File transmission encryption method and device based on device identification, equipment and medium

Abstract

The application relates to the technical field of computer data security, and provides a file transmission encryption method and device based on device identification, equipment and medium, the method comprises the following steps: receiving a file stream encryption result sent by a client; wherein the file stream encryption result is obtained by encrypting a read file stream by the client using a target session key; the target session key is obtained by decrypting a received encryption key by the client using a locally generated device private key; the encryption key is obtained by encrypting a dynamically generated initial key by the client using a device public key based on the legality verification of the device identification sent by the client; the validity of the file stream encryption result is verified, and based on the verification, the file stream encryption result is stored. The application can effectively prevent the key from being stolen or tampered with during transmission, realize efficient, dynamic and safe encryption of sensitive file streams, and effectively prevent the security risks caused by long-term use of static keys.

Description

Technical Field

[0001] This invention relates to the field of computer data security technology, and in particular to a file transfer encryption method, apparatus, device, and medium based on device identification. Background Technology

[0002] With the rapid development of computer technology, data encryption has become a core technical means to ensure the security of cross-device file transfer. It is widely used, especially in business scenarios such as file uploading, downloading, and sensitive information exchange in software systems. Its core purpose is to prevent file data from being illegally stolen, abused across devices, or maliciously tampered with during transmission and storage.

[0003] Currently, file transfer encryption technologies mainly employ globally unified key symmetric encryption. Globally unified key symmetric encryption schemes typically use symmetric encryption algorithms, employing a globally unified fixed key to encrypt file content, and relying on Hypertext Transfer Protocol Secure (HTTPS) to ensure the security of the transmission link. Specifically, the server pre-configures a unified encryption key and embeds it in the application code or configuration file; when a client uploads a file, the server uses this unified key to encrypt and store the file content; when a client downloads a file, the server uses the same key to decrypt it and return the file stream, or the client obtains the encrypted file and decrypts it locally using the unified key.

[0004] However, the aforementioned file transfer encryption technologies, because all devices share the same encryption key, are vulnerable to attack. If the key is leaked through configuration files, code decompilation, or internal personnel, attackers can decrypt all historical and future encrypted files on any device, leading to a complete loss of data security control. The source of the leak cannot be located, and encrypted files can be copied arbitrarily. Anyone with the unified key can decrypt and use the files on unauthorized devices, making it difficult to achieve precise control over file access to only authorized devices. This greatly increases the risk of paid content piracy and the leakage of sensitive corporate data. Furthermore, when authorized devices change, such as when employees replace their computers or devices become obsolete, it is often necessary to update the unified key for all devices to prevent the original device from continuing to decrypt files. It is impossible to reclaim the authorization of a specific device at low cost, severely impacting business continuity and increasing maintenance costs. Additionally, some solutions temporarily store files in plaintext during processing, or plaintext cache residue may remain due to transmission link interruptions, failing to meet the stringent requirements of compliance standards such as the Information Security Law and GDPR regarding the encryption of sensitive data throughout its entire lifecycle. Summary of the Invention

[0005] This invention provides a file transfer encryption method, apparatus, device, and medium based on device identification, which addresses the shortcomings of existing technologies such as high risk of key leakage and cross-device abuse caused by globally unified key encryption. By strongly binding the device to the root key and the device to the encrypted file, it ensures that each device has a unique code and only legitimate clients can decrypt the file. This effectively prevents the key from being stolen or tampered with during transmission, achieving efficient, dynamic, and secure encryption of sensitive file streams and effectively preventing the security risks caused by the long-term use of static keys.

[0006] This invention provides a file transfer encryption method based on device identifier, comprising: receiving a file stream encryption result sent by a client; wherein the file stream encryption result is obtained by the client encrypting the read file stream using a target session key, the target session key is obtained by the client decrypting the received encryption key using a locally generated device private key, and the encryption key is obtained by encrypting a dynamically generated initial key based on the valid verification of the device identifier sent by the client and using the device public key sent by the client; verifying the validity of the file stream encryption result, and storing the file stream encryption result based on the successful verification.

[0007] According to the present invention, a file transfer encryption method based on device identifier includes the following steps before receiving the encrypted file stream result sent by the client: receiving a device identifier sent by the client; wherein the device identifier is obtained by the client through concatenation and hashing of collected system certificate information and device serial number information, and the system certificate information is used to characterize the legality of the device identity; performing legality verification on the device identifier, the legality verification including at least one of device identifier format compliance verification, hash legality verification, and device legality verification; based on the successful legality verification, using the corresponding device identifier as a seed parameter, and combining it with a root key derived from the system certificate information, generating an initial key that meets the key length requirements of a preset symmetric encryption algorithm through a preset key derivation algorithm; encrypting the initial key using the device public key sent by the client to obtain an encryption key, and sending the encryption key to the client.

