Method of encrypting data
By capturing and encrypting the input stream of a file using delimiters, generating a template and a data array, and constructing an encrypted file, the problem of weak confidentiality in existing encryption methods is solved, achieving efficient processing and control of security events.
Patent Information
- Application Number
- CN202511717429.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-21
- Publication Date
- 2026-05-19
- Estimated Expiration
- 2045-11-21
AI Technical Summary
Existing file encryption methods suffer from weak confidentiality and are easily decrypted by attackers.
By capturing the input stream of a file using delimiters, generating templates and data, splitting and filling arrays, performing encryption, constructing encrypted files of the same size, and storing metadata and encrypted slices on different physical machines, fine-grained access control is achieved using index sequences and key sequences.
It achieves efficient processing and saves memory while limiting the impact of security incidents, ensuring data security and fine-grained control over access permissions.
Smart Images
Figure CN121525070B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data encryption technology, and in particular to a data encryption method. Background Technology
[0002] With the development of the internet, it has become mainstream for document owners to send documents to all readers who need them via email or other communication tools. To prevent documents from being captured by attackers, document encryption is becoming increasingly important. Current file encryption primarily relies on file passwords or directly processes the file using encryption algorithms. Therefore, current file encryption methods are susceptible to decryption by attackers. Summary of the Invention
[0003] In view of this, one of the technical problems solved by the embodiments of this application is to provide a data encryption method that solves the problem of weak confidentiality in document encryption.
[0004] According to a first aspect of this application, a method for encrypting data is provided, the method comprising:
[0005] The input stream of the first file is captured according to a preset delimiter to obtain captured data;
[0006] The first template is obtained based on the delimiter of the captured data;
[0007] The first data is obtained based on the data content of the captured data;
[0008] The first data is divided according to a first length to obtain the first array;
[0009] Fill the elements in the first array so that the length of each element reaches the second length, thus obtaining the second array and the first index array;
[0010] Encrypt the elements in the second array to obtain the encrypted slice sequence, the second index sequence, and the key sequence;
[0011] A second file is constructed based on the first template and captured data, so that the second file has the same size as the input first file;
[0012] The metadata and second file are stored on the first physical machine, and the encrypted slices are stored on the second physical machine.
[0013] The first file is a PDF file;
[0014] The first index array contains the starting fill position when filling the elements in the first array;
[0015] The captured data includes delimiters and data content.
[0016] According to a second aspect of this application, a data encryption device is provided, the device comprising:
[0017] The data capture determination module is used to capture the input stream of the first file according to a preset delimiter and obtain the captured data.
[0018] The first template determination module is used to obtain the first template based on the delimiter of the captured data;
[0019] The first data determination module is used to obtain the first data based on the data content of the captured data;
[0020] The first array determination module is used to divide the first data according to a first length to obtain the first array;
[0021] The array filling module is used to fill the elements in the first array so that the length of each element reaches the second length, thereby obtaining the second array and the first index array;
[0022] The data encryption processing module is used to encrypt the elements in the second array and obtain the encrypted slice sequence, the second index sequence, and the key sequence.
[0023] The second file generation module is used to construct a second file based on the first template and captured data, so that the second file has the same size as the input first file;
[0024] The metadata and second file are stored on the first physical machine, and the encrypted slice sequence is stored on the second physical machine.
[0025] The first file is a PDF file;
[0026] The first index array contains the starting fill position when filling the elements in the first array;
[0027] The captured data includes delimiters and data content.
[0028] According to a third aspect of this application, an electronic device is disclosed, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described above.
[0029] According to a fourth aspect of this application, a computer-readable storage medium is disclosed that stores a computer program, which, when executed by a processor, implements the steps of the above-described method.
