Data encryption method, data decryption method, data encryption and decryption system, electronic device and storage medium

Abstract

Disclosed in the present application are a data encryption method, a data decryption method, a data encryption and decryption system, an electronic device, and a medium. The encryption method comprises: receiving an encryption request from a user, wherein the encryption request comprises plaintext data to be encrypted; loading the plaintext data into a memory of an electronic device; calling an encryption apparatus to encrypt the plaintext data on the basis of an asymmetric encryption algorithm, so as to obtain ciphertext data, wherein a public key and a private key which are paired are generated in the asymmetric encryption algorithm, and the public key is used for encrypting the plaintext data; determining a first storage path of the plaintext data and a second storage path of the ciphertext data; storing the ciphertext data in the second storage path; and deleting the plaintext data from the first storage path.

Description

Data encryption and decryption method, encryption and decryption system, electronic equipment and medium Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data encryption and decryption method, an encryption and decryption system, an electronic device and a medium. Background Art

[0002] In real-time encryption technology, disk encryption software or hardware is used to encrypt data on the hard disk when it is stored and decrypt it when it is read, which can prevent illegal access to static plaintext data on the hard disk.

[0003] Typically, to ensure the security of on-the-fly encryption and decryption, the operating system must hold the key on its behalf. This involves numerous steps, is prone to errors, and is complex to deploy, expensive, and high-maintenance. Furthermore, in this on-the-fly encryption and decryption solution, users have no choice in the encryption and decryption of their files.

[0004] Summary of the Invention

[0005] The present application provides a data encryption and decryption method, encryption and decryption system, electronic device and medium, which can not only ensure the security of instant encryption but also protect files in a targeted manner, thereby saving data resources.

[0006] The first aspect of the present application discloses a data encryption method, which is applied to an electronic device, the method comprising: receiving an encryption request from a user, wherein the encryption request includes plaintext data to be encrypted; loading the plaintext data into the memory of the electronic device; calling an encryption device to encrypt the plaintext data based on an asymmetric encryption algorithm to obtain ciphertext data, wherein the asymmetric encryption algorithm generates a pair of public and private keys, and the public key is used to encrypt the plaintext data; determining a first storage path for the plaintext data and a second storage path for the ciphertext data; storing the ciphertext data in the second storage path; and deleting the plaintext data in the first storage path.

[0007] In a possible implementation of the first aspect above, the public key is stored in the encryption device, and the private key is stored in a storage device of an external device.

[0008] In a possible implementation of the first aspect above, it also includes receiving a user's ciphertext transfer request, the ciphertext transfer request including the ciphertext data and the second user; calling the encryption device to generate second ciphertext data based on the private key, the ciphertext data and a second public key corresponding to the second user, wherein the second public key is generated in a pair with the second private key using the asymmetric encryption algorithm; and storing the second ciphertext data to a third storage path.

[0009] In a possible implementation of the first aspect above, calling the encryption device to encrypt the plaintext data based on an asymmetric encryption algorithm to obtain ciphertext data includes, when the ciphertext data cannot be successfully obtained, deleting the plaintext data in the memory.

[0010] In a possible implementation of the first aspect, the second storage path is generated based on the first storage path according to a predetermined rule.

[0011] In a possible implementation of the first aspect above, the plaintext data in the memory is deleted.

[0012] In a possible implementation of the first aspect above, the ciphertext data in the memory is deleted.

[0013] In a possible implementation of the first aspect, the method further includes calling the ciphertext data and the plaintext data in the form of a path. In a possible implementation of the first aspect, the path includes one or more of a shortcut, a path alias, and a soft link.

[0014] The second aspect of the present application discloses a data decryption method, which is applied to an electronic device, including receiving a decryption request from a user, wherein the encryption request includes ciphertext data to be encrypted; loading the ciphertext data into the memory of the electronic device; reading a private key and calling an encryption device to decrypt the ciphertext data based on an asymmetric encryption algorithm to obtain plaintext data, wherein the private key is generated in pairs with a public key in the asymmetric encryption algorithm, and the private key is used to decrypt the ciphertext data; determining a fourth storage path for the ciphertext data and a fifth storage path for the plaintext data; storing the plaintext data in the fifth storage path; and deleting the ciphertext data in the fourth storage path.

[0015] In a possible implementation of the second aspect above, the public key is stored in the encryption apparatus, and the private key is stored in a storage device of an external device.

