File encryption method and device and electronic equipment

Abstract

The invention provides a file encryption method and device and electronic equipment. The method comprises the following steps: carrying out initialization processing on encryption parameters of an encryption file and an encryption algorithm; performing confusion processing on a to-be-encrypted file, and storing the to-be-encrypted file subjected to the confusion processing into the encrypted file; and performing encryption processing on the to-be-encrypted file through the encryption algorithm to obtain an encrypted file. In this way, the encryption parameters can be initialized, the to-be-encrypted file is subjected to confusion processing and encryption processing, and the encrypted file is generated. By adopting the method provided by the embodiment of the invention, the encryption effect can be improved, and the code security is improved.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a file encryption method, apparatus, and electronic device. Background Technology

[0002] In related technologies, provincial testing platforms are responsible for monitoring the performance indicators of many key products. During the cloud deployment of these platforms, to protect the server-side code from leakage, Python projects are typically encrypted and obfuscated to facilitate decryption and deployment across multiple platforms. However, because the Python interpreter generates .pyc files, which can only be compiled and run on specific interpreter versions, and decompilation tools already exist, the encryption effectiveness and security of the code are relatively poor. Summary of the Invention

[0003] This disclosure aims to at least partially address one of the technical problems in the related art.

[0004] The first aspect of this disclosure provides a file encryption method, including: Initialize the encryption parameters of the encrypted file and encryption algorithm; Obfuscate the file to be encrypted, and then store the obfuscated file into the encrypted file. The encrypted file is obtained by encrypting the file to be encrypted using the encryption algorithm.

[0005] A second aspect of this disclosure provides a file encryption device, comprising: The initialization module is used to initialize the encryption parameters of the encrypted file and the encryption algorithm. The first encryption module is used to obfuscate the file to be encrypted and store the obfuscated file into the encrypted file. The second encryption module is used to perform encryption processing on the file to be encrypted using the encryption algorithm to obtain an encrypted file.

[0006] A third aspect of this disclosure provides an electronic device, comprising: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to implement the method as described in the first aspect above.

[0007] A fourth aspect of this disclosure provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, are used to implement the method described in the first aspect above.

[0008] A fifth aspect of this disclosure provides a computer program product including a computer program that, when executed by a processor, implements the method described in the first aspect above.

[0009] In the embodiments of this disclosure, the encryption parameters of the encrypted file and the encryption algorithm are initialized; the file to be encrypted is obfuscated, and the obfuscated file to be encrypted is stored in the encrypted file; the encrypted file is then encrypted using the encryption algorithm to obtain the encrypted file. Thus, an encrypted file can be generated by initializing encryption parameters, obfuscating the file to be encrypted, and performing encryption. This effectively improves code security and prevents code leakage. Moreover, this encryption method no longer relies on Python .pyc files, effectively avoiding the limitations of .pyc files and the threats of decompilation tools, thereby ensuring the secure operation of the code on different platforms, further enhancing the encryption effect and improving cross-platform compatibility.

[0010] Additional aspects and advantages of this disclosure will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this disclosure. Attached Figure Description

[0011] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0012] Figure 1 A schematic flowchart illustrating a file encryption method provided in this embodiment of the disclosure; Figure 2 This is a schematic diagram illustrating a specific example of a project file to be encrypted, provided in an embodiment of this disclosure. Figure 3 This is an exemplary schematic diagram of an encrypted file provided in an embodiment of this disclosure; Figure 4 This is a schematic diagram of the structure of a file encryption device provided in an embodiment of this disclosure. Detailed Implementation

[0013] Embodiments of this disclosure are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this disclosure, and should not be construed as limiting this disclosure.

[0014] The file encryption method, apparatus, and electronic device of this disclosure are described below with reference to the accompanying drawings.

[0015] Figure 1 This is a schematic flowchart illustrating a file encryption method provided in an embodiment of this disclosure. Figure 1 As shown, the encryption method includes the following steps: S101 initializes the encryption parameters of the encrypted file and the encryption algorithm.

[0016] In the embodiments of this disclosure, initialization of the encrypted file and encryption parameters can be performed first to prepare the necessary parameters and environment for subsequent encryption operations. For example, an empty encrypted file can be created to store the encrypted data; parameters required by the encryption algorithm can be set. For instance, a custom file format can be defined to store all file trees, filenames, and file content information that need to be encrypted in this encrypted file. It is understood that the initialization process can be performed every time encryption occurs to ensure that each generated encrypted file is unique, thus ensuring file security; alternatively, initialization can be performed when encryption parameters change. If the encryption parameters are fixed or remain unchanged for a certain period, initialization can be avoided for each encryption, thereby improving performance.

[0017] S102, Obfuscate the file to be encrypted and save the obfuscated file into the encrypted file.

[0018] In the embodiments of this disclosure, after initializing the encryption parameters of the encrypted file and the encryption algorithm, the file to be encrypted (e.g., a Python project file) can be obfuscated to achieve the first layer of file encryption. A specific example of the project file to be encrypted can be found in [reference needed]. Figure 2 For example, each level of the file to be encrypted can be obfuscated, such as encrypting or transforming the filename and file content, and storing the obfuscated file content into the encrypted file to form part of the encrypted file.

