Electronic document dynamic self-adaptive encryption method and system based on quantization model

Abstract

The application discloses an electronic official document dynamic self-adaptive encryption method and system based on a quantification model, and relates to the technical field of electronic information security, wherein the method comprises the following steps: designing a file type, an encryption mode enumeration, a file attribute and an encryption strategy structure body, establishing a file extension and type mapping, configuring system parameters and generating a key and a vector; identifying a file type, detecting content repetition characteristics and sensitive attributes, and integrating to generate a file attribute object; dynamically generating an encryption strategy by means of a multi-level priority rule engine in combination with file characteristics; executing file encryption and generating ciphertext according to the strategy, and realizing decryption restoration based on strategy parameters; uniformly releasing dynamic memory, establishing a hierarchical error processing mechanism for authority, memory, keys and data abnormalities, and completing resource recycling and abnormal fault tolerance closed-loop management and control. The application upgrades the encryption strategy through dynamic intelligent decision-making, realizes dynamic balance between safety and performance, and solves the problem that traditional schemes cannot balance safety and efficiency.

Description

Technical Field

[0001] This invention relates to the field of electronic information security technology, and in particular to a dynamic adaptive encryption method and system for electronic documents based on a quantization model. Background Technology

[0002] With the widespread adoption of e-government and digital office practices in enterprises, electronic documents have become the core carrier for information flow, business approval, and instruction transmission in government agencies and large enterprises. The need for information security protection during their transmission, storage, and distribution is increasingly prominent. Electronic documents encompass various types of content, including ordinary office documents, classified government documents, and financial transaction data. Their circulation scenarios cover heterogeneous environments such as internal secure networks, cross-regional VPN links, and public internet and mobile networks. Furthermore, they need to adapt to cross-domain circulation and one-to-many batch distribution business models under multi-level organizational structures at the provincial, municipal, and county levels. This places stringent requirements on the adaptability, security, and operational efficiency of the document encryption protection system.

[0003] Currently, electronic document encryption protection largely follows traditional, fixed design approaches, generally employing pre-configured static encryption strategies. It typically uses a single encryption algorithm and operating mode for full-scenario encryption, lacking real-time awareness of business scenarios and operational status. Existing protection models cannot dynamically capture real-time variables such as network environment switching, mobile network bandwidth fluctuations, terminal battery power, CPU load, and the overall network security threat landscape. They also fail to provide fine-grained adaptations based on the document's own security level and organizational hierarchy requirements. This leads to problems such as excessive consumption of system computing and energy resources in secure intranet environments, and insufficient encryption strength in high-risk scenarios like public networks, making it difficult to meet the complex and ever-changing security needs of document circulation.

[0004] In multi-level organizational cross-domain document circulation scenarios, existing encryption systems exhibit significant security gaps. Documents are frequently transmitted across different security domains and heterogeneous network architectures, but traditional encryption schemes lack mechanisms for linking organizational hierarchical permissions and adapting to multiple network environments. This makes it impossible to achieve compatibility and adaptability of a unified encryption strategy across multiple domain scenarios, hindering the achievement of the goal of secure transmission with one-time encryption and universal adaptability. This significantly increases the risk of information leakage during cross-domain document circulation. Furthermore, encryption protection has long faced a three-way constraint between security strength, processing performance, and terminal resource consumption. Fixed encryption strength models struggle to balance the compliance requirements of highly sensitive documents with the stable operation needs of resource-constrained devices such as mobile terminals and lightweight IoT terminals. The industry has consistently lacked quantitative decision-making tools that can comprehensively weigh multiple objective parameters, failing to achieve a dynamic optimal balance between security, efficiency, and resource consumption.

[0005] From the perspective of system architecture and application implementation, existing electronic document encryption functions are mostly deeply embedded in various business systems in the form of hard-coded modules. The overall architecture has high coupling and weak scalability. When adding national cryptographic algorithms, encryption working modes, or expanding decision-making influencing factors, large-scale transformation of the original business systems is required, resulting in high upgrade costs and long iteration cycles. The key management mechanism also has the defect of being rigid, generally relying on pre-shared keys and long-term static certificates. The key update cycle is lengthy, and once a key is leaked, it will cause widespread security risks. Moreover, it is difficult to support security mechanisms such as dedicated key negotiation for a single session and recipient-directed key adaptation. Its security support capabilities for batch distribution scenarios of documents such as multicast and broadcast are seriously insufficient.

[0006] Furthermore, existing encryption systems suffer from significant shortcomings in operation, maintenance, configuration, and user experience. Policy configuration relies heavily on specialized cryptographic knowledge, and the process is cumbersome and error-prone, making it difficult for ordinary office workers to complete independently. The encryption process operates in a black box, preventing users from directly understanding the current encryption policies, decision-making logic, and protection effectiveness. This not only reduces trust in daily use but also increases the difficulty of security auditing and risk tracing. The high deployment threshold and operational complexity hinder the large-scale implementation and promotion of encryption security systems across the industry.

[0007] There is an urgent need for an electronic document encryption technology solution that features multi-dimensional perception, quantitative decision-driven approach, dynamic strategy self-adaptation, easy integration, and easy operation and maintenance, in order to overcome the inherent defects of traditional encryption modes and meet the practical application needs of secure, efficient, and cross-domain circulation of electronic documents in complex scenarios. Summary of the Invention

[0008] The main objective of this invention is to provide a dynamic adaptive encryption method for electronic documents based on a quantization model.

[0009] Another objective of this invention is to propose a dynamic adaptive encryption system for electronic documents based on a quantization model.

[0010] The third objective of this invention is to provide an electronic device.

[0011] A fourth objective of this invention is to provide a non-transitory computer-readable storage medium.