[0016] In a possible implementation of the second aspect, the method further includes verifying the private key; when the private key is verified to be invalid, ending the process and erasing all generated data.

[0017] In a possible implementation of the second aspect above, it also includes determining the file extension corresponding to the plaintext data; based on the file extension, creating a new process and opening the plaintext data in the memory; when the process ends, re-encrypting the plaintext data and importing it into the sixth storage path.

[0018] In a possible implementation of the second aspect above, the fifth storage path is generated based on the fourth storage path based on a predetermined rule.

[0019] In a possible implementation of the second aspect above, the method further includes deleting the ciphertext data in the memory.

[0020] In a possible implementation of the second aspect above, the method further includes deleting the plaintext data in the memory.

[0021] In a possible implementation of the second aspect above, the storage device of the peripheral device includes one or more of a USB device, a lightning interface device, a magnetic interface device, an IC card, and a near-field communication device.

[0022] The third aspect of the present application discloses an encryption and decryption system, including a ciphertext management device, a private key device, and an encryption device, wherein the private key device is used to store a private key, the encryption device is used to encrypt and decrypt operations and save a public key, and the ciphertext management device is used to execute the data encryption method of the first aspect of the present application and the data decryption method of the second aspect of the present application.

[0023] The fourth aspect of the present application discloses an electronic device, which includes a memory storing computer-executable instructions and a processor; when the instructions are executed by the processor, the device implements the methods according to the first and second aspects of the present application.

[0024] The fifth aspect of the present application discloses a computer-readable medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the methods of the first and second aspects of the present application.

[0025] The data encryption and decryption method, encryption and decryption system, electronic device, and media provided in this application, upon receiving a user's encryption and decryption request, invoke an encryption device in memory and perform encryption and decryption using an asymmetric encryption algorithm. This process gives the user the choice of encryption and decryption and implements the encryption process at the user-accessible application level. This eliminates the need for system-deployed encryption, reducing the operational complexity of encryption and decryption; selective encryption and decryption also conserves resources. Furthermore, the use of asymmetric encryption and decryption technology ensures the security of real-time encryption and decryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] FIG1 is a scene diagram of an embodiment of the present application;

[0027] FIG2 is a flow chart of a data encryption method 200 according to an embodiment of the present application;

[0028] FIG3 a is a schematic diagram of a public key-private key pair according to an embodiment of the present application;

[0029] FIG3 b is an example diagram of data encryption according to an embodiment of the present application;

[0030] FIG4 is a flow chart of a data encryption method 210 according to an embodiment of the present application;

[0031] FIG5 is a flow chart of a ciphertext transfer method 200 according to an embodiment of the present application;

[0032] FIG6 is a flow chart of a data decryption method 310 according to an embodiment of the present application;

[0033] FIG7 is a schematic diagram showing changes in the display interface during the decryption process in one embodiment of the present application;

[0034] FIG8 is a flow chart of a data decryption method 320 according to an embodiment of the present application;

[0035] FIG9 is a flow chart of a method 330 for processing plaintext data according to an embodiment of the present application;

[0036] 10a-10b are flowcharts of state switching methods 340 and 350 according to an embodiment of the present application;

[0037] FIG11 is a structural block diagram of an encryption and decryption system 400 according to an embodiment of the present application;

[0038] FIG12 is a block diagram of an electronic device 500 according to an embodiment of the present application. DETAILED DESCRIPTION

[0039] The present application will be further described below in conjunction with specific embodiments and accompanying drawings. It will be understood that the illustrative embodiments of the present disclosure include, but are not limited to, data encryption and decryption methods, encryption and decryption systems, electronic devices, and media. The specific embodiments described herein are merely for the purpose of explaining the present application, not for limiting the present application. In addition, for ease of description, the accompanying drawings only show some, but not all, structures or processes related to the present application. The acquisition, storage, use, and processing of data in the technical solution of the present application comply with the relevant provisions of national laws and regulations.

[0040] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0041] Figure 1 shows a scenario diagram for an embodiment of the present application. An encryption device 101 can automatically encrypt data 102 stored on a hard disk to obtain encrypted data 103, or automatically decrypt encrypted data 103 to obtain data 102. Encrypted data 103 may be inaccessible or may be in a garbled format. Specifically, encryption device 101 automatically encrypts data 102 stored on a hard disk during storage and decrypts it during reading, thereby preventing unauthorized access to static plaintext data on the hard disk.

