enterprises and various organizations, significantly enhancing data security trust. Whether it's financial institutions protecting customer confidentiality or high-tech enterprises safeguarding innovative achievements, they can effectively reduce security risks. Simultaneously, features such as dynamic encryption parameter optimization, local encryption updates, and a multi-dimensional index encryption system significantly improve office efficiency and facilitate compliant operations while ensuring security. For example, medical enterprises can achieve efficient and secure management of medical records and R&D documents.

[0159] Furthermore, the multi-departmental secure collaboration mechanism enabled by federated computing and attribute encryption can promote information sharing and collaboration among enterprise groups, multinational corporations, and multi-party cooperative projects, such as eliminating security concerns in supply chain collaboration and joint R&D. In practical applications, it can be deeply integrated into enterprise office automation systems, e-government systems, financial industry document management systems, and medical industry electronic medical records and scientific research document management products, comprehensively empowering information security management across various industries and driving steady business development.

[0160] The solution presented in this application can be applied to collaborative office products. It is based on a cloud-based unified information platform and modified to support document workflows within a cybersecurity environment. Documents located in specific isolated environments require high-level protection to ensure document security.

[0161] To meet the document security requirements of the information network environment, the project combines the overall document business process and adopts a document security management method based on lattice cryptography and federated computing. It innovatively integrates lattice cryptography and federated computing technologies to build a full-domain document security management solution. This solution achieves a full-cycle, multi-layered, precise, flexible, and robust encryption protection architecture from source to archive, strictly controls access and strengthens data privacy protection. It adapts to the security protection needs of complex office scenarios, protects the security of documents at all stages, improves overall security efficiency, effectively resists risks, and ensures the confidentiality, integrity, and availability of documents.

[0162] Furthermore, the solutions in this application embodiment can be specifically applied to OA office systems. For example, the office system can support various business scenarios such as official document processing and administrative office work through graphical rapid development and configuration capabilities. It provides a control-free, user-friendly document editor with automatic red-marking, automatic formatting, and WYSIWYG functionality. Based on AI+official documents, it offers rich intelligent document applications, supports visualized process tracking and business operation monitoring and analysis, and helps enterprises achieve digital office transformation and upgrading. As an example, the application interface of this office system is as follows: Figure 4-7 As shown. Figure 4 This is a sample screenshot of the basic information interface of an office system's document form. For example, if the system is currently in the document drafting stage, the user can draft documents on the interface, such as drafting an internal audit report. Figure 5 This is a sample screenshot of an office system's document viewing interface (minimalist mode). Users can view drafted documents, such as the content of the Test Department Business Bulletin-2. Figure 6 This is a sample diagram of an office system for editing official document text (title settings). Users can edit the document text and perform other tasks within the interface. Figure 7 This is a sample document workflow visualization tracking diagram for an office system. For example, during the drafting stage, a document can be drafted. The drafted document can be sent to the department head for review. The department head can then send it to relevant departments for countersigning. During the countersigning process, additional countersigning personnel can be added. Further processing can be done by personnel within the countersigning departments. After processing, the document is returned to the relevant departments for countersigning. Once countersigned, it is sent back to the department head for review. The department head can also add a reviewer / caretaker. After the department head's review, the drafter can send the document. This document workflow visualization tracking diagram allows users to easily view the current stage of a document.

[0163] like Figure 8 As shown, Figure 8 This is a schematic diagram of the structure of a file processing device 800 provided in an embodiment of this application, as shown below. Figure 8 As shown, the document processing device 800, applied to electronic devices, includes:

[0164] The first generation module 801 is used to generate key pairs, which include a public key and a private key.

[0165] The first encryption module 802 is used to encrypt the received initial file according to the public key to obtain the first encrypted file;

[0166] The second encryption module 803 is used to encrypt the access permission value of the first user when it receives the first user's access request for the first encrypted file, so as to obtain the first encrypted access permission value, and the access request carries the first user's access permission value.

[0167] The third encryption module 804 is used to encrypt the access permission threshold of the first encrypted file to obtain the second encryption permission value;

[0168] The first decryption module 805 is used to decrypt the first encrypted file based on the private key when the first encryption permission value is greater than or equal to the second encryption permission value, to obtain the first decrypted file, and to provide the first decrypted file to the first user.