[0008] According to the present invention, a file transfer encryption method based on device identifier is provided. Based on successful legality verification, the corresponding device identifier is used as a seed parameter, combined with a root key derived from system certificate information, to generate an initial key that meets the key length requirements of a preset symmetric encryption algorithm through a preset key derivation algorithm. The method includes: generating a root key based on system certificate information using a preset certificate key derivation algorithm; extracting a specified byte segment from the root key as a derived public key parameter; and inputting the device identifier as the seed parameter and the derived public key parameter into the preset key derivation algorithm to obtain an initial key that meets the key length requirements of a preset symmetric encryption algorithm.

[0009] According to the present invention, a file transfer encryption method based on device identifier is provided. The device identifier is obtained by the client using the system universal unique identifier (UUID) combined with device system information through concatenation and hashing when system certificate information and device serial number information have not been collected.

[0010] According to the file transfer encryption method based on device identifier provided by the present invention, after sending the encryption key to the client, or before receiving the device identifier sent by the client, the method further includes: receiving encrypted session data sent by the client; wherein the encrypted session data is obtained by the client encrypting the target session key or session file using the received root key; decrypting the encrypted session data using a private key; wherein the private key is derived using system certificate information and device serial number information keys when it is determined that a successful information collection notification sent by the client has been received or a failed information collection notification sent by the client has not been received within the target time, or the private key is derived using the system universal unique identifier (UUID) combined with the device system information key when it is determined that a failed information collection notification sent by the client has been received; verifying the legality of the decrypted key data and returning the verification result to the client so that the client can read the file stream based on the verification.

[0011] According to a file transfer encryption method based on device identifier provided by the present invention, the file stream encryption result includes an encrypted file, ciphertext of file content, a random number, and a timestamp; the validity verification of the file stream encryption result includes: obtaining the system time and determining whether the difference between the timestamp and the system time is within a preset time error range; querying a preset used random number record library to determine whether the random number exists in the preset used random number record library; encrypting the ciphertext of file content using an initial key and comparing whether the encryption result is consistent with the encrypted file; if the timestamp is within the time error range, the random number does not exist in the used random number record library, and the encryption result is consistent with the encrypted file, the file stream encryption result is determined to have passed the validity verification.

[0012] According to the present invention, a file transfer encryption method based on device identifier is provided, the method further includes: receiving a file download request sent by a client; determining whether there is a binding relationship between the corresponding device identifier and the root key derived from system certificate information based on the device identifier in the file download request; and when it is determined that there is a corresponding binding relationship, returning the corresponding file stream encryption result to the client.

[0013] The present invention also provides a file transfer encryption device based on device identifier, comprising: a file receiving module for receiving a file stream encryption result sent by a client; wherein the file stream encryption result is obtained by the client encrypting the read file stream using a target session key, the target session key is obtained by the client decrypting the received encryption key using a locally generated device private key, and the encryption key is obtained by encrypting a dynamically generated initial key based on the valid verification of the device identifier sent by the client and using the device public key sent by the client; and a verification and storage module for verifying the validity of the file stream encryption result and storing the file stream encryption result based on the successful verification.

[0014] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the file transfer encryption method based on device identifier as described above.

[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the file transfer encryption method based on device identifier as described above.

[0016] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the file transfer encryption method based on device identifier as described above.