[0019] S103, the encryption algorithm is used to perform encryption processing on the file to be encrypted, and the encrypted file is obtained.

[0020] In the embodiments of this disclosure, the obfuscated file content can be further encrypted, i.e., a second layer of encryption. For example, the encryption parameters set in the initialization step can be used to encrypt the obfuscated Python project file. The second-layer encrypted file content is then stored in the encrypted file, completing the entire encryption process. It is understood that both the obfuscation and encryption processes can be run directly without using Python, being entirely implemented in C++, thereby ensuring the encryption effect.

[0021] In the embodiments of this disclosure, the encryption parameters of the encrypted file and the encryption algorithm are initialized; the file to be encrypted is obfuscated, and the obfuscated file to be encrypted is stored in the encrypted file; the encrypted file is then encrypted using the encryption algorithm to obtain the encrypted file. Thus, an encrypted file can be generated by initializing encryption parameters, obfuscating the file to be encrypted, and performing encryption. This effectively improves code security and prevents code leakage. Moreover, this encryption method no longer relies on Python .pyc files, effectively avoiding the limitations of .pyc files and the threats of decompilation tools, thereby ensuring the secure operation of the code on different platforms, further enhancing the encryption effect and improving cross-platform compatibility.

[0022] In some possible implementations, the encryption parameters of the encrypted file and the encryption algorithm are initialized, including: Initialize an empty file to be used as an encrypted file; Initialize the file encryption index header length to the remainder 'a' of a random number and byte a1; where byte a1 is in hexadecimal; initialize bytes b1 and b2 to the remainder of a random number and byte a1, and define a byte array; store bytes b1 and b2 into the byte array; initialize the loop length 'a'; Encryption algorithms include: Obtain the lengths s1 and s2 of the initial bytes b1 and b2; Calculate the sum and product of s1 and s2; Add the sum and the product together, then square the result to get the result. Take the remainder of the result and byte a2 to generate a new byte b3; where byte a2 is in hexadecimal. Store b3 into the byte array, update byte b1 to byte b2, update byte b2 to byte b3, until the length of the byte array reaches the loop length a; Convert the loop length 'a' into hexadecimal bytes and store it in the encrypted file. Then, store the bytes in the byte array into the encrypted file in sequence to form the encrypted byte header of the file.

[0023] In embodiments of this disclosure, encrypted file initialization may include initializing the mainCode (an empty file without any formatting) encrypted file and the encryption parameters of the encryption algorithm. For example, initializing the encryption parameters may include: initializing the file encryption index header length to the remainder 'a' of a random number and byte a1 (hexadecimal); initializing bytes b1 and b2 to the remainders of a random number and byte a1; defining a byte array chars; and storing b1 and b2 in the byte array chars; and initializing the loop length 'a'. For example, the initialization of the encryption algorithm may include: (1) obtaining the lengths of bytes b1 and b2 as s1 and s2; (2) taking the sum of s1 and s2 as add, and the product of s1 and s2 as multi; (3) obtaining result by (add + multi) * (add + multi); (4) taking the remainder of result and byte a2 (hexadecimal) and converting it to byte b3; (5) storing byte b3 obtained in the previous step into the chars array, setting the value of byte b1 to byte b2, and the value of byte b2 to byte b3, and repeating (1)-(4) until a chars array of length a is stored. (6) Finally, converting length a to hexadecimal bytes and storing them into the encrypted file, and cyclically storing each byte in the chars byte array as an encryption credential into the encrypted file as the encrypted byte header.

[0024] In some possible implementations, the file to be encrypted is obfuscated, and the obfuscated file is then stored in the encrypted file, including: Iterate through the subfiles and subfolders of the file to be encrypted to obtain the files at each level; For each level of the file, obfuscation is performed; the obfuscation process includes: Convert the filename length to hexadecimal bytes and store it in the encrypted file; XOR each byte of the filename with keys1 in the encryption array to encrypt it, and then store it in the encrypted file; Convert the file's content length to hexadecimal bytes and store it in an encrypted file; XOR each byte of the file content with keys2 in the encrypted array to obtain a temporary array; Obfuscate the temporary array and store the obfuscated temporary array in an encrypted file.

[0025] Array obfuscation includes creating a random number seed and swapping array elements.

[0026] In the embodiments of this disclosure, when obfuscating a file to be encrypted, a file system traversal method can be used to recursively access each subfile and subfolder of the file to be encrypted, record the file path and filename at each level, obtain the subfiles and subfolders of the file to be encrypted, and obtain the files at each level. For example, the std::filesystem library (standard file system library) provided by C++17 can be used. The is_directory function (function to determine if a path is a directory) can be used to determine if a path is a directory, the is_regular_file function (function to determine if a path is a regular file) can be used to determine if a path is a single file, and the directory_iterator interface can be used to traverse the subfiles and subfolders f1, ..., fn of the Python project, allocating the read file information into a block of memory. Then, specific obfuscation processing can be performed on each level of the file, including: converting the filename length of each file fi to d1 (hexadecimal) bytes and storing it in the encrypted file; traversing the filenames, performing XOR (Exclusive OR) encryption on each byte of the filename and the keys1 byte used for encryption and storing it in the encrypted file; converting the file content length of each file to d2 (hexadecimal) bytes and storing it in the encrypted file; traversing the file content, performing XOR encryption on each byte of the file content and the keys2 byte used for encryption to obtain a temporary array temp, then obfuscating the temporary array temp, the content length index array idx, the hexadecimal content array v, creating a random number seed randomNext(888), traversing j from 0 to half the length of the file content, taking the remainder between the seed and the idx value as idxj and idx(j+1), swapping the values ​​of v[idxj] and v[idx(j+1)], deleting idxj and idx(j+1) from the idx array, and storing the obfuscated content v in the encrypted file. In this way, on the one hand, by encrypting the file name and file content and obfuscating the array, the complexity of the file can be increased and the security can be improved; on the other hand, by recording the length of the file name and file content, it can be ensured that the file can be correctly restored during decryption, thus ensuring the integrity of the file.