[0012] To achieve the above objectives, a first aspect of the present invention proposes a dynamic adaptive encryption method for electronic documents based on a quantization model, comprising:

[0013] Construct a data system that includes file type enumeration, encryption mode enumeration, file attribute structure and encryption strategy structure, establish a mapping relationship between file extension and file type, configure basic system parameters and generate random key and initial vector; Identify the type of the target file based on the file type mapping relationship, detect the duplicate features of the file content and determine the sensitive attributes of the file, and integrate the file size, file type, content features and sensitive attributes to construct a complete file attribute object; Based on file attribute objects, an adaptation judgment is made through a preset multi-level priority rule engine. Combining file size, format category, content redundancy features and sensitive attribute constraints, an encryption execution strategy that matches the characteristics of the current file is dynamically generated. Based on the encryption execution strategy, the plaintext data of the file is processed and encrypted to generate and write the ciphertext file. At the same time, the parameters of the encryption execution strategy are used to construct a reverse decryption process to realize ciphertext parsing and original data recovery. Unify the release of dynamic memory resources requested during the encryption and decryption process. Establish a graded error handling mechanism for working conditions including file read and write permissions, abnormal memory allocation, key matching failure, and ciphertext data corruption, and complete the closed-loop management of resource reclamation and fault tolerance throughout the entire process.

[0014] Optionally, a data system is constructed that includes file type enumeration, encryption mode enumeration, file attribute structure, and encryption policy structure; a mapping relationship between file extensions and file types is established; basic system parameters are configured; and random keys and initialization vectors are generated, including: Based on the functional requirements of the encryption system, two enumeration types are defined: file type enumeration and encryption mode enumeration. Two data structures are constructed: file attribute structure and encryption strategy structure, and a standardized data system is built. Based on file format classification rules, a mapping relationship between file extensions and file types is established, covering multiple file formats including text, images, videos, audio, documents, compressed files, and binary files. Configure the system's basic parameters according to the requirements of encryption operations and feature detection, and determine the data block length, file size classification threshold, content feature sampling parameters, and judgment threshold. A randomized security mechanism is used to allocate storage space for the key and initialization vector, and the key and initialization vector are initialized by random generation.

[0015] Optionally, the target file type is identified based on the file type mapping relationship, duplicate features of file content are detected, and sensitive file attributes are determined. File size, file type, content features, and sensitive attributes are integrated to construct a complete file attribute object, including: Extract the extension information from the target file name, convert it into a uniform character format, and compare and match it with the established extension mapping relationship to complete the identification and determination of the file type; The file content is read into the memory space as needed according to the file size, and the file data blocks are sampled and compared according to the preset sampling rules. The duplication of adjacent data blocks is counted, and the file is determined to have a redundant pattern based on the duplication characteristics. The target file is identified by its attributes according to the preset sensitivity judgment rules, and the file is marked as whether it belongs to the category of classified sensitive data. By integrating file size, identified file type, detected content redundancy features, and sensitive attributes for identification from multiple dimensions, a complete and standardized file attribute object is constructed.

[0016] Optionally, based on file attribute objects, an adaptation judgment is performed through a preset multi-level priority rule engine. Combining file size, format type, content redundancy features, and sensitive attribute constraints, an encryption execution strategy matching the characteristics of the current file is dynamically generated, including: Initialize basic encryption parameters and determine the default values ​​for encryption mode, key length, and data compression usage. The multi-dimensional decision-making rules are executed sequentially according to the preset priority order, and the basic strategy parameters are adapted and adjusted in combination with the file storage space size and file format category attributes. Redundant content features and sensitive attributes are used as the highest priority constraints to cover, correct, and forcibly limit the already adapted basic strategy parameters. Integrate all rule judgment results to generate a final encryption strategy that matches file characteristics, and simultaneously generate strategy adaptation instructions.

[0017] Optionally, the plaintext data of the file is processed and encrypted, outputting an encrypted ciphertext file, including: Based on the encryption mode and key specifications selected by the encryption execution strategy, the original plaintext data of the file is padded according to the standard padding specification to complete the original data copying and standardized byte padding. Encryption operations are performed according to the working mode selected by the encryption execution strategy. The overall encryption operation is carried out by either independent block encryption or chain-related encryption, and key expansion, block iterative encryption and chain vector XOR operation processing are completed. After the encryption operation is completed, the memory for filling data is released, the encrypted ciphertext data is retained, and the ciphertext data is written to the target file using binary writing method to generate a standard encrypted file.

[0018] Optionally, a reverse decryption process can be constructed using the parameters of the encryption execution strategy to achieve ciphertext parsing and original data recovery, completing adaptive encryption and decryption closed-loop control, including: Read the encrypted file from external storage and load it into memory, obtain the total length of the ciphertext data, and pre-allocate the data cache buffer required for decryption operations; Match the working mode and key parameters used in the encryption stage, build the corresponding reverse decryption logic flow, and complete the ciphertext decryption and vector inverse operation block by block according to the decryption operation rules; Extract the identifier byte at the end of the decrypted data, verify the compliance and validity of the value of the padding byte, remove the standardized padding redundant bytes, and restore the true length of the original plaintext data. Write the complete original plaintext data after removing padding to the target storage path to complete the ciphertext parsing verification and original file data restoration.

[0019] Optionally, dynamically allocated memory resources during encryption / decryption processing can be uniformly released. A tiered error handling mechanism can be established to address scenarios including file read / write permissions, memory allocation anomalies, key matching failures, and corrupted ciphertext data. This mechanism enables closed-loop management of resource reclamation and anomaly tolerance throughout the entire process, including: After the entire encryption and decryption process is completed, it iterates through the various memory resources dynamically requested during the process, such as file cache, data filling, ciphertext storage, and key expansion, and releases and reclaims the space one by one. For business scenarios such as invalid file paths, insufficient access permissions, and file read / write failures, set up a dedicated exception judgment branch, output verification prompts, and terminate the current business process in an orderly manner. In response to abnormal hardware conditions such as system memory allocation failure or insufficient storage space, an abnormal alarm will be triggered immediately, and the occupied resources will be reclaimed and released in advance. For each of the following abnormal operating conditions: key mismatch, data filling verification failure, and corrupted encrypted data storage, corresponding abnormal prompt logic is set up to complete the identification and notification of the cause of the failure; By unifying the reclamation of memory resources across all dimensions and handling different levels of exceptions under various operating conditions, a closed-loop fault-tolerant management system is constructed that integrates exception interception, resource cleanup, and status feedback throughout the entire encryption and decryption process.