[0169] In some embodiments, decrypting the first encrypted file based on the private key includes:

[0170] Based on the private key and the access permission value of the first user, at least a portion of the ciphertext in the first encrypted file is decrypted, wherein the at least a portion of the ciphertext is the part that has access permission under the access permission value of the first user.

[0171] In some embodiments, the apparatus further includes:

[0172] The first receiving module is used to receive the second file after the first user has modified the first decrypted file;

[0173] The first update module is used to update at least one of the encryption parameters to obtain the updated encryption parameters. The encryption parameters include at least one of the following: key pair; encryption dimension; encryption function; number of encryption rounds; encryption padding ratio.

[0174] The fourth encryption module is used to encrypt the second file based on the updated encryption parameters to obtain the second encrypted file.

[0175] In some embodiments, updating at least one of the encryption parameters includes:

[0176] Update at least one of the encryption parameters based on at least one of the following:

[0177] The modifications made to the second file compared to the first decrypted file;

[0178] Sensitivity of the second document;

[0179] The weight of the department where the first user is located;

[0180] Document review process progress.

[0181] In some embodiments, a first encrypted file is stored in a blockchain, a second encrypted file is stored in a blockchain, and the blockchain is used to store the file and at least one of the following: file modification time, file modifier identifier, and file modification type.

[0182] In some embodiments, the apparatus further includes:

[0183] The module provides a second file for encrypting the second file based on the updated encryption parameters in the fourth encryption module. After obtaining the second encrypted file, the module provides a second decrypted file to the second user. The second decrypted file is the file after decrypting the third encrypted file. The third encrypted file is the encrypted file that has been modified or reviewed by at least one user after the second encrypted file.

[0184] The second receiving module is used to receive the signing instruction for the second decrypted file input by the second user. The signing instruction carries access structure information, which is used to represent object information that has access rights.

[0185] The second generation module is used to generate an encryption key in response to the issuance command;

[0186] The fifth encryption module is used to encrypt the second decrypted file according to the encryption key and access structure information to obtain the fourth encrypted file.

[0187] In some embodiments, generating a key pair includes: generating a key pair based on a lattice cryptography algorithm;

[0188] Encrypting the access permission value of the first user to obtain the first encrypted access permission value includes: encrypting the access permission value of the first user based on a homomorphic encryption algorithm to obtain the first encrypted access permission value;

[0189] Encrypting the access permission threshold of the first encrypted file to obtain a second encrypted permission value includes: encrypting the access permission threshold of the encrypted file based on a homomorphic encryption algorithm to obtain a second encrypted permission value.

[0190] In some embodiments, the apparatus further includes:

[0191] The index building module is used to build multi-dimensional indexes for stored encrypted files;

[0192] The sixth encryption module is used to encrypt the multi-dimensional index and generate a multi-dimensional encrypted index.

[0193] In some embodiments, the apparatus further includes:

[0194] The seventh encryption module is used to encrypt the search characters upon receiving them, thus obtaining encrypted search characters.

[0195] The index matching module is used to perform matching in a multi-dimensional encrypted index based on the search encrypted characters;

[0196] The file location module is used to locate the encrypted file corresponding to the matching encrypted index.

[0197] The file processing device 800 provided in this embodiment can implement each process of the above-described file processing method, with one-to-one correspondence of technical features and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0198] This application also provides an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, it implements the various processes of the above-described file processing method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0199] For details, see Figure 9 This application also provides an electronic device, including a bus 901, a transceiver 902, an antenna 903, a bus interface 904, a processor 905, and a memory 906.

[0200] The processor is used for:

[0201] Generate a key pair, which includes a public key and a private key;

[0202] The first encrypted file is obtained by encrypting the received initial file using the public key;

[0203] Upon receiving a request from the first user to access the first encrypted file, the first user's access permission value is encrypted to obtain the first encrypted access permission value, and the access request carries the first user's access permission value.

[0204] The access permission threshold of the first encrypted file is encrypted to obtain the second encrypted permission value;

[0205] If the first encryption permission value is greater than or equal to the second encryption permission value, the first encrypted file is decrypted based on the private key to obtain the first decrypted file, which is then provided to the first user.

[0206] In some embodiments, decrypting the first encrypted file based on the private key includes:

[0207] Based on the private key and the access permission value of the first user, at least a portion of the ciphertext in the first encrypted file is decrypted, wherein the at least a portion of the ciphertext is the part that has access permission under the access permission value of the first user.