[0042] Encryption device 101 can be encryption software, encryption hardware, or a combination of both. To achieve automatic encryption during storage and automatic decryption during reading, encryption device 101 must meet the following characteristics: 1) maintain data 102 in an encrypted state; 2) read and write data 102 / encrypted data 103 at high speeds regardless of storage location on the hard disk; and 3) the encryption and decryption process must not significantly increase file size.

[0043] In manual encryption solutions, users need to find encryption software on their computers, select the files to be encrypted or decrypted, and then encrypt or decrypt them. However, in encryption solutions using encryption device 101, data can be automatically encrypted when saved and decrypted when accessed, invisible to the user. By using this on-the-fly encryption and decryption solution, users do not have to worry about manually encrypting and decrypting data.

[0044] Generally, in order to achieve instant encryption and decryption operations, a symmetric key scheme needs to be adopted. In some embodiments, in order to ensure the security of the symmetric key, the key can be held by the operating system or the encryption device 101 instead of the user managing the key. In order to cope with all possibilities of users using files on the operating system, the operating system or encryption device 101 that holds the key needs to be aware of and compatible with all user software during deployment, identify its legitimacy, and add it to the whitelist. This process involves many links and is prone to errors, and the deployment is complex, expensive, and has high maintenance costs. In addition, in this instant encryption and decryption scheme, the user does not have the right to choose the encrypted and decrypted files, that is, the user cannot choose files according to his own wishes and encrypt and protect them in a targeted manner.

[0045] In addition, this key delegation solution relies on the operating system's architectural classification of code execution levels. Current solutions are mostly based on the Windows operating system and are rarely implemented on other operating systems, such as Linux and Mac systems.

[0046] To address the aforementioned issues, one embodiment of the present application provides a data encryption method that gives users the choice of encryption and implements the encryption process at the user-accessible application level. This eliminates the need for system-wide encryption, reducing operational complexity. Selective encryption also conserves resources. Furthermore, the use of asymmetric encryption ensures the security of real-time encryption.

[0047] The following describes details of an embodiment of a data encryption method according to the present application in conjunction with Figure 2. As shown in Figure 2, a data encryption method 200 according to an embodiment of the present application includes the following steps.

[0048] In S201 , an encryption request from a user is received, where the encryption request includes plaintext data to be encrypted.

[0049] Method 200 is applied to an electronic device, which may be one or more of a desktop computer, a laptop computer, a smartphone, a tablet computer, a server, an IoT device, a chip, or a portable wearable device. The IoT device may be one or more of a smart car device, a smart TV, a smart speaker, or a smart air conditioner. In some embodiments, the electronic device may have installed applications, including one or more of applications pre-installed in the operating system, applications that require separate installation, and applications that can be used without installation.

[0050] An encryption request from a user is received, the encryption request including plaintext data to be encrypted specified by the user. In some examples, the types of the plaintext data to be encrypted include, but are not limited to, one or more of documents, images, audio, and video.

[0051] In some embodiments, the user can drag or copy the plaintext data to be encrypted into the application of the electronic device. In other embodiments, the user can enter the file path of the plaintext data to be encrypted in the application or import the plaintext data to be encrypted based on the file location index. In some embodiments, the user can also right-click the data and select the corresponding encryption operation to determine the plaintext data to be encrypted.

[0052] In S202 , plaintext data is loaded into the memory of the electronic device.

[0053] The plaintext data can be stored in a hard disk, and the plaintext data in the hard disk can be loaded into the memory of the electronic device, and the encryption operation of the plaintext data can be performed in the memory. In some embodiments, the encryption operation can be performed directly on the plaintext data in the memory.

[0054] In S203, an encryption device is called to encrypt the plaintext data based on an asymmetric encryption algorithm to obtain ciphertext data, wherein a pair of public keys and private keys are generated in the asymmetric encryption algorithm, and the public key is used to encrypt the plaintext data.

[0055] The encryption device 101 is called to encrypt the plaintext data using an asymmetric encryption algorithm. In some embodiments, in the asymmetric encryption algorithm, corresponding public key-private key pairs can be generated for different users or different plaintext data. The public key is used for encryption, and the private key is used for decryption.

[0056] It can be understood that the role of the encryption device here is not limited to encryption, but can also decrypt ciphertext data based on an asymmetric encryption algorithm. It is the abbreviation of encryption and decryption device.