[0020] To achieve the above objectives, a second aspect of the present invention proposes a dynamic adaptive encryption system for electronic documents based on a quantization model, comprising: The data construction module builds a data system that includes file type enumeration, encryption mode enumeration, file attribute structure and encryption strategy structure, establishes the mapping relationship between file extension and file type, configures basic system parameters and generates random keys and initial vectors. The attribute recognition module identifies the type of the target file based on the file type mapping relationship, detects the duplicate features of the file content and determines the sensitive attributes of the file, and integrates the file size, file type, content features and sensitive attributes to construct a complete file attribute object; The strategy adaptation module, based on file attribute objects, performs adaptation judgment through a preset multi-level priority rule engine, and dynamically generates an encryption execution strategy that matches the characteristics of the current file by combining file size, format category, content redundancy features and sensitive attribute constraints. The ciphertext processing module, based on the encryption execution strategy, processes the plaintext data of the file and performs encryption operations to generate and write ciphertext files. At the same time, it uses the parameters of the encryption execution strategy to construct a reverse decryption process to realize ciphertext parsing and original data recovery. The anomaly control module uniformly releases the dynamic memory resources requested during the encryption and decryption process. It establishes a graded error handling mechanism for working conditions including file read / write permissions, abnormal memory allocation, key matching failure, and corrupted ciphertext data, and completes the closed-loop control of resource reclamation and anomaly tolerance throughout the entire process.

[0021] Regarding the system in the above embodiments, the specific ways in which each module performs operations have been described in detail in the embodiments related to the method, and will not be elaborated here.

[0022] To achieve the above objectives, a third aspect of this application provides an electronic device, including a processor and a memory; wherein the processor runs a program corresponding to the executable program code stored in the memory, for implementing a dynamic adaptive encryption method for electronic documents based on a quantization model as described in the first aspect embodiment.

[0023] To achieve the above objectives, a fourth aspect of this application provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a dynamic adaptive encryption method for electronic documents based on a quantization model as described in the first aspect embodiment.

[0024] The embodiments of the present invention have the following beneficial effects: 1. Upgrades encryption strategies from static presets to dynamic intelligent decision-making, solving the problem of balancing security and efficiency in traditional solutions. Relying on a multi-dimensional context-aware and quantitative decision-making engine, it intelligently analyzes various parameters such as file attributes, network environment, terminal status, and organizational compliance rules, significantly improving strategy matching accuracy. It can adaptively select the optimal encryption scheme for each document transmission, avoiding resource redundancy in low-risk scenarios and protection gaps in high-risk scenarios, achieving a dynamic balance between security strength, processing performance, and resource consumption.

[0025] 2. Enhance the accuracy of electronic document security protection and the overall system performance, achieving on-demand security adaptation and performance optimization. Encryption strength can be dynamically increased and additional verification protection added based on network risk trends. Combined with a six-dimensional permission matrix, fine-grained permission control is achieved, effectively resisting network attacks such as pattern leakage. Simultaneously, through differentiated encryption modes and intelligent compression adapted to different files and network scenarios, encryption and decryption speeds are significantly improved, transmission traffic and time are reduced, and energy consumption can be reasonably adjusted for resource-constrained terminals, extending device battery life.

[0026] 3. Adopting a modular and decoupled architecture significantly enhances the system's scalability, maintainability, and business integration capabilities. The system is divided into independent functional modules such as context acquisition, quantitative decision-making, encryption execution, and key management, with interaction achieved through standard interfaces. Adding new national cryptographic algorithms and iterative decision rules requires no changes to the core code, resulting in low upgrade and iteration costs. It also provides multiple types of call interfaces and a visual management interface, allowing for seamless integration into existing business systems while lowering the barrier to entry for operators and maintenance personnel, ensuring strong deployment adaptability.

[0027] 4. Possesses significant economic value and broad industry application prospects, meeting the compliant and secure application needs of multiple fields. Through intelligent strategy optimization, it reduces investment in high-performance encryption hardware, lowers network bandwidth and storage space resource consumption, and simplifies operation and maintenance work and improves the efficiency of security incident investigation through automated decision-making. Adaptable to application scenarios in government, finance, healthcare, and other industries, it is compatible with the Cybersecurity Classified Protection Standard 2.0 and multiple international security compliance standards, providing technical support for building a compliant, efficient, and secure cross-domain electronic document transfer system for various industries. Attached Figure Description

[0028] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A flowchart illustrating a dynamic adaptive encryption method for electronic documents based on a quantization model, provided as an embodiment of the present invention; Figure 2 This is a flowchart of a file content pattern detection algorithm provided in an embodiment of the present invention; Figure 3 A flowchart illustrating the multi-level priority decision logic of the encryption strategy provided in this embodiment of the invention; Figure 4 This is a flowchart illustrating the overall process of the adaptive encryption method provided in this embodiment of the invention. Figure 5 This is a structural diagram of a dynamic adaptive encryption system for electronic documents based on a quantization model, provided as an embodiment of the present invention. Detailed Implementation

[0029] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0031] The following description, with reference to the accompanying drawings, describes a dynamic adaptive encryption method and system for electronic documents based on a quantization model, according to an embodiment of the present invention.

[0032] Example 1 This invention provides a dynamic adaptive encryption method for electronic documents based on a quantization model. Figure 1 This is a flowchart illustrating a dynamic adaptive encryption method for electronic documents based on a quantization model, provided as an embodiment of the present invention. Figure 1 As shown, the method includes the following steps: Step S1: Construct a data system that includes file type enumeration, encryption mode enumeration, file attribute structure and encryption strategy structure, establish the mapping relationship between file extension and file type, configure system basic parameters and generate random key and initial vector.

[0033] In this embodiment, the initialization and construction of the underlying operating parameters and core data structure of the encryption system are carried out first, laying the underlying framework foundation for the subsequent operation of various adaptive encryption processes.