[0208] In some embodiments, the processor is further configured to:

[0209] Receive the second file after the first user has modified the first decrypted file;

[0210] Update at least one of the encryption parameters to obtain the updated encryption parameters. The encryption parameters include at least one of the following: key pair; encryption dimension; encryption function; number of encryption rounds; encryption padding ratio.

[0211] The second file is encrypted using the updated encryption parameters to obtain the second encrypted file.

[0212] In some embodiments, updating at least one of the encryption parameters includes:

[0213] Update at least one of the encryption parameters based on at least one of the following:

[0214] The modifications made to the second file compared to the first decrypted file;

[0215] Sensitivity of the second document;

[0216] The weight of the department where the first user is located;

[0217] Document review process progress.

[0218] In some embodiments, a first encrypted file is stored in a blockchain, a second encrypted file is stored in a blockchain, and the blockchain is used to store the file and at least one of the following: file modification time, file modifier identifier, and file modification type.

[0219] In some embodiments, the processor is further configured to:

[0220] After the fourth encryption module encrypts the second file based on the updated encryption parameters and obtains the second encrypted file, it provides the second decrypted file to the second user. The second decrypted file is the file after decrypting the third encrypted file. The third encrypted file is the encrypted file that has been modified or reviewed by at least one user after the second encrypted file.

[0221] Receive a signing instruction for the second decrypted file input by the second user. The signing instruction carries access structure information, which is used to represent object information that has access permissions.

[0222] In response to the issuance command, an encryption key is generated;

[0223] Based on the encryption key and access structure information, the second decrypted file is encrypted to obtain the fourth encrypted file.

[0224] In some embodiments, generating a key pair includes: generating a key pair based on a lattice cryptography algorithm;

[0225] Encrypting the access permission value of the first user to obtain the first encrypted access permission value includes: encrypting the access permission value of the first user based on a homomorphic encryption algorithm to obtain the first encrypted access permission value;

[0226] Encrypting the access permission threshold of the first encrypted file to obtain a second encrypted permission value includes: encrypting the access permission threshold of the encrypted file based on a homomorphic encryption algorithm to obtain a second encrypted permission value.

[0227] In some embodiments, the processor is further configured to:

[0228] Build a multi-dimensional index for the stored encrypted files;

[0229] Encrypt the multi-dimensional index to generate a multi-dimensional encrypted index.

[0230] In some embodiments, the processor is further configured to:

[0231] Upon receiving the input search character, the search character is encrypted to obtain the encrypted search character;

[0232] Matching is performed in a multi-dimensional encrypted index based on the search for encrypted characters;

[0233] Locate the encrypted file corresponding to the matching encrypted index.

[0234] exist Figure 9 In this document, a bus architecture (represented by bus 901) is used. Bus 901 can include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 905 and memory represented by memory 906. Bus 901 can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 904 provides an interface between bus 901 and transceiver 902. Transceiver 902 can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 905 is transmitted over a wireless medium via antenna 903, which further receives data and transmits it to processor 905.

[0235] Processor 905 manages bus 901 and general processing, and also provides various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Memory 906 can be used to store data used by processor 905 during operation.

[0236] Optionally, the processor 905 can be a CPU, ASIC, FPGA, or CPLD.

[0237] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the various processes of the above-described file processing method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0238] This application provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, they implement the various processes of the method described in the embodiment. The technical features are one-to-one and can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0239] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0240] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods of the various embodiments of this application.

[0241] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.< / encryptedmarker>

Claims

1. A file processing method, characterized in that, The method includes: Generate a key pair, which includes a public key and a private key; The received initial file is encrypted using the public key to obtain the first encrypted file; Upon receiving an access request from a first user to the first encrypted file, the access permission value of the first user is encrypted to obtain a first encrypted access value, and the access request carries the access permission value of the first user. The access permission threshold of the first encrypted file is encrypted to obtain the second encrypted permission value; If the first encryption permission value is greater than or equal to the second encryption permission value, the first encrypted file is decrypted based on the private key to obtain the first decrypted file, and the first decrypted file is provided to the first user.