[0057] Figure 3a shows a schematic diagram of a public key-private key pair of an embodiment of the present application. Before running encryption, the encryption device 101 can initialize and generate a pair of public key 111 and private key 112. In some examples, the encryption device 101 stores the public key 111, for example, the public key 111 is protected and stored in the core of the encryption device 101, such as a chip, software or other medium. Except for the encryption device itself, no hardware or software means can read and write the public key. In this case, the public key 111 is invisible to the user, and the encryption device can directly call the public key for encryption during the encryption process without the need for manual operation by the user. In some examples, the encryption device 101 can provide an initialization interface so that the private key is stored on a private key device, and the private key device can be a peripheral private key storage device.

[0058] In S204 , a first storage path for the plaintext data and a second storage path for the ciphertext data are determined.

[0059] A first storage path for storing plaintext data and a second storage path for storing ciphertext data are determined. In some embodiments, the second storage path is generated based on the first storage path based on a predetermined rule. For example, the plaintext data is stored in folder A on the hard disk, and the first storage path of the plaintext data can be determined based on this. The ciphertext data can also be stored in folder A on the hard disk, that is, the first storage path of the plaintext data and the second storage path of the ciphertext data are located in the same folder. In other examples, the ciphertext data can also be located in a subfolder of folder A, or in a folder above folder A.

[0060] It is understood that the steps in method 200 are not limited to be performed in the order of the numbers. For example, step S204 may be performed before the encryption process in step S203.

[0061] In S205 , the encrypted data is stored in the second storage path.

[0062] After determining a second storage path for storing the ciphertext data, the ciphertext data is stored in the second storage path. In some examples, the ciphertext data in the memory can be deleted. In other examples, the ciphertext data in the memory can be processed in other ways, such as being re-encrypted or modified to prevent reproduction.

[0063] In S206 , the plaintext data in the first storage path is deleted.

[0064] In some embodiments, after the plaintext data in the first storage path is deleted, the ciphertext data in the second storage path on the hard disk replaces the original plaintext data on the hard disk. In some embodiments, when the first storage path and the second storage path are consistent, the ciphertext data can be used to overwrite the plaintext data. In some embodiments, the plaintext data in the memory can also be deleted.

[0065] In method 200, after receiving a user's request to encrypt plaintext data, an encryption device is invoked in memory and an asymmetric encryption algorithm is used to encrypt the plaintext data, obtaining ciphertext data. The plaintext data in the file path previously storing the plaintext data is deleted, and the ciphertext data is stored in a different storage path, achieving instant encryption. This process gives the user the choice of encryption and implements the encryption process at the user-accessible application level. This eliminates the need for system-deployed encryption, reducing operational complexity. Selective encryption also conserves resources. Furthermore, the use of asymmetric encryption ensures the security of instant encryption.

[0066] In some implementations, encrypted data and plaintext data can be accessed in the form of a path. Paths can include one or more of shortcuts, path aliases, and soft links. In some examples, the encrypted data / plaintext data within the path can be read into memory, or the path can be directly input into the encryption device. In some examples, parameters can be set for the path shortcut, path alias, or soft link to access the encrypted data before the corresponding application is run.

[0067] FIG3 b shows an example of data encryption according to an embodiment of the present application. Plaintext data is displayed normally in the operating system before encryption (301). When the user drags the plaintext data to the ciphertext management interface 303, the plaintext data is encrypted. The encrypted ciphertext data is displayed as garbled characters in the operating system (302). In the ciphertext management interface 303, the ciphertext data is displayed as a shortcut (304). In the example of FIG3 b , the interface changes of the ciphertext management interface 303 before and after encryption can occur in a relatively short period of time, such as a few milliseconds.

[0068] 4 shows a flow chart of a data encryption method 210 according to an embodiment of the present application. The method 210 is a further refinement of the method 200 and includes the following steps.

[0069] In S211, an encryption request from a user is received. S211 is similar to S201 in method 200 and will not be described in detail here.

[0070] In S212, a first storage path for the plaintext data and a second storage path for the ciphertext data are determined. S212 is similar to S204 in method 200 and will not be described in detail here.

[0071] In S213, the plaintext data is loaded into the memory of the electronic device. S213 is similar to S202 in method 200 and will not be described in detail here.