[0027] In some possible implementations, an encryption algorithm is used to perform encryption processing on the file to be encrypted to obtain an encrypted file, including: The encryption algorithm is used to perform encryption processing on the file to be encrypted, generating the encrypted byte header of the file to be encrypted. Iterate through each level of the file in the file to be encrypted; For each level of the encrypted file, the filename length is converted to hexadecimal bytes and stored in the encrypted file; each byte of the filename is XORed with the encryption key and stored in the encrypted file; the file content length is converted to hexadecimal bytes and stored in the encrypted file; each byte of the file content is XORed with the encryption key to obtain the encrypted content, and the encrypted content is stored in the encrypted file. An encrypted file is generated based on the file's encrypted header bytes, the hexadecimal filename length, the XOR-encrypted filename, the hexadecimal file content length, and the XOR-encrypted file content.

[0028] In embodiments of this disclosure, a second layer of encryption can be applied to the encrypted file after the initial encryption algorithm has been used. For example, initial encryption parameters can be used to generate an encrypted byte header for the file to be encrypted using the encryption algorithm. This encrypted byte header can contain necessary information, such as the version of the encryption algorithm and encryption parameters. The encrypted byte header can be written to the beginning of the encrypted file. Then, a file system traversal method can be used to access each subfile and subfolder of the file to be encrypted, recording the file path and filename at each level. For each level of the encrypted file, the filename length is converted to hexadecimal bytes and stored in the encrypted file. For example, the length of the filename is calculated, converted to hexadecimal bytes, and these bytes are written to the encrypted file. Each byte of the filename is XORed with the encryption key and stored in the encrypted file. For example, each byte of the filename is XORed with the encryption key and the encrypted bytes are written to the encrypted file. The file content length is converted to hexadecimal bytes and stored in the encrypted file. For example, the length of the file content is calculated, converted to hexadecimal bytes, and these bytes are written to the encrypted file. Each byte of the file content is XORed with the encryption key to obtain the encrypted content, and the encrypted content is stored in the encrypted file. For example, each byte of the file content is XORed with the encryption key and the encrypted content is written to the encrypted file. Next, all the encrypted information (including the encrypted file header, the hexadecimal filename length, the XOR-encrypted filename, the hexadecimal file content length, and the XOR-encrypted file content) can be combined into a complete encrypted file. For example, the encrypted file header can be written to the beginning of the encrypted file, and then this information can be written sequentially in the order of filename length, encrypted filename, file content length, and encrypted file content, ensuring that the order and format of all information are consistent. This generates an encrypted file of the file to be encrypted, so that it can be correctly restored during subsequent decryption. As an example, an exemplary diagram of the generated encrypted file can be shown below. Figure 3As shown. This effectively protects the file to be encrypted, preventing unauthorized access to the filename and content, ensuring the security and consistency of each encryption process, while also providing high performance and cross-platform compatibility.

[0029] In some possible implementations, it also includes: Read the encrypted byte header of an encrypted file; Based on the encrypted header, determine whether the encrypted file is the target decryption file; When the encrypted file is the target decryption file, iterate through the bytes in the target decryption file that are greater than the preset offset to obtain the file name and file content to be decrypted; The file name and file content are decrypted to obtain the decrypted file.

[0030] In the embodiments of this disclosure, decryption processing of encrypted files can also be performed. For example, the encrypted byte header of the encrypted file can be read from its starting position. Using the information in the encrypted byte header, the structure and content of the encrypted file can be verified to determine if the encrypted file is the file to be decrypted, i.e., the target decryption file. If the encrypted file is determined to be the target decryption file, an offset can be set according to the information in the encrypted byte header. Starting from the offset, the bytes in the encrypted file can be traversed to extract the encrypted bytes of the filename and file content. Then, the extracted encrypted bytes of the filename and file content can be decrypted to obtain the decrypted file. For example, the above-described encryption algorithm can be used for decryption processing. Thus, performing decryption processing on top of encryption can further protect the file to be encrypted, preventing unauthorized access to the filename and file content, thereby effectively improving file security and enhancing the encryption effect. Simultaneously, implementing encryption and decryption through C++ also enables cross-platform operation, improving adaptability and compatibility.