[0034] The system sequentially defines and constructs various basic enumeration types and functional structures, standardizing overall data interaction and parameter definition. A pre-defined file type enumeration, `file_type_t`, covers eight types: TEXT, IMAGE, VIDEO, AUDIO, DOCUMENT, ARCHIVE, BINARY, and UNKNOWN, enabling comprehensive classification and identification of various common files and files of unknown formats used in daily applications.

[0035] The encryption mode enumeration aes_mode_t is defined synchronously, which is limited to ECB and CBC encryption modes. This standardizes the working method used for encryption operations and provides a unified value specification for subsequent strategy selection and encryption execution.

[0036] At the same time, a dedicated file attribute structure, file_attributes_t, is built. The structure integrates five core parameter items: file_size, file_type, has_patterns, is_sensitive, and filename. It can fully carry key information such as the size, format type, content repetition characteristics, sensitive attributes, and filename of a single target file.

[0037] Additionally, configure the encryption strategy structure encryption_strategy_t. The structure has built-in mode, key_size, use_compression, and reason configuration fields, which are used to record the selected encryption mode, key length specification, compression function enabled status, and the reason for strategy generation, respectively.

[0038] After completing the enumeration and structure definition, a mapping table between file extensions and corresponding file types is further established. The mapping scope covers seven mainstream file formats: text, image, video, audio, document, compressed, and binary, which facilitates quick matching and identification of file categories by file extension.

[0039] The system uniformly and permanently configures the fixed constant parameters required for operation, specifically setting AES_BLOCK_SIZE to 16 bytes, SMALL_FILE_THRESHOLD to 1KB, LARGE_FILE_THRESHOLD to 10MB, PATTERN_SAMPLE_BLOCKS to 100, and PATTERN_THRESHOLD to 5%, providing a unified quantitative benchmark for file size classification, data block division, content feature sampling, and duplication rate determination.

[0040] Subsequently, a dedicated storage area was allocated for encryption operations, with 32 bytes of key storage space and 16 bytes of IV initialization vector storage space configured. In practical applications, the key and vector content can be automatically generated and filled using the system's built-in random number generator, or users can manually assign values ​​using custom keys. From multiple levels, including data structure, fixed parameters, and key vectors, a robust and complete underlying architecture and parameter support are provided for the stable and reliable operation of the entire adaptive encryption process.

[0041] Step S2: Identify the type of the target file based on the file type mapping relationship, detect the duplicate features of the file content and determine the sensitive attributes of the file, integrate the file size, file type, content features and sensitive attributes, and construct a complete file attribute object.

[0042] like Figure 2The diagram shows the content pattern detection algorithm flow. This application strictly follows the complete flow shown in the diagram to carry out file recognition and content feature detection, ensuring accurate file attribute determination and standardized process execution, and providing a reliable basis for subsequent encryption strategy generation.

[0043] In actual operation, the system first identifies the format of the target file and uses the strrchr function to accurately extract the suffix extension from the complete file name. To avoid matching failure due to case differences, the extracted extension characters are uniformly converted to lowercase format. Then, it is matched against the pre-set extension mapping array one by one. After the matching is completed, the corresponding file type enumeration value is output, thus completing the standardized classification of file formats.

[0044] Subsequently according to Figure 2 The algorithm performs content pattern detection, completely reading and loading the target file into system memory, and simultaneously obtaining the file's actual byte size to lay the data foundation for subsequent feature detection. First, it performs an initial file size assessment. If the file length is less than 32 bytes, the data size is too small to meet the conditions for duplicate feature detection, and the file is directly determined to have no duplicate content patterns. If the file size meets the detection conditions, it calculates the number of sample blocks (sample_blocks), which is the smaller value between the total number of file data blocks and a preset value of 100. Simultaneously, it initializes the pattern_count variable to zero to count the number of duplicate data blocks and sets the initial value of the circular index to 0, preparing for the block comparison process.

[0045] Enter Figure 2 The loop comparison process, as shown, compares the integrity of adjacent 16-byte data blocks one by one, provided the index meets the traversal range. It verifies whether every byte of the two data blocks is completely identical. After each round of comparison, the index is incremented, and this process continues until all sampled blocks have been compared. If two adjacent data blocks are found to be completely identical, the pattern_count is incremented to accurately record the number of duplicate data blocks.

[0046] After the loop ends, the system automatically calculates the file content duplication rate. This is obtained by multiplying `pattern_count` by 100 and then dividing by `sample_blocks` to get the percentage duplication rate. The calculated result is then compared to a preset threshold of 5%. When the duplication rate exceeds the preset threshold, `has_patterns` is marked as 1, indicating that the file contains fixed duplicate content features; if the duplication rate does not exceed the threshold, `has_patterns` is marked as 0, indicating that the file has no obvious duplicate patterns.

[0047] Meanwhile, the system performs sensitive attribute screening on the target file, determining whether the file contains sensitive information according to preset rules and marking it with the is_sensitive status flag. Finally, a new file_attributes_t structure instance is created, and all fields of file_size, file_type, has_patterns, is_sensitive, and filename are populated in sequence, assembling a complete and clearly defined file attribute object, providing comprehensive and accurate preliminary data support for subsequent encryption strategy decisions.

[0048] Step S3: Based on the file attribute object, an adaptation judgment is performed through a preset multi-level priority rule engine. Combining file size, format category, content redundancy features and sensitive attribute constraints, an encryption execution strategy matching the characteristics of the current file is dynamically generated.

[0049] like Figure 3 The diagram illustrates the encryption strategy decision-making logic flow. Based on the complete decision-making logic shown in the diagram, this application uses a built-in rule engine to achieve hierarchical determination, dynamic adaptation, and automatic generation of encryption strategies, ensuring that each configuration is highly matched with the file characteristics.

[0050] The system first creates an `encryption_strategy_t` policy object and initializes the basic default parameters. The default encryption mode is set to the more secure CBC mode, the key length "key_size" is uniformly configured to 32 bytes, corresponding to a 256-bit high-strength encryption specification, and the compression flag "use_compression" is set to 0 by default, which serves as the baseline state for policy adjustment.