[0072] In S214, the encryption device is called to encrypt the plaintext data. If the encryption is successful, the process proceeds to S216, otherwise it proceeds to S215. During the encryption process, if the working state of the encryption device is abnormal or the correct public key is not used, the encryption will fail.

[0073] In S215, when the encryption of the plaintext data fails, the plaintext data in the memory is deleted. After S215, the relevant process can be terminated.

[0074] In S216, the ciphertext data is saved in the memory, and the plaintext data in the memory is deleted.

[0075] In S217 , the ciphertext data is written into the second storage path. If the writing is successful, the process proceeds to S218 , otherwise, the process proceeds to S215 .

[0076] In S218, the plaintext data in the first storage path is deleted. After the plaintext data in the first storage path is deleted, the ciphertext data in the second storage path may be displayed instead of the plaintext data in the first storage path, as shown in 302 in Figure 3b. In some embodiments, when the first storage path and the second storage path are consistent, the ciphertext data may be used to overwrite the plaintext data.

[0077] In S219, the ciphertext data in the memory is deleted. After the encryption is successful, both the plaintext data and the ciphertext data in the memory can be deleted to improve security and reduce memory usage.

[0078] Returning to the scenario in Figure 3b, the ciphertext data is displayed as a shortcut in the ciphertext management interface 303. If the ciphertext data needs to be displayed normally in the ciphertext management interface 303 or further operations such as modification, copying, cutting, and transfer are required, another private key device is required to achieve this. Regarding the transfer of ciphertext data, Figure 5 shows a flowchart of a ciphertext transfer method 200 according to an embodiment of the present application. This method can convert the ciphertext data of one user into the ciphertext data of another user without decryption, and includes the following steps.

[0079] In S221 , a ciphertext transfer request from a user is received, where the ciphertext transfer request includes ciphertext data and a second user.

[0080] Continuing with Figure 3b as an example, user M can select the ciphertext data to be transferred and the receiving user N in the ciphertext management interface. After determining the ciphertext data to be transferred, the corresponding storage path can be determined. In some examples, the user can drag the ciphertext data to be transferred to the location corresponding to user N in the ciphertext management interface, or the user can right-click the ciphertext data to be transferred and select the ciphertext transfer option.

[0081] In S222, the encryption device is called to generate second ciphertext data based on the private key, the ciphertext data and the second public key corresponding to the second user, wherein the second public key is generated in pair with the second private key using an asymmetric encryption algorithm.

[0082] After detecting that the private key of user M has been verified, the encryption device is called to encrypt the ciphertext data based on the ciphertext data and the public key of user N to generate second ciphertext data. The public key of user N is generated in pairs with the corresponding private key based on an asymmetric encryption algorithm.

[0083] In S223, the second ciphertext data is stored in the third storage path.

[0084] The ciphertext data after the ciphertext transfer is stored in the new storage path. In S221-S223, the ciphertext data of user M is not decrypted, but directly converted into the ciphertext data of user N, thereby improving the security of the ciphertext transfer.

[0085] In some embodiments, the ciphertext may be transferred by copying, i.e., after generating user N's ​​ciphertext based on user M's ciphertext, user M's ciphertext may remain. In some embodiments, the ciphertext may be transferred by cutting, i.e., after generating user N's ​​ciphertext based on user M's ciphertext, user M's ciphertext will be deleted, i.e., the plaintext data in the second storage path will be deleted.

[0086] FIG6 shows a flowchart of a data decryption method 310 according to an embodiment of the present application, which includes the following steps.

[0087] In S311 , a decryption request from a user is received, where the encryption request includes ciphertext data to be encrypted.

[0088] Receive a decryption request from a user, wherein the decryption request includes ciphertext data to be decrypted specified by the user, wherein the ciphertext data can be encrypted using the data encryption method of the present application.

[0089] In some embodiments, the user can drag or copy the ciphertext data to be decrypted into the application of the electronic device. In other embodiments, the user can enter the file path of the ciphertext data to be decrypted in the application or import the ciphertext data to be decrypted according to the file location index. In some embodiments, the user can also right-click the data and select the corresponding decryption operation to determine the ciphertext data to be decrypted.

[0090] In S312 , the encrypted data is loaded into the memory of the electronic device.

[0091] The encrypted data can be stored in a hard disk, loaded into the memory of the electronic device, and decrypted in the memory. In some embodiments, the decryption operation can be performed directly on the encrypted data in the memory.