2. The method according to claim 1, characterized in that, Decrypting the first encrypted file based on the private key includes: Based on the private key and the access permission value of the first user, at least a portion of the ciphertext in the first encrypted file is decrypted, wherein the at least a portion of the ciphertext is the part that has access permission under the access permission value of the first user.

3. The method according to any one of claims 1-2, characterized in that, After providing the first decrypted file to the first user, the process further includes: Receive the second file after the first user has modified the first decrypted file; At least one of the encryption parameters is updated to obtain updated encryption parameters, wherein the encryption parameters include at least one of the following: the key pair; encryption dimension; encryption function; number of encryption rounds; encryption padding ratio; The second file is encrypted based on the updated encryption parameters to obtain the second encrypted file.

4. The method according to claim 3, characterized in that, Updating at least one of the encryption parameters includes: Update at least one of the encryption parameters based on at least one of the following: The modifications made to the second file compared to the first decrypted file; The sensitivity of the second document; The weight of the department to which the first user belongs; Document review process progress.

5. The method according to claim 3, characterized in that, The first encrypted file is stored in a blockchain, the second encrypted file is stored in the blockchain, and the blockchain is used to store files, as well as at least one of the following: file modification time, file modifier identifier, and file modification type.

6. The method according to claim 3, characterized in that, After encrypting the second file based on the updated encryption parameters to obtain the second encrypted file, the process further includes: A second decrypted file is provided to the second user. The second decrypted file is the file after the third encrypted file has been decrypted. The third encrypted file is the encrypted file that has been modified or reviewed by at least one user after the second encrypted file. The system receives a signing instruction for the second decrypted file input by the second user. The signing instruction carries access structure information, which is used to represent object information that has access permissions. In response to the issuance instruction, an encryption key is generated; The second decrypted file is encrypted using the encryption key and the access structure information to obtain the fourth encrypted file.

7. The method according to claim 1, characterized in that, The generation of the key pair includes: The key pair is generated based on a lattice cryptography algorithm; Encrypting the access permission value of the first user to obtain a first encrypted access permission value includes: encrypting the access permission value of the first user based on a homomorphic encryption algorithm to obtain the first encrypted access permission value; The step of encrypting the access permission threshold of the first encrypted file to obtain the second encrypted permission value includes: encrypting the access permission threshold of the first encrypted file based on the homomorphic encryption algorithm to obtain the second encrypted permission value.

8. The method according to claim 1, characterized in that, The method further includes: Build a multi-dimensional index for the stored encrypted files; The multi-dimensional index is encrypted to generate a multi-dimensional encrypted index.

9. The method according to claim 8, characterized in that, After encrypting the multi-dimensional index to generate a multi-dimensional encrypted index, the process further includes: Upon receiving the input search character, the search character is encrypted to obtain the encrypted search character; Based on the search encrypted characters, a match is performed in the multi-dimensional encrypted index; Locate the encrypted file corresponding to the matching encrypted index.

10. A document processing device, characterized in that, The device includes: The first generation module is used to generate a key pair, the key pair including a public key and a private key; The first encryption module is used to encrypt the received initial file according to the public key to obtain a first encrypted file; The second encryption module is used to encrypt the access permission value of the first user when it receives an access request from the first user to the first encrypted file, so as to obtain a first encrypted access permission value, wherein the access request carries the access permission value of the first user. The third encryption module is used to encrypt the access permission threshold of the first encrypted file to obtain the second encryption permission value; The first decryption module is used to decrypt the first encrypted file based on the private key when the first encryption permission value is greater than or equal to the second encryption permission value, to obtain the first decrypted file, and to provide the first decrypted file to the first user.

11. An electronic device, characterized in that, The electronic device is a network device, including a processor. The processor is used for: Generate a key pair, which includes a public key and a private key; The received initial file is encrypted using the public key to obtain the first encrypted file; Upon receiving an access request from a first user to the first encrypted file, the access permission value of the first user is encrypted to obtain a first encrypted access value, and the access request carries the access permission value of the first user. The access permission threshold of the first encrypted file is encrypted to obtain the second encrypted permission value; If the first encryption permission value is greater than or equal to the second encryption permission value, the first encrypted file is decrypted based on the private key to obtain the first decrypted file, and the first decrypted file is provided to the first user.

12. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the method as described in any one of claims 1 to 9.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-9.

14. A computer program product, characterized in that, Includes computer instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1-9.

Images