[0030] This application embodiment captures the input stream of a first file according to a preset delimiter to obtain captured data, a first template, and first data. The first data is then divided according to a first length to obtain a first array. The elements in the first array are padded so that the length of each element reaches a second length to obtain a second array and a first index array. The elements in the second array are encrypted to obtain an encrypted slice sequence, a second index sequence, and a key sequence. A second file is constructed based on the first template and the captured data, so that the second file has the same size as the input first file. Metadata and the second file are stored on a first physical machine, and the encrypted slice sequence is stored on a second physical machine. This streaming approach achieves block reading and processing of the original file, resulting in efficient processing and memory saving. The generation of the encrypted slice sequence, the second index sequence, and the key sequence encrypts the data blocks and makes their keys independent, enabling the decryption of corresponding ciphertext blocks to obtain plaintext based on access permissions, effectively limiting the scope of impact of security incidents. Attached Figure Description
[0031] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0032] Figure 1 A flowchart illustrating a data encryption method provided in one embodiment of this application;
[0033] Figure 2 This is a schematic diagram of the structure of a data encryption device provided in one embodiment of this application. Detailed Implementation
[0034] The present disclosure will now be discussed with reference to several exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and thus implement the present disclosure, and are not intended to imply any limitation on the scope of the disclosure.
[0035] According to one embodiment of this application, a data encryption method, such as... Figure 1 As shown, the method includes steps S101 to S108.
[0036] Step S101: Capture the input stream of the first file according to a preset delimiter to obtain captured data. The first file is a PDF file, and the captured data includes delimiters and data content.
[0037] In this embodiment of the application, the separator is used to represent special characters or strings that divide and identify different parts of the data.
[0038] Specifically, scripts or splitters can be edited to define several delimiters to scan the input stream of a PDF file to obtain captured data. These defined delimiters can include syntax keyword delimiters present in the PDF file, such as delimiters for marking the beginning and end of a data stream (stream and endstream), delimiters for marking the beginning and end of an object (obj and endobj), and common data format delimiters, such as the XML format data delimiter: <tag> ,< / tag> You can also customize and insert specific, uncommon strings as delimiters, such as<!DATA_START!> In application, these defined delimiters are used to scan the input stream of the PDF file to obtain the captured data. This method of scanning the input stream by delimiters cannot load the entire PDF file at once, but rather achieves the purpose of reading and processing in chunks as a stream, which achieves efficient processing and saves memory.
[0039] In practical applications, the file size of the PDF file can be read in advance to measure its storage space. If the PDF file is detected to be larger than the predetermined file size threshold, step S101 is executed; otherwise, it is input into the preset encryption algorithm model for encryption.
[0040] Step S102: Obtain the first template based on the delimiter of the captured data.
[0041] In this embodiment of the application, the captured data is used to represent the collection of all useful information fragments extracted using delimiters, specifically including the delimiters and the data content between them.
[0042] When applying this method, during the scanning of the input stream of a PDF file, each time a delimiter is scanned, it can be recorded in the template. Each time data content is scanned, a space can be reserved in the template or a mark can be added for the encrypted data to be filled in. In this way, the first template can be obtained when the scan is completed and the captured data is obtained.
[0043] For example, assuming the sequence of captured data is ["5 0 obj", "<<", " / Length100", ">>", "stream", <100 bytes of image data>, "endstream", "endobj"], the first template generated based on the delimiter might be: [structure: "5 0 obj", structure: "<<", structure: " / Length100", structure: ">>", structure: "stream", data space: <---There were originally 100 bytes of data here, structure: "endstream", structure: "endobj"], that is, the obtained first template includes the delimiter and the reserved data space.
[0044] Step S103: Obtain the first data based on the data content of the captured data.
[0045] When applied, during the process of generating captured data from the input stream of a scanned PDF file, the raw data between delimiters is identified and determined as part of the first data.
[0046] Step S104: Divide the first data according to the first length to obtain the first array.
[0047] Step S105: Fill the elements in the first array so that the length of each element reaches the second length, and obtain the second array and the first index array, wherein the first index array contains the starting filling position when filling the elements in the first array.
[0048] Specifically, the elements in the first array can be padded to meet the length requirements of the encrypted data as specified by a preset encryption algorithm before subsequent encryption processing. That is, the padding step is performed when the data length of an element in the first array is less than the second length. More specifically, the second length varies depending on the encryption algorithm. In application, multiple encryption algorithms can be pre-configured, and the second length is determined based on the user-selected algorithm. Padding ensures that all elements in the first array have the same length, simplifying subsequent storage, indexing, and management.