[0017] The file transfer encryption method, apparatus, device, and medium based on device identifier provided by this invention encrypt the received file stream by having the client decrypt the received encryption key using the device's locally stored private key, and then encrypt the file using the decrypted target session key. This avoids the inefficiency of directly using asymmetric encryption for large file streams. It leverages both the security advantages of asymmetric algorithms in key distribution and the high performance advantages of symmetric algorithms in data encryption, achieving efficient, dynamic, and secure encryption of sensitive file streams. Furthermore, the encryption key is obtained by dynamically generating an initial key using the device's public key sent by the client after verifying the device identifier sent by the client. By making device legitimacy verification a necessary prerequisite for encryption key generation and distribution, it ensures that only legitimate devices can generate valid encrypted data, thereby effectively preventing unauthorized clients from forging or... This approach mitigates the risk of tampering with uploaded data, avoids the security risks associated with long-term use of static keys, and encrypts data transmitted to the client. This ensures that only legitimate clients holding the corresponding device's private key can decrypt the data, effectively preventing theft or tampering of the key during transmission and guaranteeing the confidentiality and security of key distribution. By validating the encrypted results of the received file stream, it avoids situations where direct data storage might lead to invalid, tampered, or malicious data contaminating the storage system. Ensuring that only verified encrypted file stream results are stored not only guarantees the integrity and authenticity of the data entering the database but also avoids wasting storage resources. This provides reliable quality assurance for subsequent data reading and processing, constructing an end-to-end encrypted transmission closed loop. This solves the problems of insufficient high-strength encryption protection for file streams before transmission and storage, as well as the insecurity of the key distribution process in existing technologies. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is one of the flowcharts illustrating the file transfer encryption method based on device identifier provided by the present invention; Figure 2 This is the second flowchart illustrating the file transfer encryption method based on device identifier provided by the present invention; Figure 3 This is a schematic diagram of the file transfer encryption device based on device identification provided by the present invention; Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0021] Figure 1 This is one of the flowcharts illustrating the file transfer encryption method based on device identifier provided by the present invention, such as... Figure 1 As shown, the method includes the following: S11, Receive the file stream encryption result sent by the client; wherein, the file stream encryption result is obtained by the client encrypting the read file stream using the target session key, the target session key is obtained by the client decrypting the received encryption key using the locally generated device private key, and the encryption key is obtained by encrypting the dynamically generated initial key based on the legality verification of the device identifier sent by the client and using the device public key sent by the client. S12 verifies the validity of the file stream encryption result and stores the file stream encryption result based on the successful verification.

[0022] It should be noted that the execution entity of this method is the server. The following section will provide a detailed explanation. Figure 2 The present invention describes a file transfer encryption method based on device identifier.

[0023] Step S11: Receive the file stream encryption result sent by the client; wherein, the file stream encryption result is obtained by the client encrypting the read file stream using the target session key, the target session key is obtained by the client decrypting the received encryption key using the locally generated device private key, and the encryption key is obtained by encrypting the dynamically generated initial key based on the validity verification of the device identifier sent by the client and using the device public key sent by the client.

[0024] It's important to note that the client first generates a device key pair, sending the device's public key to the server and storing the device's private key locally. This allows the client to decrypt the encryption key only locally, preventing the risk of private key leakage at the source. Additionally, the client sends a device identifier to the server for verification. If the server verifies the device identifier's legitimacy, it uses the client's public key to encrypt the dynamically generated initial key, obtaining an encryption key, which is then sent to the client. This ensures that even if the transmission link is eavesdropped on, attackers cannot decrypt without the device's private key, solving the symmetric key distribution security problem. The client then uses its local device private key to decrypt the encryption key, obtaining the target session key to reconstruct the initial key. It then uses the target session key to encrypt the read file stream. The entire process of encrypting and decrypting files is handled as a file stream, without generating plaintext temporary files, avoiding the risk of leakage due to plaintext storage. Furthermore, the device's private key is stored locally, while the server only stores the device's public key and encryption key, preventing the private key from being transferred without plaintext, thus protecting against key loss due to server data leakage.

[0025] Furthermore, through the dual interaction of the device public key and the device identifier, the server verifies the legitimacy of the device identifier to ensure the device's identity is legitimate. This avoids security risks caused by the inability to effectively verify the client's legitimate identity. After verifying the device's legitimacy, the server uses the device's public key to encrypt a dynamically generated initial key, avoiding security risks associated with the long-term use of static keys. This encrypted key is then transmitted to the client, ensuring that only a legitimate client holding the corresponding device private key can decrypt it. This achieves a strong binding between the device identifier, public key, and dynamic key, effectively preventing the key from being stolen or tampered with during transmission and ensuring the confidentiality and security of key distribution. The client uses its local device private key to decrypt the key to obtain the session key and uses the session key to encrypt the file stream. This avoids the inefficiency of directly using asymmetric encryption to process large file streams. It leverages both the security advantages of asymmetric algorithms in key distribution and the high performance advantages of symmetric algorithms in data encryption, achieving efficient, dynamic, and secure encryption of sensitive file streams.

[0026] Furthermore, the client generates a device key pair based on an asymmetric encryption algorithm. More specifically, the asymmetric encryption algorithm can employ RSA encryption. Accordingly, the client generates the device key pair by randomly selecting two large prime numbers. and Determine the product of the two. (this It is part of the public key), and the exponent is determined by the Euler totient function. Based on the product and exponent, determine the device public key and device private key to obtain the device key pair.