[0051] according to Figure 3 Following a predetermined priority branching order, the system performs conditional rule checks one by one to ensure that high-priority rules take effect first. First, it enters the small file optimization branch. When the file size is less than the 1KB threshold, it automatically switches the encryption mode to ECB and adjusts the key length to 16 bytes, while also noting the reason for the policy adaptation. This lightweight configuration improves the performance of small file processing.

[0052] Next, the system enters the large file security assessment branch. When the file size exceeds the 10MB threshold, the system will always use the CBC encryption mode and configure a 32-byte key length. Relying on the chain encryption feature of the CBC mode, the system will significantly improve the security level of large file encryption and ensure the security of data transmission and storage.

[0053] After determining the file size dimension, the system proceeds... Figure 3The file type adaptation branch provides differentiated parameter configurations for different file types, balancing encryption efficiency with usage requirements. Text files use CBC mode, a 32-bit key, and compression enabled; image, video, and audio media files use CBC mode, a 32-bit key, and compression disabled; document files use CBC mode, a 32-bit key, and compression enabled; archive compressed files use CBC mode and a 32-bit key configuration; binary files use CBC mode by default, ensuring the highest level of security protection.

[0054] After the basic rules are determined, the system proceeds according to... Figure 3 The highest priority is set, and two constraint branch rules with mandatory overriding effect are executed to further enhance security protection capabilities.

[0055] One branch is the pattern leakage protection branch. Once "has_patterns" is detected as 1, it means that the file has duplicate content characteristics. The system immediately forces the encryption mode to be locked to CBC and adds a note to the policy reason that duplicate pattern was detected and forces the use of CBC encryption to eliminate the risk of pattern leakage.

[0056] The second branch is sensitive data protection. If "is_sensitive" is identified as a sensitive attribute, the system will forcibly configure CBC mode and a 32-bit key length, and supplement the labeling of sensitive data with 256-bit CBC encryption protection to ensure that sensitive information is protected at the highest level.

[0057] After all rule branch judgment processes are completed, the system outputs complete information such as file name, file size, file type, encryption mode, key length, and policy adaptation reason. At the same time, it returns the configured encryption policy structure object, providing accurate and reliable parameter basis for the subsequent adaptive encryption execution process.

[0058] Step S4: Based on the encryption execution strategy, the plaintext data of the file is processed and encryption operations are performed to generate and write the ciphertext file. At the same time, the parameters of the encryption execution strategy are used to construct a reverse decryption process to realize ciphertext parsing and original data restoration.

[0059] like Figure 4 The diagram illustrates the overall process of the adaptive encryption method. This application strictly follows the entire process outline shown in the diagram, sequentially and orderly completing data filling, AES encryption and decryption operations, and file read / write output, from data preprocessing to encryption calculations, file output, and reverse decryption and restoration. This ensures that each step corresponds precisely to the node shown in the diagram, creating a closed-loop process with rigorous logic, thus guaranteeing the security and efficiency of data encryption.

[0060] During the encryption preprocessing stage, to ensure that the original file data length meets the block alignment requirements of AES block encryption, the system strictly follows the PKCS#7 standard to pad the original file data. Specifically, the padding length `pad_length` is first calculated using a preset algorithm, which is calculated by subtracting the file size modulo 16 from 16. If the file size is exactly divisible by 16 (i.e., the modulo result is 0), then `pad_length` is directly set to 16, ensuring that each block of data meets the standard block length requirements of AES encryption, laying the foundation for the smooth execution of subsequent encryption operations.

[0061] Based on the calculated total length after padding (padded_length), the system calls the malloc function to dynamically allocate memory space of the corresponding size to store the padded complete data. Then, the memcpy function is used to copy the original file data completely and accurately to this memory area, preventing loss or tampering of the original data. After copying, pad_length bytes of equal value are continuously padded to the end of the original data, completing the standardized data padding process. For example, if the original data is 13 bytes, three 0x03 bytes are padded; if the original data is 16 bytes, sixteen 0x10 bytes are padded. This standardized padding ensures that subsequent decryption steps can accurately identify and remove padding bytes, guaranteeing the integrity of the restored data.

[0062] After data filling is complete, the system executes the corresponding AES encryption operation according to the encryption mode selected in the previous strategy decision-making stage, achieving encryption adaptation for different scenarios and balancing efficiency and security. In the ECB mode specifically for small files, the aes_key_expansion function is first called to complete the key expansion process, generating the extended key sequence required for encryption operations. At the same time, an encryption output buffer matching the length of the filled data is allocated to store the encrypted ciphertext data. Then, a block-by-block encryption loop is started, with the initial traversal index set to 0. The aes_cipher function is called sequentially for each 16-byte data block to complete the encryption calculation. After processing each data block, the index is incremented, and the traversal continues until all data blocks are encrypted, ensuring the high efficiency of small file encryption and adapting to the need for rapid processing of small amounts of data.

[0063] In the default CBC mode, sufficient encryption buffers are pre-allocated, and the `prev_cipher_block` variable is initialized to a preset IV initialization vector, providing an initial baseline for chained encryption. Then, a chained encryption loop is initiated, with the loop index initially set to 0. The plaintext data after padding is processed block by block. Each round of processing executes three core steps sequentially: XORing the plaintext block with the preceding ciphertext block, performing AES block encryption on the XOR result, and updating the currently generated ciphertext block with the new preceding ciphertext block. After each round of processing, the index is incremented until all plaintext blocks are encrypted. This chained encryption mechanism allows the same plaintext block to generate completely different ciphertext blocks in different positions, fundamentally avoiding the risk of content pattern leakage and significantly improving the security of encrypted data. It is suitable for most file encryption scenarios requiring a high level of security. After all encryption operations are completed, the system calls the `free` function to release the temporary memory space occupied by the padding data, retaining only the encrypted valid ciphertext data, avoiding memory waste and ensuring system efficiency.

[0064] After the encrypted data processing is complete, the system proceeds to the ciphertext file output stage. The system opens the preset output file in binary write mode ("wb") and uses the fwrite function to write the encrypted and valid ciphertext data completely and orderly into the file, ensuring that the ciphertext data is not lost or disordered. After the write operation is completed, the fclose function is called in a timely manner to close the file handle, avoid file resource leakage, and ensure the security and reliability of persistent storage of ciphertext data.