[0092] In S313, the private key is read and the encryption device is called to decrypt the ciphertext data based on the asymmetric encryption algorithm to obtain the plaintext data, wherein the private key is generated in pairs with the public key in the asymmetric encryption algorithm, and the private key is used to decrypt the ciphertext data.

[0093] The encryption device is invoked to encrypt the plaintext data using an asymmetric encryption algorithm and a public key, and the ciphertext data is decrypted using a private key generated in pair with the public key. In some embodiments, in the asymmetric encryption algorithm, corresponding public-private key pairs can be generated for different users or different plaintext data. In some embodiments, the public key device is stored in the encryption device, and the private key device is stored in an external storage device.

[0094] In S314 , a fourth storage path for the ciphertext data and a fifth storage path for the plaintext data are determined.

[0095] A fourth storage path for storing ciphertext data and a fifth storage path for storing plaintext data are determined. In some embodiments, the fifth storage path is generated based on the fourth storage path based on a predetermined rule. For example, the ciphertext data is stored in folder B on the hard disk, and the fourth storage path of the ciphertext data can be determined based on this. The plaintext data can also be stored in folder B on the hard disk, that is, the fourth storage path of the ciphertext data and the fifth storage path of the plaintext data are located in the same folder. In other examples, the plaintext data can also be located in a subfolder of folder B, or in a folder above folder B.

[0096] It is understood that the steps in method 310 are not limited to be performed in the order of the numbers. For example, step S314 may be performed before the encryption process in step S313.

[0097] In S315 , the plaintext data is stored in the fifth storage path.

[0098] After determining a fifth storage path for storing the plaintext data, the plaintext data is stored in the fifth storage path. In some examples, the plaintext data in the memory can be deleted. In other examples, the plaintext data in the memory can be processed in other ways, such as being re-encrypted or modified to prevent reproduction.

[0099] In S316, the ciphertext data in the fourth storage path is deleted.

[0100] In some embodiments, after the ciphertext data in the fourth storage path is deleted, the plaintext data in the fifth storage path on the hard disk replaces the ciphertext data on the original hard disk. In some embodiments, when the fourth storage path and the fifth storage path are consistent, the ciphertext data can be overwritten with the plaintext data. In some embodiments, the ciphertext data in the memory can also be deleted.

[0101] In method 310, after receiving a decryption request from a user for ciphertext data, the private key is read and the encryption device in memory is invoked to decrypt the ciphertext data using an asymmetric encryption algorithm to obtain the plaintext data. The ciphertext data in the file path previously storing the ciphertext data is then deleted and the plaintext data is stored in a different storage path, achieving instant encryption. This process gives the user the choice of decryption and places the decryption process at the user-accessible application level. This eliminates the need for system-level decryption, reducing the operational complexity of encryption.

[0102] In addition, the security of the data can be guaranteed by controlling the private key. See the example in Figure 7. Figure 7 shows the changes in the display interface during the decryption process in one embodiment of the present application.

[0103] In the ciphertext management interface, ciphertext data is displayed as a shortcut (303-1). When the ciphertext management interface receives a decryption request from the user and detects that the private key device has successfully read the private key, it can open the shortcut to display the plaintext content (302-2). The user can view the plaintext content. During this period, the status of the private key can be continuously monitored. If the private key device is disconnected midway, the ciphertext management interface will display a locked status (303-3). During this period, the user can intuitively experience the interface switching of the ciphertext manager.

[0104] In some embodiments, the private key device may be one or more of a USB device, a lightning interface device, a magnetic interface device, an IC card, and a near-field communication (NFC) device. The USB device interface version includes, but is not limited to, USB Type-A, USB Type-B, or USB Type-C. In some examples, reading the private key is not limited to a physical private key device; for example, the private key may be read through fingerprint recognition or facial recognition.

[0105] 8 shows a flow chart of a data decryption method 320 according to an embodiment of the present application. The method 320 is a further refinement of the method 310 and includes the following steps.

[0106] In S321, a decryption request from a user is received. S321 is similar to S311 in method 310 and will not be described in detail here.

[0107] In S322, a fourth storage path for the ciphertext data and a fifth storage path for the plaintext data are determined. S322 is similar to S314 in method 310 and will not be described in detail here.

[0108] In S323, the encrypted data is loaded into the memory of the electronic device. S323 is similar to S312 in method 310 and will not be described in detail here.

[0109] In S324 , the private key is read.