[0049] Specifically, the difference N between each element in the first array and the second length can be detected, and N bytes can be added to the end of each element, with each byte having the value N. For example, assuming the elements are [A,B,C,D,E], the length is 5 bytes, and the second length is 8 bytes, then after padding, we get [A,B,C,D,E,0x03,0x03,0x03]. During decryption, by looking at the value of the last byte, we can know how many bytes are padding content, so as to quickly remove and restore the original data. It should be noted that other padding methods (such as zero padding) can also be used in practical applications, which will not be listed here.
[0050] In this embodiment, the first index array is used to record the starting position of the padding, the end position of the original data, and the start position of the padding, and uses this as metadata. In this way, when decoding, the padding length is calculated by decrypting the data itself, and then the position information recorded in the first index array is used for cross-validation. If the two are consistent, it means that the decryption and parsing are successful; otherwise, it means that an error has occurred, thereby improving the reliability of the system.
[0051] Step S106: Encrypt the elements in the second array and obtain the encrypted slice sequence, the second index sequence, and the key sequence.
[0052] In this embodiment of the application, the encrypted slice sequence is an array of ciphertext data blocks obtained by encrypting each element in the second array using an encryption algorithm and a key. For example, suppose the second array = [plaintext block 1, plaintext block 2, ..., plaintext block N], and the encrypted slice sequence = [ciphertext block 1, ciphertext block 2, ..., ciphertext block N], where the length of each ciphertext block is the same as the length of the plaintext block before encryption, that is, the length is the second length.
[0053] In this embodiment, the key sequence represents the set of keys used to encrypt each data block (i.e., the elements in the second array), such as key sequence = [key1, key2, ..., keyN]. This key sequence can be derived from the master key or generated independently, allowing subsequent decryption of the corresponding ciphertext block to obtain the plaintext. This method of using different keys to encrypt different data blocks enables fine-grained control of access permissions. For example, users can be authorized to decrypt only a few key data blocks, rather than the entire file. This ensures that even if the key of one data block is leaked, it will not lead to the decryption of other data blocks, effectively limiting the scope of the security incident.
[0054] In this embodiment, the second index sequence is used to characterize the mapping relationship between each ciphertext block in the encrypted slice sequence and the original file structure. In application, when accessing a file is required, and data at a certain location is determined based on the first template, the location of the encrypted slice corresponding to that data, as well as the specific key used for decryption, can be found using the second index sequence.
[0055] Step S107: Construct a second file based on the first template and captured data, so that the second file has the same size as the input first file.
[0056] Step S108: Save metadata and a second file on the first physical machine, and save the encrypted slice sequence on the second physical machine.
[0057] In this embodiment, metadata is used to characterize all auxiliary information required for decrypting and reconstructing the original file, including a second index sequence; when applied, it may also include at least one of a first index array, a second index sequence, and a key sequence.
[0058] This application constructs a second file with the same size as the first file, thus retaining the same structure and content as the first file. The data content is stored on a second physical machine, so that when accessing the data, the corresponding encrypted slice can be found on the second physical machine based on metadata such as a second index sequence.
[0059] This application embodiment captures the input stream of a first file according to a preset delimiter to obtain captured data, a first template, and first data. The first data is then divided according to a first length to obtain a first array. The elements in the first array are padded so that the length of each element reaches a second length to obtain a second array and a first index array. The elements in the second array are encrypted to obtain an encrypted slice sequence, a second index sequence, and a key sequence. A second file is constructed based on the first template and the captured data, so that the second file has the same size as the input first file. Metadata and the second file are stored on a first physical machine, and the encrypted slice sequence is stored on a second physical machine. This streaming approach achieves block reading and processing of the original file, resulting in efficient processing and memory saving. The generation of the encrypted slice sequence, the second index sequence, and the key sequence encrypts the data blocks and makes their keys independent, enabling the decryption of corresponding ciphertext blocks to obtain plaintext based on access permissions, effectively limiting the scope of impact of security incidents.
[0060] According to one embodiment of this application, a separator is used to capture a text stream, table, text block, graphics, or resource stream.