[0031] In some possible implementations, the encrypted byte header of the encrypted file is read, and based on the encrypted byte header, it is determined whether the encrypted file is the target decryption file, including: Read the value of the first byte of the encrypted file and use it as the length of the encrypted index header; Traverse the length of the encrypted index header, and based on the encryption algorithm, calculate the value of the test byte according to the bytes at positions z and z+1 in the encrypted file; where z∈[1,s], and s is the length of the encrypted index header; If the value of the test byte is equal to the value of the byte at position z+3 in the encrypted file, the encrypted file is determined to be the target decryption file.

[0032] In embodiments of this disclosure, the first byte can be read from the beginning of the encrypted file, and its value is used as the length of the encrypted index header. Starting from 1, the encrypted index header length s is traversed, and for each position z (from 1 to S), bytes at positions z and z+1 in the encrypted file are read. Then, using an encryption algorithm, the value of a test byte is calculated based on the bytes at positions z and z+1. For example, the byte lengths s1 and s2 at positions z and z+1 can be obtained, the sum of s1 and s2 (add) and their product (multi) can be calculated, and (add+multi)×(add+multi) is used to obtain the result result. The remainder of result divided by the hexadecimal byte a2 is used to generate the test byte b3. Then, the value of the test byte can be compared with the byte value at position z+3 in the encrypted file. If the test byte values ​​at all positions are equal to the byte values ​​in the encrypted file, the encrypted file is determined to be the target decryption file; if the test byte value at any position is not equal to the byte value in the encrypted file, the encrypted file is determined not to be the target decryption file, and the file may have been tampered with or corrupted. As an example, we can read the value of the first byte of the mainCode encrypted file to obtain the encrypted index header length s. Then, we iterate through the index length s and use the encryption algorithm, starting from z=1, to calculate the value of the test byte using the first data[z] and data[z+1] bytes. We then compare the test byte value with the value at the data[z+3]th bit in the encrypted file. If they are equal, the file is considered the target for decryption, and parsing continues; otherwise, the file input is incorrect or the file is corrupted, and the process stops. In this way, by verifying byte by byte, we can ensure the correctness of the encrypted file's structure and content, guaranteeing the reliability and security of the decryption process.

[0033] In a further possible implementation, when the encrypted file is the target decryption file, the bytes greater than a preset offset in the target decryption file are traversed to obtain the filename and file content to be decrypted, including: When the encrypted file is the target decryption file, set the offset offset to s+1 based on the length s of the encrypted index header; Starting from offset offset, read the byte d1 at offset offset position to obtain the filename length value fileNameSize of the target decrypted file; Increment the offset by 1, and starting from the offset position incremented by 1, read fileNameSize bytes to obtain the encrypted filename bytes; Increment the offset by fileNameSize, and read the byte d2 at the position where offset is incremented by fileNameSize to get the file content length value fileSize. Starting from the position where fileSize is added to offset, read fileSize bytes to obtain the encrypted file content in bytes; Based on the encrypted bytes of the filename and the encrypted bytes of the file content, the filename and file content to be decrypted are obtained.

[0034] In the embodiments of this disclosure, when the encrypted file is the target decryption file, the first byte of the encrypted file can be read to obtain the encrypted index header length s, and the offset can be set to s+1, pointing to the starting position of the first filename in the encrypted file. Then, a byte d1 can be read from the offset position, and the value of d1 can be converted to an integer as the filename length fileNameSize. The offset is then incremented by 1, pointing to the starting position of the filename, and starting from the new offset position, fileNameSize bytes are read to obtain the encrypted bytes of the filename. Afterwards, the offset can be incremented by fileNameSize, pointing to the starting position of the file content length, and a byte d2 can be read from the new offset position, and the value of d2 can be converted to an integer as the file content length fileSize. The offset is then incremented by fileSize, pointing to the starting position of the file content, and starting from the new offset position, fileSize bytes are read to obtain the encrypted bytes of the file content. Finally, the encrypted bytes of the filename and file content can be recorded to obtain the filename and file content to be decrypted. This can be done, for example, by storing them in a data structure (such as a hash table) as input for subsequent decryption. This effectively extracts the filename and file content to be decrypted from the encrypted file, ensuring the correctness and reliability of the decryption process.

[0035] In a further possible implementation, the filename and file content are decrypted to obtain a decrypted file, including: XOR the encrypted bytes of the filename with keys1 in the encryption array to decrypt, and get the plaintext of the filename with the file path; The encrypted bytes of the file content are XORed with keys2 in the encryption array to decrypt the first layer of the file content. Obfuscate the first-level decrypted content to obtain the second-level decrypted plaintext of the file content; The decrypted file is obtained based on the plaintext of the filename, the first-level decrypted content, and the second-level decrypted plaintext.

[0036] In the embodiments of this disclosure, when decrypting filenames and file content, the encrypted bytes of the filename can be read, and each byte of the filename can be XORed and decrypted using keys1 in the encrypted array. The decrypted bytes are then combined to form the plaintext of the filename, restoring the original path and name of the file. Similarly, the encrypted bytes of the file content can be read, and each byte of the file content can be XORed and decrypted using keys2 in the encrypted array. The decrypted bytes are then combined to form the first layer of decrypted content. This first layer of decrypted content can then be obfuscated, including but not limited to swapping array elements and reverse operations. Using the same obfuscation algorithm as during encryption, the first layer of decrypted content can be reversed to obtain the second layer of decrypted plaintext. Finally, the decrypted plaintext filename and the second layer of decrypted plaintext can be combined to form the complete file content. This effectively decrypts filenames and file content, restores the original file, improves decryption efficiency and reliability, and ensures file integrity.