[0027] In one optional embodiment, before receiving the encrypted file stream result sent by the client, the process includes: receiving a device identifier sent by the client; wherein the device identifier is obtained by the client through concatenation and hashing of collected system certificate information and device serial number information, and the system certificate information is used to characterize the electronic data identifying the legitimate identity of the device; performing a legitimacy verification on the device identifier, the legitimacy verification including at least one of device identifier format compliance verification, hash legitimacy verification, and device legitimacy verification; based on the successful legitimacy verification, using the corresponding device identifier as a seed parameter, and combining it with the root key derived from the system certificate information, generating an initial key that meets the key length requirements of a preset symmetric encryption algorithm through a preset key derivation algorithm; encrypting the initial key using the device public key sent by the client to obtain an encryption key, and sending the encryption key to the client.

[0028] Furthermore, the preset symmetric encryption algorithm can be the Advanced Encryption Standard (AES) algorithm, which can be selected according to actual design requirements and prior experience, without further restrictions here.

[0029] In addition, based on the successful legitimacy verification, the corresponding device identifier will be bound to the root key to support the authorization binding, unbinding and recycling of a single device. Even if a single device key is leaked, it will only affect the encrypted files corresponding to that device and will not lead to the exposure of all data. There is no need to replace the global key, reducing management costs. When the device is replaced, only the corresponding device identifier needs to be unbound, without updating the global key, reducing operation costs by 90%. If the legitimacy verification fails, it is determined that the device is not authorized and the service is denied.

[0030] It should be noted that before receiving the encrypted file stream result sent by the client, the client collects system certificate information and device serial number information, and concatenates and hashes these two pieces of information to ensure the uniqueness and immutability of the device identifier. This prevents the possibility of a single device identifier being forged or counterfeited, and the device identifier is sent to the server as a representation of the device's legitimacy. The server verifies the legitimacy of the device identifier to prevent unauthorized devices or malicious attackers from bypassing the verification to obtain services. This effectively filters invalid or malicious requests, ensures the security of the subsequent key distribution process, prevents resource abuse, and, based on the successful legitimacy verification, generates an initial key using a preset symmetric encryption algorithm based on the device identifier and root key. This achieves a strong binding between the key generation process and the device identity, eliminating the need to store plaintext keys and implementing a one-device-one-code system. This fundamentally prevents cross-device decryption and solves the problem of... This approach mitigates the predictability risks associated with static or weak random number generation while ensuring the dynamic and uncopyable nature of key generation. Even if the initial key is intercepted during transmission, attackers cannot independently reproduce the generation process, significantly enhancing security. Furthermore, it utilizes the device's public key sent by the client to encrypt the initial key, protecting its transmission and overcoming the vulnerability of keys to eavesdropping during network transmission. This ensures that only a specific legitimate client holding the corresponding device's private key can decrypt and obtain the initial key, achieving secure targeted key distribution and completing a secure closed loop from generation to use. Subsequent clients can then use the device's private key to decrypt the encrypted key and encrypt the file stream using the decrypted target session key, strongly binding the encrypted file stream to the device. Even if other devices obtain the ciphertext and random number, they cannot derive a key or decrypt it due to the lack of a matching device.

[0031] It should be added that the device identifier format compliance verification includes: verifying whether the data length and character composition of the device identifier meet the preset format requirements; device legitimacy verification includes: verifying whether the device identifier meets the preset list of legitimate devices; hash legitimacy verification includes: verifying whether the hash value of the device identifier meets the preset hash algorithm rules; and / or, concatenating and hashing the system certificate information and device serial number information of the corresponding derived private key to obtain a hash value, comparing the hash value with the received device representation to verify the device identity, thus eliminating the possibility of the client forging random hashes to impersonate the device ID.

[0032] In addition, when generating the initial key based on the preset root key and device identifier, it can also be generated by combining the corresponding timestamp. By using the device identifier as a seed parameter, combined with the root key and the corresponding timestamp, an initial key that meets the key length requirements of the preset symmetric encryption algorithm is generated through a preset key derivation algorithm.

[0033] Specifically, based on the successful legality verification, the corresponding device identifier is used as the seed parameter, combined with the root key derived from the system certificate information, to generate an initial key that meets the preset key length requirements of the symmetric encryption algorithm through a preset key derivation algorithm. This includes: generating a root key based on the system certificate information using a preset certificate key derivation algorithm; extracting a specified byte segment from the root key as a derived public key parameter; and inputting the device identifier as the seed parameter and the derived public key parameter into the preset key derivation algorithm to obtain an initial key that meets the preset key length requirements of the symmetric encryption algorithm.