[0061] Specifically, delimiters can include BT (Begin Text, indicating the start of a text block), ET (End Text, indicating the end of a text block), Tj, TJ, etc. Tj is used to indicate Show Text, displaying a single text string, while TJ is used to indicate Show Text with Positioning, displaying text and adjusting character spacing. Other delimiters include Stream and Content obj. For example, assuming Tj or TJ is detected, the immediately following string (and the current text state) will be captured as a single text element.
[0062] According to one embodiment of this application, the process of acquiring the first data includes: sorting the captured data based on the length of the data content; extracting the corresponding data content based on the sorted captured data; merging the data content to obtain a first array; the metadata also includes the original order corresponding to the sorted captured data. Specifically, the length of the data content can be sorted according to a predetermined order (such as ascending order), and after reordering, the content of each data block is extracted and merged to form a first array. Reordering resists traffic analysis, making it impossible to infer any information about the original file type, structure, or content from its size and order, thus preventing attackers from inferring a large amount of information by analyzing the size and order of encrypted data blocks. Simultaneously, the metadata also provides the original order corresponding to the sorted captured data, providing a basis for subsequent decoding and recombination, thereby restoring the original file.
[0063] According to one embodiment of this application, a first data stream is used to fill elements in a first array, the first data stream being obtained based on first data. In application, a preset hash function (such as SHA-256) can be used to hash the first data to obtain a corresponding hash value, which is then used as a seed to initialize a pseudo-random number generator, resulting in the first data stream. During the filling process, bytes of a corresponding length are truncated from the first data stream and added to the end for each element in the first array that needs to be filled, thus obtaining a second array where each element is of a second length.
[0064] According to one embodiment of this application, the process of encrypting the fragment to be encrypted in the second array includes:
[0065] Generate the first key;
[0066] The first key and the first encryption algorithm are used to encrypt the fragment to be encrypted to obtain the first encrypted slice;
[0067] Generate a first number, use the first number as the index of the first encrypted slice, and associate the first key with the first number.
[0068] Specifically, a pseudo-random number generator can generate a random byte sequence, which will then be used as the key for encryption. In application, if the encryption algorithm is AES-256, the pseudo-random number generator will generate a 32-byte random number as the key.
[0069] Specifically, the first number can be a random number, a counter value, or a hash value calculated based on the content of the slice. For example, the first number is obtained by hashing the first encrypted slice.
[0070] According to one embodiment of this application, the first number is obtained based on the encrypted slice content. Specifically, a preset hash algorithm can be used to calculate the encrypted slice to obtain the first number. For example, SHA-256 can be used to hash the encrypted slice content to obtain the first number. Since the first number originates from the encrypted slice content, the identifier of the encrypted slice content can be calculated at any time based on itself. This eliminates the need for the decryption end to parse or additionally store the first number from metadata, reducing the possibility of errors and greatly simplifying system design. Furthermore, the same encrypted slice has the same hash value (first number), which ensures the stability of the index.
[0071] According to one embodiment of this application, the first key is generated from a first master key. Generating the first key from the first master key centralizes security resources and reduces the difficulty of key management. Specifically, the first key can be calculated using a key derivation function (KDF). This ensures that even in the event of an attack, the attacker will extract the first key, not the master key, thus preventing attacks on the master key.
[0072] According to one embodiment of this application, the process of constructing the second file includes:
[0073] The second data is obtained by rearranging the first data;
[0074] A pseudo-data distribution is generated based on the data distribution corresponding to the captured data;
[0075] The first template is populated based on the distribution of the second data and pseudo data to obtain the second file.
[0076] In this embodiment, the data distribution is used to characterize the length array of each data segment in the original file. A pseudo-data distribution is constructed to indicate the data length at different positions during the generation of the second file.
[0077] Specifically, the rearrangement of the first data can be achieved by sorting each data item by length (e.g., ascending order) and then merging them to obtain the second data. Alternatively, the rearrangement of the first data can involve encryption, format conversion, or other operations. This rearrangement changes the data organization, effectively hiding the first data, allowing the second data to be embedded in the first template to obtain the second file.
[0078] According to one embodiment of this application, the first physical machine also stores metadata encrypted with the user's public key. This metadata, encrypted with the user's public key, binds decryption permissions to the user's identity. Thus, even if an attacker compromises the physical machine, they cannot access the files because they cannot obtain the user's private key, reducing the risk of data leakage and enabling fine-grained control over user access permissions.