[0065] correspond Figure 4 In the reverse decryption phase of the overall process, the system synchronously builds a complete decryption execution logic to ensure that the ciphertext can be accurately restored to the original plaintext data. First, the encrypted file is read from external storage using the `fopen` function and fully loaded into system memory. Simultaneously, the total length of the ciphertext data is obtained, and a decryption buffer matching the ciphertext length is pre-allocated to provide sufficient memory support for the decryption operation. Then, based on the working mode used in the encryption phase, the corresponding decryption function is automatically matched and called. The decryption process also uses a loop index traversal method, initializing the index to 0, processing the ciphertext data block by block, and incrementing the index after each block to ensure that all ciphertext blocks can be completely decrypted.

[0066] In CBC decryption mode, the system strictly follows the reverse logic corresponding to the encryption step, restoring the original plaintext data block by block. The specific steps are as follows: First, perform AES decryption on the current ciphertext block to obtain an intermediate decryption result; then, perform an XOR operation between this intermediate result and the previous ciphertext block to obtain the corresponding plaintext block. After all decryption is complete, the system reads the value of the last byte of the decrypted data as pad_length, and verifies whether the value of pad_length is within the valid range of 1 to 16 to ensure that the padding data has not been tampered with and is valid and usable. Then, by subtracting pad_length from the total ciphertext length, the effective length of the original plaintext data is calculated, and redundant padding bytes at the end of the decrypted data are precisely removed. Finally, the restored clean plaintext data is written to the preset target storage path, completing the complete and accurate restoration of the original file data and achieving a closed-loop connection between the adaptive encryption and decryption processes.

[0067] Step S5: Release the dynamic memory resources requested during the encryption and decryption process in a unified manner. Establish a graded error handling mechanism for working conditions including file read / write permissions, abnormal memory allocation, key matching failure, and corrupted ciphertext data, and complete the closed-loop management of resource recovery and fault tolerance throughout the entire process.

[0068] Accept Figure 4 In the final control phase of the adaptive encryption method's overall process, after all encryption and decryption logic has been executed, the system centrally manages the temporarily allocated memory space during operation. It uniformly traverses all resources dynamically allocated during the process, including file cache areas, temporary data filling space, ciphertext data storage buffers, and memory occupied by key expansion, and performs memory release and storage space reclamation operations one by one according to the program's execution logic. This prevents long-term memory occupation, resource idleness, and memory leaks from the operational level, ensuring long-term stable system operation.

[0069] Meanwhile, the system has established a comprehensive multi-condition hierarchical error handling mechanism, covering various common abnormal scenarios in the entire adaptive encryption process. When encountering conditions such as invalid file path configuration, missing system access permissions, or abnormal file read / write interaction, it can promptly output status prompts and terminate the current business process in an orderly manner according to the standard logic, preventing the program from getting stuck or crashing abnormally.

[0070] If system memory allocation requests fail or hardware resources are insufficient, the system can immediately trigger a running alarm and proactively reclaim currently occupied memory resources to maximize the release of available system space and alleviate resource shortages.

[0071] In the encryption / decryption verification process, if key mismatch or failure of end padding data verification occurs, the system can accurately identify the cause of the fault and output a clear error message, making it easy to quickly locate the source of the problem.

[0072] When issues such as corrupted encrypted file storage or abnormal decryption output data are detected, a risk warning is immediately issued, and the subsequent decryption process is proactively terminated to prevent abnormal data from continuing to circulate and causing secondary impacts.

[0073] The system internally configures independent main encryption and decryption functions, strictly adhering to... Figure 4 The illustrated process logic architecture sequentially connects key steps such as file reading and parsing, file attribute analysis, encryption strategy selection, raw data filling, AES encryption and decryption operations, and file writing and saving, forming a complete business execution chain.

[0074] Based on a unified memory reclamation mechanism and hierarchical exception handling logic covering all scenarios, an integrated fault-tolerant control closed loop is constructed for the entire process of adaptive encryption method, including exception interception, automatic resource cleanup, and real-time feedback of running status. This effectively improves the overall stability, robustness, and maintainability of the method.

[0075] To verify the actual performance optimization effect of the adaptive encryption strategy of the present invention, this application has established a multi-dimensional performance benchmark evaluation system covering multiple indicators such as encryption time, network transmission time, end-to-end overall time, system service throughput and protocol redundancy overhead, and carried out quantitative comparative tests from the aspects of computational efficiency, transmission efficiency and resource consumption.

[0076] This performance test used a 1MB standard official document file as the test sample for simulated transmission. The dynamic adaptive encryption strategy of this invention was compared with the fixed AES-256-CBC static encryption strategy commonly used in existing technologies. The test data and comparison results for multiple scenarios are detailed in Table 1. The test results show that this invention can automatically match the optimal encryption parameters according to the network environment, transmission scenario and data sensitivity level, and shows obvious performance and adaptability advantages under different application conditions.

[0077] In local transmission and low-sensitivity business scenarios, this system can intelligently and automatically downgrade to the ECB-128 lightweight encryption mode. The actual measured encryption operation time is only 1024ms, the network transmission time is 9ms, and the total end-to-end time is 1033ms. Compared with the traditional solution that forces the use of the high-specification CBC-256 encryption throughout the process, the cryptographic operation efficiency and overall data processing performance of this invention can be improved by up to 40%, which significantly reduces the local computing power consumption while ensuring basic security.

[0078] In mobile network bandwidth-constrained transmission scenarios, the system automatically adapts to and selects the CBC-192 encryption specification, and activates an adaptive data compression mechanism. The actual measured password calculation time is 5529ms, the network transmission time is 10334ms, and the total end-to-end time including encryption processing and network transmission is 15863ms. Compared with the traditional fixed encryption strategy that does not have adaptive compression capabilities, this invention effectively improves the business communication rate and actual effective throughput. While saving network traffic consumption, the overall end-to-end business processing performance is improved by 30%, and it is more suitable for complex mobile transmission environments such as weak networks and narrowband.