[0034] It should be noted that the server derives the root key directly from the device's inherent system certificate information, thus strongly binding the key source to the system certificate. This solves the problem of the root key being easily stolen or tampered with due to reliance on external storage or random generation, ensuring that the key is rooted in the device's own trust chain. This guarantees the native security of the key system from the source. Furthermore, it precisely extracts specific fragments from the root key as parameters, rather than directly using the complete root key. This increases the internal complexity and uncertainty of key generation, solving the exposure risk that may exist if the complete key is used as a parameter. Moreover, this interception operation makes it difficult for attackers to reverse-engineer the complete root key even if some parameters are leaked during the derivation process, enhancing the root key's anti-reverse engineering capability. In addition, the device identifier is further integrated with the derived public key parameters to generate an initial key through an algorithm. This achieves deep integration of device identity and key generation, solving the problem of one key being used for multiple purposes or being abused across devices due to the decoupling of traditional key distribution and device identity. At the same time, it ensures that the generated initial key not only meets the length requirements of symmetric encryption algorithms but also has strong device specificity and dynamic characteristics.

[0035] Furthermore, the device identifier is used as a seed parameter, combined with the derived public key parameter, and input into a preset key derivation function for computation to generate an initial key that meets the preset symmetric encryption algorithm key length requirements. This includes: formatting the device identifier to obtain standardized identifier seed data; concatenating or XORing the derived public key parameter with the identifier seed data to generate mixed input data; padding the mixed input data to make its length reach the data block alignment length of the preset key derivation function; using the padded mixed input data as an input vector, substituting it into the preset key derivation function for multiple rounds of iterative hashing to obtain an intermediate digest result with a preset bit length; and extracting a byte sequence equal to the preset symmetric encryption algorithm key length from the beginning of the intermediate digest result, and determining this byte sequence as the initial key.

[0036] In addition, the device identifier is formatted, including: encoding the device identifier, converting the text-formatted device identifier into a uniform binary byte sequence; and padding the binary byte sequence to ensure that the length of the processed data meets the input block length requirements of the preset key derivation function.

[0037] In addition, when using the corresponding device identifier as a seed parameter, combined with the root key derived from the system certificate information, and generating an initial key that meets the key length requirements of the preset symmetric encryption algorithm through a preset key derivation algorithm, the initial key can also be generated by combining the timestamp. By concatenating or XORing the timestamp with the derived public key parameter and the identifier seed data, mixed input data is generated, and then the preset symmetric encryption algorithm is used to generate the initial key.

[0038] In an optional embodiment, after sending the encryption key to the client, or before receiving the device identifier sent by the client, the method further includes: receiving encrypted session data sent by the client; wherein the encrypted session data is obtained by the client encrypting the target session key or session file using the received root key; decrypting the encrypted session data using a private key; wherein the private key is derived using system certificate information and device serial number information keys when it is determined that a successful information collection notification sent by the client has been received or a failed information collection notification sent by the client has not been received within a target time; verifying the legality of the decrypted key data and returning the verification result to the client so that the client can read the file stream based on the verification pass.

[0039] It should be noted that by receiving session data encrypted with the root key on the server side and decrypting it using the stored private key, a communication handshake is performed before the client uploads files. This ensures the confidentiality of subsequent file transfers and prevents the file stream from being eavesdropped on or intercepted in the channel. Furthermore, the private key is derived by the server based on the system certificate and device serial number, rather than simply stored in a database. This enables dynamic generation of the server's private key and device binding, significantly reducing the risk of large-scale data leakage due to a compromised static keystore on the server side. The post-decryption validation adds an extra layer of security, preventing man-in-the-middle attacks or spurious handshakes caused by tampered but correctly formatted data. The validation result is returned as a prerequisite for the client to read the file stream, constructing a closed-loop control mechanism of request, verification, and execution. This ensures that only complete, legitimate, and tamper-proof session data can unlock file access permissions, effectively preventing malicious clients from using illegal data to fraudulently obtain services.

[0040] In addition, file encryption relies on symmetric encryption, device key pairs rely on asymmetric encryption, and the server-side private key is responsible for core verification, thus balancing encryption efficiency and key transmission security.

[0041] It should be added that the decrypted key data is validated for legality, including: verifying whether the length of the initial session key meets the key length requirements of the preset symmetric encryption algorithm; verifying whether the initial session key is all zeros or a preset weak key pattern; if the length of the initial session key meets the requirements and is not a weak key, then the initial session key is deemed to have passed the validity check.

[0042] In one optional embodiment, the device identifier is obtained by the client using the system's universally unique identifier (UUID) combined with the device system information through concatenation and hashing, in the absence of system certificate information and device serial number information collected.