[0079] According to one embodiment of this application, the process of acquiring the first data includes: extracting the corresponding binary array based on the data content of the captured data, and merging the binary data to obtain the second data. Specifically, the second data is obtained by extracting the corresponding binary array from the data content of the captured data, merging the binary data, and then dividing it according to a second length.
[0080] According to one embodiment of this application, a data encryption device is provided, such as... Figure 2 As shown, the device 20 includes: a data capture determination module 201, a first template determination module 202, a first data determination module 203, a first array determination module 204, an array filling processing module 205, a data encryption processing module 206, a second file generation module 207, and a data storage processing module 208.
[0081] The data capture determination module 201 is used to capture the input stream of the first file according to a preset delimiter to obtain captured data;
[0082] The first template determination module 202 is used to obtain a first template based on the delimiter of the captured data;
[0083] The first data determination module 203 is used to obtain first data based on the data content of the captured data;
[0084] The first array determination module 204 is used to divide the first data according to the first length to obtain the first array;
[0085] The array filling processing module 205 is used to fill the elements in the first array so that the length of each element reaches the second length, thereby obtaining the second array and the first index array;
[0086] The data encryption processing module 206 is used to encrypt the elements in the second array and obtain the encrypted slice sequence, the second index sequence, and the key sequence.
[0087] The second file generation module 207 is used to construct a second file based on the first template and captured data, so that the second file has the same size as the input first file;
[0088] The data storage processing module 208 stores metadata and a second file on the first physical machine, and stores the encrypted slice sequence on the second physical machine;
[0089] The first file is a PDF file;
[0090] The first index array contains the starting fill position when filling the elements in the first array;
[0091] The captured data includes delimiters and data content.
[0092] This application embodiment captures the input stream of a first file according to a preset delimiter to obtain captured data, a first template, and first data. The first data is then divided according to a first length to obtain a first array. The elements in the first array are padded so that the length of each element reaches a second length to obtain a second array and a first index array. The elements in the second array are encrypted to obtain an encrypted slice sequence, a second index sequence, and a key sequence. A second file is constructed based on the first template and the captured data, so that the second file has the same size as the input first file. Metadata and the second file are stored on a first physical machine, and the encrypted slice sequence is stored on a second physical machine. This streaming approach achieves block reading and processing of the original file, resulting in efficient processing and memory saving. The generation of the encrypted slice sequence, the second index sequence, and the key sequence encrypts the data blocks and makes their keys independent, enabling the decryption of corresponding ciphertext blocks to obtain plaintext based on access permissions, effectively limiting the scope of impact of security incidents.
[0093] Furthermore, the delimiter is used to capture text streams, tables, text blocks, graphics, or resource streams.
[0094] Furthermore, the process of acquiring the first data includes:
[0095] The captured data is sorted based on the length of its content.
[0096] Extract the corresponding data content based on the sorted captured data;
[0097] Merge the data contents to obtain the first array;
[0098] The metadata also includes the original order of the sorted captured data.
[0099] Furthermore, the elements in the first array are filled using a first data stream, which is based on first data acquisition.
[0100] Furthermore, the process of encrypting the fragments to be encrypted in the second array includes:
[0101] Generate the first key;
[0102] The first key and the first encryption algorithm are used to encrypt the fragment to be encrypted to obtain the first encrypted slice;
[0103] Generate a first number, use the first number as the index of the first encrypted slice, and associate the first key with the first number.
[0104] Furthermore, the first number is obtained based on the content of the encrypted slice.
[0105] Furthermore, the first key is generated from the first master key.
[0106] Furthermore, the construction process of the second file includes:
[0107] The second data is obtained by rearranging the first data;
[0108] A pseudo-data distribution is generated based on the data distribution corresponding to the captured data;
[0109] The first template is populated based on the distribution of the second data and pseudo data to obtain the second file.
[0110] Furthermore, the first physical machine also stores metadata encrypted with the user's public key.
[0111] Furthermore, the process of acquiring the first data includes: extracting the corresponding data stream based on the data content of the captured data, and merging the data streams to obtain the second data.