[0037] As an example, we can (1) read byte d1 to get the file name length value fileNameSize; (2) use pointer offset offset += d1 as the starting point and fileNameSize as the length to get the encrypted bytes of the file name, and perform XOR decryption on the encrypted bytes and keys1 bytes to get the plaintext of the file name with the file path; (3) use pointer offset offset += fileNameSize as the starting point, read byte d2 to get the file content length fileSize; (4) use pointer offset offset += d2 as the starting point and fileSize as the length to get the encrypted bytes of the file content, and perform XOR decryption on the encrypted bytes and keys2 bytes to get the first layer of decrypted content temp; (5) use the obfuscation method in the encryption of temp to calculate the second layer of decrypted plaintext of the file content. By repeating the above process, we can get all the encrypted files in sequence, and record the file name and file content obtained above into the hashmap table as cache data for lookup.

[0038] To make the methods provided in this disclosure clearer, the following examples will be used for illustration.

[0039] The method provided in this disclosure can utilize computer technology to define a custom file format, storing all file trees, filenames, and file content information that need to be encrypted into this encrypted file. A new file format is defined, which does not run directly through Python. This project is entirely based on C++ to achieve the encryption effect and can run cross-platform through decryption. Details are as follows: [Encryption Process]: Step 1: Initialize the encrypted file: Initialize the mainCode (an empty file without any formatting) encryption file, and the encryption parameters of the encryption algorithm: The length of the encrypted index header of the file is the remainder 'a' between a random number and 'a1' bytes (hexadecimal); Initialize bytes b1 and b2 as the remainder of a random number and byte a1, and define a byte array chars; Store b1 and b2 into chars; The loop length is a.

[0040] The encryption algorithm is as follows: (1) Obtain the lengths of bytes b1 and b2 as s1 and s2; (2) Take the sum of s1 and s2, add; take the product of s1 and s2, multi; (3) Obtain the result by (add + multi) * (add + multi); (4) Take the remainder of result and byte a2 (hexadecimal) and convert it to byte b3; (5) Store the b3 byte obtained in the previous step into the chars array, set the value of the b1 byte to the value of the b2 byte, and the value of the b2 byte to the value of the b3 byte. Repeat (1)-(4) until the chars array of length a is stored.

[0041] (6) Finally, the length of a is converted into hexadecimal bytes and stored in the encrypted file. Then, each byte in the chars array is stored in the encrypted file as an encryption credential, which serves as the encrypted byte header of the file.

[0042] Step 2: Store the obfuscated content (v) into the encrypted file: The `std::filesystem` library, provided by C++17, is used for file system management. `is_directory` checks if a path is a directory, `is_regular_file` checks if a path is a single file, and the `directory_iterator` interface iterates through subfiles and subfolders `f1...fn` in the Python project. The read file information is allocated to a block of memory, and an encryption array `encodeKeys[keys1, keys2]` is defined. For each level `i` of the file, the following processing is performed: (1) Convert the filename length of each file fi to d1 (hexadecimal) bytes and store it in the encrypted file; (2) Traverse the file name, perform XOR encryption on each byte of the file name and the keys1 byte used for encryption, and store it in the encrypted file; (3) Convert the length of each file to d2 (hexadecimal) bytes and store it in the encrypted file; (4) Traverse the file content, and perform XOR encryption on each byte of the file content and the keys2 bytes used for encryption to obtain a temporary temp; (5) Obfuscate the temporary temp, the content length index array idx, the hexadecimal content array v, create a random number seed randomNext(888), iterate through j from 0 to half the content length, take the remainder of the seed and idx values ​​as idxj and idx(j+1), swap the values ​​of v[idxj] and v[idx(j+1)], delete idxj and idx(j+1) from the idx array, and store the obfuscated content v into the encrypted file.

[0043] Step 3: Perform an encryption operation on the target project P to generate the final encrypted file: For the target project P, perform an encryption operation to generate an encrypted file named mainCode with a file header of length 'a' and a loop of (filename length 'd1' bytes + encrypted filename + file content length 'd2' bytes + encrypted file content). For example, see the illustrations of the project file to be encrypted and the encrypted file respectively. Figure 2 , 3 .

[0044] [Decryption Process]: Step 1: Verify the encrypted header to determine if it is the target decryption file.

[0045] Read the first byte of the encrypted mainCode file to obtain the encrypted index header length. Traverse the index length s, and using the encryption algorithm in the encryption, starting from z=1, calculate the value of the test byte through the first data[z] and data[z+1] bytes. Compare the test byte value with the value of the data[z+3]th bit in the encrypted file. (1) If they are equal, then it is determined to be the target decryption file, and the parsing continues; (2) If they are not equal, it is determined that the file input is incorrect or the file has been corrupted, and the process will not continue.

[0046] Step 2: Set the offset to s+1 and iterate through the bytes that are greater than the offset.