[0043] Correspondingly, the private key is derived by the server using the system's universally unique identifier (UUID) combined with the device's system information key when it determines that it has received a notification of information collection failure from the client.

[0044] Step S12: Verify the validity of the file stream encryption result, and store the file stream encryption result based on the successful verification.

[0045] In this embodiment, the file stream encryption result includes an encrypted file, ciphertext of the file content, a random number, and a timestamp. The validity verification of the file stream encryption result includes: obtaining the system time and determining whether the difference between the timestamp and the system time is within a preset time error range; querying a preset used random number record library to determine if the random number exists in the preset used random number record library; encrypting the ciphertext of the file content using the initial key and comparing the encryption result with the encrypted file; if the timestamp is within the time error range, the random number does not exist in the used random number record library, and the encryption result is consistent with the encrypted file, then the file stream encryption result passes the validity verification.

[0046] In addition, if any of the above non-compliance issues are found during validity verification, the device is determined to be unauthorized, and service is denied.

[0047] It should be noted that the server-side verifies the validity of timestamps to introduce time-based security protection, solving the problem of being unable to defend against replay attacks. Even if an attacker intercepts historically valid encrypted data packets, they cannot pass the time verification, thus ensuring the timeliness of data requests and preventing the unauthorized use of expired or maliciously delayed data. By maintaining and querying the used random number library, the non-repeatability of random numbers is used for deduplication verification to avoid duplicate submissions within the time window that may occur with a single time verification, ensuring the uniqueness of each data packet. This effectively intercepts replay attacks, further enhancing the anti-tampering and anti-replay capabilities of the communication process. Furthermore, by re-encrypting and comparing the result with the original, strict verification of data integrity is achieved, solving the problem that data may be tampered with or damaged during transmission but is difficult to detect. Only data that can be correctly decrypted and restored to a result consistent with the encrypted file is considered valid, thus ensuring the consistency of file content at the transmitting and receiving ends.

[0048] In an optional embodiment, the method further includes: receiving a file download request sent by a client; determining, based on the device identifier in the file download request, whether there is a binding relationship between the corresponding device identifier and the root key derived from the system certificate information; and, if a corresponding binding relationship is determined to exist, returning the corresponding file stream encryption result to the client.

[0049] It should be noted that the server establishes a strong association between device identity and key usage permissions by verifying the binding relationship between the device identifier and the root key. This addresses the risk of unauthorized access caused by simple credentials being allowed to download files in existing technologies. It ensures that file download requests must come from legitimate devices that have been certified by the system certificate, thereby effectively preventing unauthorized devices or forged identifiers from stealing file resources. The file return operation is only executed after the binding relationship is confirmed, ensuring strict access control and enabling fine-grained control of file distribution requests by the server. This ensures that encrypted file streams can only be received and obtained by clients with specific identity authentication bindings, further guaranteeing the security and targeting of data distribution and preventing data leakage to unauthorized third parties.

[0050] Furthermore, if it is determined that no corresponding binding relationship exists, the device is deemed unauthorized, and service is denied.

[0051] In addition, after the server returns the encrypted result of the corresponding file stream to the client, the client uses the target session key to decrypt the encrypted result of the downloaded file stream so that the client can directly return the file stream, achieving no plaintext being written to disk.

[0052] In one alternative embodiment, the transmission link between the client and the server relies on HTTPS encryption, and the file content is encrypted, achieving dual protection of "link encryption plus content encryption" to resist eavesdropping and tampering attacks.

[0053] In one alternative embodiment, reference Figure 2 The method includes: The client generates a device key pair and sends the device public key from the device key pair to the server, and sends the device identifier to the server; On the server side, the device identifier is verified for legitimacy. Based on the successful verification, the device public key is used to encrypt the dynamically generated initial key to obtain the encryption key, which is then sent to the client. The client uses the device's private key to decrypt the encryption key to obtain the target session key, and then uses the target session key to encrypt the read file stream, sending the encrypted file stream result to the server. On the server side, the validity of the encrypted file stream result is verified, and the encrypted file stream result is stored if the verification is successful.

[0054] The specific principles are described above and will not be repeated here. It is worth noting that this method's hardware acceleration support, combined with 1MB block processing, ensures no significant performance loss in encrypting and decrypting large files (10GB). Furthermore, the authorization verification and key derivation process takes ≤50ms, without affecting the interface response efficiency for file transfer. It fully complies with the requirements of GDPR, Cybersecurity Classified Protection 2.0, and other standards such as "sensitive data is only authorized for terminal use" and "data lifecycle security," reducing enterprise compliance risks. It can be directly applied to scenarios such as sensitive file distribution, encrypted transmission of paid content, data interaction between IoT devices, and financial data transmission, and is compatible with various terminals including PCs, mobile devices, and embedded devices.