[0112] The data encryption device in this embodiment can execute the data encryption method shown in the embodiment of this application. The implementation principle is similar and will not be described again here.
[0113] Another embodiment of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described method.
[0114] Specifically, the processor can be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA, or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.
[0115] Specifically, the processor connects to the memory via a bus, which may include a path for transmitting information. The bus can be a PCI bus or an EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc.
[0116] The memory may be ROM or other types of static storage devices that can store static information and instructions, RAM or other types of dynamic storage devices that can store information and instructions, or EEPROM, CD-ROM or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.
[0117] Optionally, the memory stores the code of a computer program that executes the scheme of this application, and the execution is controlled by a processor. The processor executes the application code stored in the memory to implement the operation of the apparatus provided in the above embodiments.
[0118] Another embodiment of this application provides a computer-readable storage medium storing computer-executable instructions for performing the methods provided in the above embodiments.
[0119] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.
[0120] It will be understood by those skilled in the art that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.
[0121] The above is a detailed description of the preferred embodiments of this application. However, this application is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.
Claims
1. A method for encrypting data, characterized in that, include: The input stream of the first file is captured according to a preset delimiter to obtain captured data; The first template is obtained based on the delimiters of the captured data. During the scanning of the input stream of the first file, each time a delimiter is scanned, it is recorded in the template. Each time data content is scanned, a space is reserved in the template until the scanning is completed and the first template is obtained. First data is obtained based on the data content of the captured data, wherein, during the process of generating captured data by scanning the input stream of the first file, when the original data between delimiters is identified, it is determined to be a component of the first data; The first data is divided according to a first length to obtain the first array; Fill the elements in the first array so that the length of each element reaches the second length, thus obtaining the second array and the first index array; The elements in the second array are encrypted using a key sequence to obtain an encrypted slice sequence and a second index sequence. The encrypted slice sequence is an array of ciphertext data blocks obtained by encrypting each element in the second array using an encryption algorithm and a key. The key sequence represents the set of keys used to encrypt each element in the second array. The second index sequence represents the mapping relationship between each ciphertext block in the encrypted slice sequence and the original file structure. A second file is constructed based on the first template and captured data, so that the second file has the same size as the input first file; Metadata and a second file are stored on the first physical machine, and an encrypted slice sequence is stored on the second physical machine. The metadata is used to characterize all auxiliary information required to decrypt and reconstruct the original file, including a first index array, a second index sequence, and a key sequence. The first file is a PDF file; The first index array contains the starting fill position when filling the elements in the first array; The captured data includes delimiters and data content; The process of building the second file includes: The second data is obtained by rearranging the first data; A pseudo-data distribution is generated based on the data distribution corresponding to the captured data; The first template is populated based on the distribution of the second data and pseudo data to obtain the second file.
2. The data encryption method as described in claim 1, characterized in that, The delimiter is used to capture text streams, tables, text blocks, graphics, or resource streams.
3. The data encryption method as described in claim 1, characterized in that, The process of acquiring the first data includes: The captured data is sorted based on the length of its content. Extract the corresponding data content based on the sorted captured data; Merge the data contents to obtain the first array; The metadata also includes the original order of the sorted captured data.
4. The data encryption method as described in claim 1, characterized in that, The elements in the first array are filled using a first data stream, which is based on first data acquisition.
5. The data encryption method as described in claim 1, characterized in that, The process of encrypting the fragments to be encrypted in the second array includes: Generate the first key; The first key and the first encryption algorithm are used to encrypt the fragment to be encrypted to obtain the first encrypted slice; Generate a first number, use the first number as the index of the first encrypted slice, and associate the first key with the first number.
6. The data encryption method as described in claim 5, characterized in that, The first number is obtained based on the content of the encrypted slice.
7. The data encryption method as described in claim 5, characterized in that, The first key is generated from the first master key.
8. The data encryption method as described in claim 1, characterized in that, The first physical machine also stores metadata encrypted with the user's public key.
9. The data encryption method as described in claim 1, characterized in that, The process of acquiring the first data includes: Based on the data content of the captured data, the corresponding data stream is extracted, and the data streams are merged to obtain the second data.