[0047] (1) Read byte d1 to obtain the filename length value fileNameSize; (2) Use pointer offset += d1 as the starting point and fileNameSize as the length to get the encrypted bytes of the file name. Perform XOR decryption on the encrypted bytes and keys1 bytes to get the plaintext of the file name with the file path. (3) Starting from the pointer offset offset += fileNameSize, read d2 bytes to obtain the file content length fileSize; (4) Use pointer offset += d2 as the starting point and fileSize as the length to obtain the encrypted bytes of the file content. Perform XOR decryption on the encrypted bytes and keys2 bytes to obtain the first layer of decrypted content temp. (5) Calculate the decrypted plaintext of the second layer of file content by using the obfuscation method in the encryption of temp; Step 3: Repeatedly process all encrypted files obtained in the third step, record the file names and file contents obtained above and store them in a hashmap table as cache data for lookup.

[0048] Among them, [Cross-platform operation]: Because the import search directory is lost after encryption, in order to load and execute files that have import operations in py files, a C++ implementation is used to run py files on multiple platforms. This is achieved using a hook insertion mechanism: sys.meta_path, which seamlessly inserts its own module loading into the import.

[0049] Step 1: Insert the hook module Myhook into the main entry point of the decrypted file, main.py, and initialize the module hook method.

[0050] Step 2: To read custom import modules in Python, a custom loader `find_module` method is defined. The filename is obtained through the `args` parameter of the loader's Py object. The method then checks if the file exists in the previously decrypted hash table. If it does, it means the file can be decrypted using this loader, and the loader object is returned.

[0051] Step 3: After obtaining the loader object in find_module, implement the load_module method on the loader object, and iterate through the hash table file name key to query the value of the object file name, which is the file content.

[0052] (1) If the file data does not return end, then record the decrypted content of module_code that needs to be compiled.

[0053] (2) If the file data returns end, it is determined that the file cannot be found and an exception is thrown.

[0054] (3) Based on the module_code obtained in the first step, the file content is compiled using the CompileString method. If the compilation is successful, the realcode is obtained. The ExecCodeModuleEx method is executed, which can run the methods of the imported PyObject object, thus enabling cross-platform operation.

[0055] In this way, during the encryption process, a new file format can be formed by binary encryption of all .py files in a Python project using C++ based on file encryption and obfuscation techniques. The method for cross-platform operation after decryption is as follows: A self-constructed random file encryption index header length is used, within which the encryption algorithm described in detail in this article is set. This generates a completely custom encryption string. The file is parsed into binary, and all filenames in the file tree are XORed. The file content is then encrypted in two layers: the first layer is XOR, and the second layer involves swapping the contents using a random seed to create content obfuscation. This effectively ensures that the final encrypted file is random, custom, and obfuscated. The encryption index header can be used to obtain the byte string that needs to be decrypted and verified. After successful verification, all file trees, filenames, and file contents in the encryption can be obtained. The filenames are decrypted using a first-layer XOR, and the file contents are decrypted using a second-layer XOR obfuscation. The encrypted file can be directly compiled and run, decrypted directly, and is cross-platform, meeting the needs of practical application scenarios. In order to enable the running of .py files on multiple platforms via C++, the import files in the .py files that have import operations are loaded and executed. The hook insertion mechanism is used: sys.meta_path, which seamlessly inserts its own module loading into the import, thus achieving cross-platform operation.

[0056] Based on the method provided in this disclosure, compared with the pyc files generated by the traditional Python interpreter, the file security can be effectively improved because there is no decompilation tool to crack it; it can run across different types of operating systems without code differentiation, and it performs encryption and decryption processing on the entire file content without rewriting mature code encapsulation tools like CPython; it can uniformly process all py files of the entire Python project without limitations on the number of module functions or file size.

[0057] To implement the above embodiments, this disclosure also proposes a file encryption device.

[0058] Figure 4 This is a schematic diagram of a file encryption device provided in an embodiment of this disclosure. Figure 4 As shown, the file encryption device 400 includes: The initialization module 410 is used to initialize the encryption parameters of the encrypted file and the encryption algorithm. The first encryption module 420 is used to obfuscate the file to be encrypted and store the obfuscated file into the encrypted file. The second encryption module 430 is used to perform encryption processing on the file to be encrypted using the encryption algorithm to obtain an encrypted file.

[0059] In some possible implementations, the initialization module 410 is used for: Initialize an empty file to be used as an encrypted file; Initialize the file encryption index header length to a remainder 'a' of a random number and 'a1' bytes; where 'a1' bytes are in hexadecimal; initialize bytes b1 and b2 to remainders of a random number and 'a1' bytes, and define a byte array; store bytes b1 and b2 into the byte array; initialize the loop length 'a'; Initialization module 410 is used for: Obtain the lengths s1 and s2 of the initial bytes b1 and b2; Calculate the sum and product of s1 and s2; The sum and product are added together and then squared to obtain the result. The remainder of the result and byte a2 is used to generate a new byte b3; wherein byte a2 is in hexadecimal. Store the b3 into the byte array, update the byte b1 to the byte b2, update the byte b2 to the byte b3, until the array length of the byte array reaches the loop length a; The loop length 'a' is converted into hexadecimal bytes and stored in the encrypted file. Then, bytes from the byte array are stored sequentially in the encrypted file to form the encrypted byte header.