[0055] In summary, the file stream encryption result received in this embodiment of the invention is obtained by the client decrypting the received encryption key using the locally stored device private key, and then encrypting the file using the target session key obtained from the decryption. This avoids the inefficiency of directly using asymmetric encryption to process large file streams. It leverages both the security advantages of asymmetric algorithms in key distribution and the high performance advantages of symmetric algorithms in data encryption, achieving efficient, dynamic, and secure encryption of sensitive file streams. Furthermore, the encryption key is obtained by dynamically generating an initial key using the device public key sent by the client after the device identifier sent by the client has been verified. By making device legitimacy verification a necessary prerequisite for encryption key generation and distribution, it ensures that only legitimate devices can generate valid encrypted data, thereby effectively preventing the risk of unauthorized clients forging or tampering with uploaded data. This approach avoids the security risks associated with long-term use of static keys and encrypts the data before transmitting it to the client. This ensures that only legitimate clients holding the corresponding device's private key can decrypt the data, effectively preventing the key from being stolen or tampered with during transmission and guaranteeing the confidentiality and security of key distribution. By validating the encrypted results of the received file stream, it avoids situations where direct data storage might lead to invalid, tampered, or malicious data contaminating the storage system. By ensuring that only verified encrypted file stream results are stored, it not only guarantees the integrity and authenticity of the data entering the database but also avoids wasting storage resources. This provides reliable quality assurance for subsequent data reading and processing, constructing an end-to-end encrypted transmission closed loop. This solves the problems of existing technologies, such as the lack of strong encryption protection for file streams before transmission and storage and the insecurity of the key distribution process.

[0056] The following describes the device-based file transfer encryption device provided by the present invention. The device-based file transfer encryption device described below and the device-based file transfer encryption method described above can be referred to in correspondence.

[0057] Figure 3 A schematic diagram of a file transfer encryption device based on device identifier is shown. The device includes: The file receiving module 31 receives the encrypted file stream result sent by the client. The encrypted file stream result is obtained by the client encrypting the read file stream using the target session key. The target session key is obtained by the client decrypting the received encryption key using the locally generated device private key. The encryption key is obtained by encrypting the dynamically generated initial key based on the legality verification of the device identifier sent by the client and using the device public key sent by the client. The verification storage module 32 verifies the validity of the file stream encryption result and stores the file stream encryption result based on the successful verification.

[0058] It should be noted that the specific principles of the embodiments of the present invention are the same as those of the method embodiments described above. For details, please refer to the method embodiments above. More detailed explanations will not be repeated here.

[0059] Figure 4 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 4 As shown, the electronic device may include a processor 410, a communications interface 420, a memory 430, and a communication bus 440. The processor 410, communications interface 420, and memory 430 communicate with each other via the communication bus 440. The processor 410 can invoke logical instructions in the memory 430 to execute a file transfer encryption method based on a device identifier. This method includes: receiving a file stream encryption result sent by a client; wherein the file stream encryption result is obtained by the client encrypting the read file stream using a target session key, the target session key being obtained by the client decrypting the received encryption key using a locally generated device private key, and the encryption key being obtained by encrypting a dynamically generated initial key based on the client's valid device identifier and the client's public key; verifying the validity of the file stream encryption result, and storing the file stream encryption result based on successful verification.

[0060] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0061] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the file transfer encryption method based on device identifier provided by the above methods. The method includes: receiving a file stream encryption result sent by a client; wherein the file stream encryption result is obtained by the client encrypting the read file stream using a target session key, the target session key is obtained by the client decrypting the received encryption key using a locally generated device private key, and the encryption key is obtained by encrypting a dynamically generated initial key based on the legality verification of the device identifier sent by the client and using the device public key sent by the client; verifying the validity of the file stream encryption result, and storing the file stream encryption result based on the successful verification.

[0062] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When executed by a processor, the computer program implements the file transfer encryption method based on device identifier provided by the above methods. The method includes: receiving a file stream encryption result sent by a client; wherein the file stream encryption result is obtained by the client encrypting the read file stream using a target session key, the target session key is obtained by the client decrypting the received encryption key using a locally generated device private key, and the encryption key is obtained by encrypting a dynamically generated initial key based on the validity verification of the device identifier sent by the client and using the device public key sent by the client; verifying the validity of the file stream encryption result, and storing the file stream encryption result based on the successful verification.