[0079] In application scenarios where VPN private networks already have link encryption at the underlying layer, the system can intelligently sense the existing encryption protection status of the transmission channel, actively avoid the redundant overhead caused by repeated encryption, and automatically downgrade to CBC-128 encryption mode. Compared with the resource waste caused by the traditional solution still forcibly adopting high-specification encryption, this invention can effectively reduce the computing power and latency loss caused by double encryption, and improve the overall running performance by about 25% (because the core optimization of the scenario is to avoid the overhead of double encryption, the specific time consumption is not calculated separately).

[0080] In high-risk access scenarios on public wireless networks, traditional strategies still maintain fixed encryption configurations. This invention, however, proactively upgrades the security protection level by adopting the CBC-256 encryption specification and superimposing the HMAC integrity verification mechanism. The actual measured password calculation time is 949ms, the network transmission time is 967ms, and the total end-to-end time is 1916ms. Within a controllable computational latency range, it makes up for the shortcomings in data anti-tampering and anti-eavesdropping security in public network environments, taking into account both transmission performance and high-level security protection requirements.

[0081] In a local area network file sharing scenario, the system adopts an intelligent balancing strategy to adaptively select the CBC-192 encryption mode. The actual test results show that the password calculation time is 12288ms, the network transmission time is 902ms, and the total end-to-end time is 13190ms. This configuration avoids blindly adopting excessively high encryption specifications, which would cause redundant computing power, and also avoids lowering security standards and causing data risks. It achieves the optimal balance between computing power consumption and encryption security strength.

[0082] Table 1 Performance Scenario Quantitative Comparison Table

[0083] The quantitative test indicators and the comparative data in Table 1 fully demonstrate that the present invention can dynamically adjust the encryption strategy according to the scenario and optimize it according to the environment, taking into account multiple requirements of computing speed, communication efficiency and security protection. It effectively breaks through the triadic technical paradox of traditional fixed encryption schemes, which cannot take into account the performance, data security and network resource consumption. It has good engineering application value and performance adaptation advantages in various actual business transmission scenarios.

[0084] Example 2 This invention provides a dynamic adaptive encryption system for electronic documents based on a quantization model. Figure 5 This is a schematic diagram illustrating the structure of a dynamic adaptive encryption system for electronic documents based on a quantization model, provided as an embodiment of the present invention. Figure 5 As shown, the system includes: Data construction module 100 constructs a data system that includes file type enumeration, encryption mode enumeration, file attribute structure and encryption strategy structure, establishes the mapping relationship between file extension and file type, configures basic system parameters and generates random key and initial vector; The attribute recognition module 200 identifies the type of the target file based on the file type mapping relationship, detects the duplicate features of the file content and determines the sensitive attributes of the file, and integrates the file size, file type, content features and sensitive attributes to construct a complete file attribute object; The strategy adaptation module 300, based on file attribute objects, performs adaptation judgment through a preset multi-level priority rule engine, and dynamically generates an encryption execution strategy that matches the characteristics of the current file by combining file size, format category, content redundancy features and sensitive attribute constraints. The ciphertext processing module 400, based on the encryption execution strategy, processes the plaintext data of the file and performs encryption operations to generate and write the ciphertext file. At the same time, it uses the parameters of the encryption execution strategy to construct a reverse decryption process to realize ciphertext parsing and original data recovery. The anomaly control module 500 uniformly releases the dynamic memory resources requested during the encryption and decryption process. It establishes a graded error handling mechanism for working conditions including file read / write permissions, abnormal memory allocation, key matching failure, and corrupted ciphertext data, and completes the closed-loop control of resource recovery and anomaly tolerance throughout the entire process.

[0085] Regarding the system in the above embodiments, the specific ways in which each module performs operations have been described in detail in the embodiments related to the method, and will not be elaborated here.

[0086] Example 3 To implement the methods of the above embodiments, the present invention also provides an electronic device, which includes a memory and a processor; wherein the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the various steps of the methods described above.

[0087] Example 4 To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method described in the foregoing embodiments.

[0088] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0089] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0090] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A dynamic adaptive encryption method for electronic documents based on a quantization model, characterized in that, include: Construct a data system that includes file type enumeration, encryption mode enumeration, file attribute structure and encryption strategy structure, establish a mapping relationship between file extension and file type, configure basic system parameters and generate random key and initial vector; Identify the type of the target file based on the file type mapping relationship, detect the duplicate features of the file content and determine the sensitive attributes of the file, and integrate the file size, file type, content features and sensitive attributes to construct a complete file attribute object; Based on file attribute objects, an adaptation judgment is made through a preset multi-level priority rule engine. Combining file size, format category, content redundancy features and sensitive attribute constraints, an encryption execution strategy that matches the characteristics of the current file is dynamically generated. Based on the encryption execution strategy, the plaintext data of the file is processed and encrypted to generate and write the ciphertext file. At the same time, the parameters of the encryption execution strategy are used to construct a reverse decryption process to realize ciphertext parsing and original data recovery. Unify the release of dynamic memory resources requested during the encryption and decryption process. Establish a graded error handling mechanism for working conditions including file read and write permissions, abnormal memory allocation, key matching failure, and ciphertext data corruption, and complete the closed-loop management of resource reclamation and fault tolerance throughout the entire process.

2. The method according to claim 1, characterized in that, Construct a data system including file type enumeration, encryption mode enumeration, file attribute structure, and encryption policy structure; establish a mapping relationship between file extensions and file types; configure basic system parameters; and generate random keys and initialization vectors, including: Based on the functional requirements of the encryption system, two enumeration types are defined: file type enumeration and encryption mode enumeration. Two data structures are constructed: file attribute structure and encryption strategy structure, and a standardized data system is built. Based on file format classification rules, a mapping relationship between file extensions and file types is established, covering multiple file formats including text, images, videos, audio, documents, compressed files, and binary files. Configure the system's basic parameters according to the requirements of encryption operations and feature detection, and determine the data block length, file size classification threshold, content feature sampling parameters, and judgment threshold. A randomized security mechanism is used to allocate storage space for the key and initialization vector, and the key and initialization vector are initialized by random generation.