[0060] In some possible implementations, the first encryption module 420 is used for: Iterate through the subfiles and subfolders of the file to be encrypted to obtain the files at each level; For each level of the file, obfuscation is performed; wherein, the obfuscation includes: Convert the filename length to hexadecimal bytes and store it in the encrypted file; Each byte of the filename is XORed with keys1 in the encryption array and then stored in the encrypted file; The file content length of the file is converted into hexadecimal bytes and stored in the encrypted file; Each byte of the file content is XORed with keys2 in the encrypted array to obtain a temporary array; The temporary array is obfuscated, and the obfuscated temporary array is stored in the encrypted file.

[0061] In some possible implementations, the second encryption module 430 is used for: The encryption algorithm is used to perform encryption processing on the file to be encrypted, generating an encrypted byte header for the file to be encrypted. Iterate through each level of the file in the file to be encrypted; For each level of the file in the file to be encrypted, the filename length is converted to hexadecimal bytes and stored in the encrypted file; each byte of the filename is XORed with the encryption key and stored in the encrypted file; the file content length is converted to hexadecimal bytes and stored in the encrypted file; each byte of the file content is XORed with the encryption key to obtain the encrypted content, and the encrypted content is stored in the encrypted file. Based on the encrypted byte header of the file, the hexadecimal filename length, the XOR encrypted filename, the hexadecimal file content length, and the XOR encrypted file content, an encrypted file of the file to be encrypted is generated.

[0062] In some possible implementations, a decryption module is also included, for: Read the encrypted byte header of an encrypted file; Based on the encrypted header, determine whether the encrypted file is the target decryption file; If the encrypted file is the target decryption file, traverse the bytes in the target decryption file that are greater than a preset offset to obtain the file name and file content to be decrypted; The file name and file content are decrypted to obtain a decrypted file.

[0063] In some possible implementations, the decryption module is used for: Read the value of the first byte of the encrypted file as the length of the encrypted index header; Traverse the length of the encrypted index header, and based on the encryption algorithm, calculate the value of the test byte according to the bytes at positions z and z+1 in the encrypted file; where z∈[1,s], and s is the length of the encrypted index header; If the value of the test byte is equal to the value of the byte at position z+3 in the encrypted file, the encrypted file is determined to be the target decryption file.

[0064] In some possible implementations, the decryption module is used for: If the encrypted file is the target decryption file, set the offset offset to s+1 based on the length s of the encrypted index header; Starting from the offset, read the byte d1 at the offset position to obtain the filename length value fileNameSize of the target decrypted file; Increment the offset by 1, and starting from the position where offset is incremented by 1, read fileNameSize bytes to obtain the encrypted bytes of the filename; Add fileNameSize to the offset, and read the byte d2 at the position where fileNameSize is added to the offset to obtain the file content length value fileSize. Starting from the position where fileSize is added to offset, read fileSize bytes to obtain the encrypted bytes of the file content; Based on the encrypted bytes of the filename and the encrypted bytes of the file content, the filename and file content to be decrypted are obtained.

[0065] In some possible implementations, the decryption module is used for: The encrypted bytes of the filename are XORed with keys1 in the encryption array to decrypt the filename and obtain the plaintext filename with the file path. The encrypted bytes of the file content are XORed with keys2 in the encryption array to decrypt the first layer of the file content; The first-layer decrypted content is obfuscated to obtain the second-layer decrypted plaintext of the file content; The decrypted file is obtained based on the plaintext of the filename, the first-level decrypted content, and the second-level decrypted plaintext.

[0066] The specific implementation and technical effects of each module in this embodiment are similar to those in the above method embodiments, and will not be repeated here.

[0067] To implement the above embodiments, this disclosure also proposes an electronic device, including: at least one processor, and a memory communicatively connected to the at least one processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided in the foregoing embodiments.

[0068] To implement the above embodiments, this disclosure also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments.

[0069] To implement the above embodiments, this disclosure also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0070] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this disclosure all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0071] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0072] This disclosure is intended to provide implementation schemes for users to selectively prevent the use or access to their personal information data. Specifically, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information is de-identified to protect user privacy.

[0073] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this disclosure. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0074] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this disclosure, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0075] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of preferred embodiments of this disclosure includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of this disclosure pertain.

[0076] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0077] It should be understood that various parts of this disclosure can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0078] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0079] Furthermore, the functional units in the various embodiments of this disclosure can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0080] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present disclosure have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present disclosure. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present disclosure.

Claims

1. A file encryption method, characterized in that, include: Initialize the encryption parameters of the encrypted file and encryption algorithm; Obfuscate the file to be encrypted, and then store the obfuscated file into the encrypted file. The encrypted file is obtained by encrypting the file to be encrypted using the encryption algorithm.