[0063] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0064] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0065] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A file transfer encryption method based on device identifier, characterized in that, include: The client receives a file stream encryption result sent by the client; wherein the file stream encryption result is obtained by the client encrypting the read file stream using a target session key, the target session key is obtained by the client decrypting the received encryption key using a locally generated device private key, and the encryption key is obtained by encrypting a dynamically generated initial key based on the valid verification of the device identifier sent by the client and using the device public key sent by the client. The validity of the encrypted file stream is verified, and the encrypted file stream result is stored if the verification passes.

2. The file transfer encryption method based on device identifier according to claim 1, characterized in that, Before receiving the encrypted file stream result sent by the client, the process includes: The device identifier is received from the client; wherein the device identifier is obtained by the client through concatenation and hashing of collected system certificate information and device serial number information, and the system certificate information is used to characterize the electronic data that identifies the legitimacy of the device identity. The device identifier is validated for legality, and the validation includes at least one of the following: device identifier format compliance validation, hash validity validation, and device validity validation. Based on the successful legality verification, the corresponding device identifier is used as the seed parameter, and combined with the root key derived from the system certificate information, an initial key that meets the key length requirements of the preset symmetric encryption algorithm is generated through a preset key derivation algorithm. The initial key is encrypted using the device public key sent by the client to obtain an encryption key, and the encryption key is sent to the client.

3. The file transfer encryption method based on device identifier according to claim 2, characterized in that, Based on the successful validity verification, the corresponding device identifier is used as the seed parameter. Combined with the root key derived from the system certificate information, an initial key that meets the key length requirements of a preset symmetric encryption algorithm is generated through a preset key derivation algorithm, including: A root key is generated based on the system certificate information using a preset certificate key derivation algorithm. Extract a specified byte segment from the root key as a derived public key parameter; The device identifier is used as a seed parameter and the derived public key parameter are input into a preset key derivation algorithm to obtain an initial key that meets the preset key length requirements of the symmetric encryption algorithm.

4. The file transfer encryption method based on device identifier according to claim 2, characterized in that, The device identifier is obtained by the client using the system's universally unique identifier (UUID) combined with device system information through concatenation and hashing, in the absence of system certificate information and device serial number information collected.

5. The file transfer encryption method based on device identifier according to claim 2, characterized in that, After sending the encryption key to the client, or before receiving the device identifier sent by the client, the method further includes: The client receives encrypted session data sent by the client; wherein the encrypted session data is obtained by the client encrypting a target session key or session file using the received root key. The encrypted session data is decrypted using a private key; wherein, the private key is derived from the system certificate information and the device serial number information key when it is determined that the information collection success notification sent by the client is received or the information collection failure notification sent by the client is not received within the target time; or, the private key is derived from the system universal unique identifier (UUID) combined with the device system information key when it is determined that the information collection failure notification sent by the client is received. The decrypted key data is validated for legality, and the validation result is returned to the client so that the client can read the file stream based on the validation.

6. The file transfer encryption method based on device identifier according to claim 1, characterized in that, The encrypted file stream result includes the encrypted file, the ciphertext of the file content, a random number, and a timestamp; The validity verification of the encrypted file stream result includes: Obtain the system time and determine whether the difference between the timestamp and the system time is within a preset time error range; Query the preset used random number record library to determine whether the random number exists in the preset used random number record library; The file content is encrypted using the initial key, and the encryption result is compared with the encrypted file to determine if they match. If the timestamp is within the time error range, the random number does not exist in the used random number record library, and the encryption result is consistent with the encrypted file, then the file stream encryption result is determined to have passed the validity verification.

7. The file transfer encryption method based on device identifier according to claim 1, characterized in that, The method further includes: Receive the file download request sent by the client; Based on the device identifier in the file download request, determine whether there is a binding relationship between the corresponding device identifier and the root key derived from the system certificate information; Once a corresponding binding relationship is confirmed, the encrypted result of the corresponding file stream is returned to the client.

8. A file transfer encryption device based on device identifier, characterized in that, include: The file receiving module receives the encrypted file stream result sent by the client. The encrypted file stream result is obtained by the client encrypting the read file stream using a target session key. The target session key is obtained by the client decrypting the received encryption key using a locally generated device private key. The encryption key is obtained by encrypting a dynamically generated initial key based on the validity verification of the device identifier sent by the client and using the device public key sent by the client. The verification storage module verifies the validity of the encrypted file stream result and stores the encrypted file stream result based on the successful verification.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the file transfer encryption method based on device identifier as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the file transfer encryption method based on device identifier as described in any one of claims 1 to 7.

Images