3. The method according to claim 2, characterized in that, Based on the file type mapping relationship, the target file type is identified, duplicate features of the file content are detected, and sensitive file attributes are determined. File size, file type, content features, and sensitive attributes are integrated to construct a complete file attribute object, including: Extract the extension information from the target file name, convert it into a uniform character format, and compare and match it with the established extension mapping relationship to complete the identification and determination of the file type; The file content is read into the memory space as needed according to the file size, and the file data blocks are sampled and compared according to the preset sampling rules. The duplication of adjacent data blocks is counted, and the redundancy pattern of the file is determined based on the duplication characteristics. The target file is identified by its attributes according to the preset sensitivity judgment rules, and the file is marked as whether it belongs to the category of classified sensitive data. By integrating file size, identified file type, detected content redundancy features, and sensitive attributes for identification from multiple dimensions, a complete and standardized file attribute object is constructed.

4. The method according to claim 3, characterized in that, Based on file attribute objects, an adaptation judgment is performed through a preset multi-level priority rule engine. Combining file size, format type, content redundancy features, and sensitive attribute constraints, an encryption execution strategy matching the characteristics of the current file is dynamically generated, including: Initialize basic encryption parameters and determine the default values ​​for encryption mode, key length, and data compression usage. The multi-dimensional decision-making rules are executed sequentially according to the preset priority order, and the basic strategy parameters are adapted and adjusted in combination with the file storage space size and file format category attributes. Redundant content features and sensitive attributes are used as the highest priority constraints to cover, correct and forcibly limit the already adapted basic strategy parameters. Integrate all rule judgment results to generate a final encryption strategy that matches file characteristics, and simultaneously generate strategy adaptation instructions.

5. The method according to claim 4, characterized in that, Process the plaintext data of the file and perform encryption operations to output the encrypted ciphertext file, including: Based on the encryption mode and key specifications selected by the encryption execution strategy, the original plaintext data of the file is padded according to the standard padding specification to complete the original data copying and standardized byte padding. Encryption operations are performed according to the working mode selected by the encryption execution strategy. The overall encryption operation is carried out by either independent block encryption or chain-related encryption, and key expansion, block iterative encryption and chain vector XOR operation processing are completed. After the encryption operation is completed, the memory for filling data is released, the encrypted ciphertext data is retained, and the ciphertext data is written to the target file using binary writing method to generate a standard encrypted file.

6. The method according to claim 5, characterized in that, A reverse decryption process is constructed using the parameters of the encryption execution strategy to achieve ciphertext parsing and original data recovery, completing adaptive encryption and decryption closed-loop control, including: Read the encrypted file from external storage and load it into memory, obtain the total length of the ciphertext data, and pre-allocate the data cache buffer required for decryption operations; Match the working mode and key parameters used in the encryption stage, build the corresponding reverse decryption logic flow, and complete the ciphertext decryption and vector inverse operation block by block according to the decryption operation rules; Extract the identifier byte at the end of the decrypted data, verify the compliance and validity of the value of the padding byte, remove the standardized padding redundant bytes, and restore the true length of the original plaintext data. Write the complete original plaintext data after removing padding to the target storage path to complete the ciphertext parsing verification and original file data restoration.

7. The method according to claim 6, characterized in that, Unified release of dynamic memory resources allocated during encryption and decryption processing; establishment of a tiered error handling mechanism for scenarios including file read / write permissions, abnormal memory allocation, key matching failure, and corrupted ciphertext data; completion of resource reclamation and closed-loop fault tolerance management throughout the entire process, including: After the entire encryption and decryption process is completed, it iterates through the various memory resources dynamically allocated during the process, such as file cache, data filling, ciphertext storage, and key expansion, and releases and reclaims the space one by one. For business scenarios such as invalid file paths, insufficient access permissions, and file read / write failures, set up a dedicated exception judgment branch, output verification prompts, and terminate the current business process in an orderly manner. In response to abnormal hardware conditions such as system memory allocation failure or insufficient storage space, an abnormal alarm will be triggered immediately, and the occupied resources will be reclaimed and released in advance. For each of the following abnormal operating conditions: key mismatch, data filling verification failure, and corrupted encrypted data storage, corresponding abnormal prompt logic is set up to complete the identification and notification of the cause of the failure; By unifying the reclamation of memory resources across all dimensions and handling different levels of exceptions under various operating conditions, a closed-loop fault-tolerant management system is constructed that integrates exception interception, resource cleanup, and status feedback throughout the entire encryption and decryption process.

8. A dynamic adaptive encryption system for electronic documents based on a quantization model, characterized in that, include: The data construction module builds a data system that includes file type enumeration, encryption mode enumeration, file attribute structure and encryption strategy structure, establishes the mapping relationship between file extension and file type, configures basic system parameters and generates random keys and initial vectors. The attribute recognition module identifies the type of the target file based on the file type mapping relationship, detects the duplicate features of the file content and determines the sensitive attributes of the file, and integrates the file size, file type, content features and sensitive attributes to construct a complete file attribute object; The strategy adaptation module, based on file attribute objects, performs adaptation judgment through a preset multi-level priority rule engine, and dynamically generates an encryption execution strategy that matches the characteristics of the current file by combining file size, format category, content redundancy features and sensitive attribute constraints. The ciphertext processing module, based on the encryption execution strategy, processes the plaintext data of the file and performs encryption operations to generate and write ciphertext files. At the same time, it uses the parameters of the encryption execution strategy to construct a reverse decryption process to realize ciphertext parsing and original data recovery. The anomaly control module uniformly releases the dynamic memory resources requested during the encryption and decryption process. It establishes a graded error handling mechanism for working conditions including file read / write permissions, abnormal memory allocation, key matching failure, and corrupted ciphertext data, and completes the closed-loop control of resource reclamation and anomaly tolerance throughout the entire process.

9. An electronic device, characterized in that, Including processor and memory; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the method as described in any one of claims 1-7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-7.

Images