2. The file encryption method according to claim 1, characterized in that, The initialization process for the encryption parameters of the encrypted file and encryption algorithm includes: Initialize an empty file to be used as an encrypted file; Initialize the file encryption index header length to a remainder 'a' of a random number and 'a1' bytes; where 'a1' bytes are in hexadecimal; initialize bytes b1 and b2 to remainders of a random number and 'a1' bytes, and define a byte array; store bytes b1 and b2 into the byte array; initialize the loop length 'a'; The encryption algorithm includes: Obtain the lengths s1 and s2 of the initial bytes b1 and b2; Calculate the sum and product of s1 and s2; The sum and product are added together and then squared to obtain the result. The remainder of the result and byte a2 is used to generate a new byte b3; wherein byte a2 is in hexadecimal. Store the b3 into the byte array, update the byte b1 to the byte b2, update the byte b2 to the byte b3, until the array length of the byte array reaches the loop length a; The loop length 'a' is converted into hexadecimal bytes and stored in the encrypted file. Then, bytes from the byte array are stored sequentially in the encrypted file to form the encrypted byte header.

3. The file encryption method according to claim 1, characterized in that, The process of obfuscating the file to be encrypted and storing the obfuscated file into the encrypted file includes: Iterate through the subfiles and subfolders of the file to be encrypted to obtain the files at each level; For each level of the file, obfuscation is performed; wherein, the obfuscation includes: Convert the filename length to hexadecimal bytes and store it in the encrypted file; Each byte of the filename is XORed with keys1 in the encryption array and then stored in the encrypted file; The file content length of the file is converted into hexadecimal bytes and stored in the encrypted file; Each byte of the file content is XORed with keys2 in the encrypted array to obtain a temporary array; The temporary array is obfuscated, and the obfuscated temporary array is stored in the encrypted file.

4. The file encryption method according to claim 2, characterized in that, The step of encrypting the file to be encrypted using the encryption algorithm to obtain an encrypted file includes: The encryption algorithm is used to perform encryption processing on the file to be encrypted, generating an encrypted byte header for the file to be encrypted. Iterate through each level of the file in the file to be encrypted; For each level of the file in the file to be encrypted, the filename length is converted to hexadecimal bytes and stored in the encrypted file; each byte of the filename is XORed with the encryption key and stored in the encrypted file; the file content length is converted to hexadecimal bytes and stored in the encrypted file; each byte of the file content is XORed with the encryption key to obtain the encrypted content, and the encrypted content is stored in the encrypted file. Based on the encrypted byte header of the file, the hexadecimal filename length, the XOR encrypted filename, the hexadecimal file content length, and the XOR encrypted file content, an encrypted file of the file to be encrypted is generated.

5. The file encryption method according to claim 1, characterized in that, Also includes: Read the encrypted byte header of an encrypted file; Based on the encrypted header, determine whether the encrypted file is the target decryption file; If the encrypted file is the target decryption file, traverse the bytes in the target decryption file that are greater than a preset offset to obtain the file name and file content to be decrypted; The file name and file content are decrypted to obtain a decrypted file.

6. The file encryption method according to claim 5, characterized in that, The step of reading the encrypted byte header of the encrypted file and determining whether the encrypted file is the target decryption file based on the encrypted byte header includes: Read the value of the first byte of the encrypted file as the length of the encrypted index header; Traverse the length of the encrypted index header, and based on the encryption algorithm, calculate the value of the test byte according to the bytes at positions z and z+1 in the encrypted file; where z∈[1,s], and s is the length of the encrypted index header; If the value of the test byte is equal to the value of the byte at position z+3 in the encrypted file, the encrypted file is determined to be the target decryption file.

7. The file encryption method according to claim 6, characterized in that, When the encrypted file is the target decryption file, the process involves traversing bytes greater than a preset offset within the target decryption file to obtain the filename and content to be decrypted, including: If the encrypted file is the target decryption file, set the offset offset to s+1 based on the length s of the encrypted index header; Starting from the offset, read the byte d1 at the offset position to obtain the filename length value fileNameSize of the target decrypted file; Increment the offset by 1, and starting from the position where offset is incremented by 1, read fileNameSize bytes to obtain the encrypted bytes of the filename; Add fileNameSize to the offset, and read the byte d2 at the position where fileNameSize is added to the offset to obtain the file content length value fileSize. Starting from the position where fileSize is added to offset, read fileSize bytes to obtain the encrypted bytes of the file content; Based on the encrypted bytes of the filename and the encrypted bytes of the file content, the filename and file content to be decrypted are obtained.

8. The file encryption method according to claim 7, characterized in that, The process of decrypting the filename and file content to obtain a decrypted file includes: The encrypted bytes of the filename are XORed with keys1 in the encryption array to decrypt the filename and obtain the plaintext filename with the file path. The encrypted bytes of the file content are XORed with keys2 in the encryption array to decrypt the first layer of the file content; The first-layer decrypted content is obfuscated to obtain the second-layer decrypted plaintext of the file content; The decrypted file is obtained based on the plaintext of the filename, the first-level decrypted content, and the second-level decrypted plaintext.

9. A file encryption device, characterized in that, include: The initialization module is used to initialize the encryption parameters of the encrypted file and the encryption algorithm. The first encryption module is used to obfuscate the file to be encrypted and store the obfuscated file into the encrypted file. The second encryption module is used to perform encryption processing on the file to be encrypted using the encryption algorithm to obtain an encrypted file.

10. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-8.

Images