[0110] The private key is read from the device where the private key is stored or the user's feature identification device.

[0111] In S325, the encryption device is called to decrypt the ciphertext data. If the decryption is successful, the process proceeds to S327, otherwise it proceeds to S326. During the decryption process, if the working state of the decryption device is abnormal or the private key reading state is abnormal, the decryption will fail.

[0112] In S326, when the decryption of the ciphertext data fails, the ciphertext data in the memory is deleted. After S326, the relevant process can be terminated.

[0113] In S327, the plaintext data is saved in the memory and the ciphertext data in the memory is deleted.

[0114] In S328 , the plaintext data is written into the fifth storage path. If the writing is successful, the process proceeds to S329 , otherwise the process proceeds to S326 .

[0115] In S329, the ciphertext data in the fourth storage path is deleted. After the ciphertext data in the fourth storage path is deleted, the plaintext data in the fifth storage path may replace the ciphertext data in the fourth storage path and be displayed, as shown in 303-2 in FIG7 . In some embodiments, when the fourth storage path and the fifth storage path are consistent, the ciphertext data may be overwritten with the plaintext data.

[0116] In S330, the plaintext data in the memory is deleted. After the decryption is successful, both the plaintext data and the ciphertext data in the memory can be deleted to improve security and reduce memory usage.

[0117] Returning to Figure 7, the data in the ciphertext management interface 303-2 is in a user-available state. The user can perform all operations on the data therein that are supported by the corresponding plaintext data. Although the ciphertext data opened via the shortcut is displayed as plaintext, in some embodiments, the data in the storage path of the ciphertext data on the hard disk is still encrypted. If the user needs to save the operations on the plaintext in the ciphertext management interface 303-2, it needs to be encrypted again. The user can use the plaintext and store the ciphertext in the ciphertext management interface. In some embodiments, if the private key device is disconnected midway, the user's modifications to the plaintext content can be saved, re-encrypted, and the new ciphertext data can be written to the corresponding storage path.

[0118] FIG9 shows a flowchart of a method 330 for processing plaintext data according to an embodiment of the present application, including the following steps:

[0119] In S331 , the file extension corresponding to the plaintext data is determined.

[0120] The plaintext data here is obtained by calling the encryption device to decrypt the ciphertext data. For example, the plaintext data is the plaintext loaded into the memory after steps S321-S325 in method 320.

[0121] Plaintext data can be in various forms, and its file extension can be used to determine the format of the plaintext data and the application that can be used to open it. For example, the file extension can be any of ".txt", ".doc", ".pdf", ".jpg", and ".avi".

[0122] In S332, based on the file extension, a new process is created and the plaintext data in the memory is opened.

[0123] After determining the file extension, the application that will open the plaintext data can be determined. The newly created process uses the application corresponding to the file extension to open the plaintext data in memory. It should be understood that the term "process" is used broadly and can refer to a subprocess. For example, in some implementations, a subprocess can be created within an existing process to open the plaintext data in memory.

[0124] For example, when the file extension is ".txt", a new document reader process opens the plaintext data; when the file extension is ".pdf", a new PDF document reader process opens the plaintext data.

[0125] In S333, when the process ends, the plaintext data is re-encrypted and imported into the sixth storage path.

[0126] In the newly created process, the user can perform various operations on the plaintext data, such as copying, cutting, pasting, etc. When the operation is completed and the process ends, the updated plaintext data can be re-encrypted, for example, encrypted into the second ciphertext data. And the second ciphertext data storage is imported into the sixth storage path. In some examples, the storage path of the new ciphertext data (i.e., the sixth storage path) can be consistent with the storage path of the original ciphertext (i.e., the fourth storage path). In other examples, the sixth storage path may be inconsistent with the fourth storage path.

[0127] In method 330, during the decryption process, the user can open the decrypted data normally without hindrance. After the operation on the decrypted data is completed, the electronic device will encrypt it to obtain the new encrypted data. The user can use the plaintext normally, and the electronic device will re-encrypt the modified plaintext, so that the plaintext can be used and the ciphertext can be stored without the user's awareness.

[0128] Returning to Figure 7, in some embodiments, the ciphertext manager interface can monitor the corresponding interface of the private key device in real time. If the monitored signal is abnormal, a private key verification request can be sent to the private key device. If the verification succeeds, the current process continues; if it fails, the process ends and all generated data is erased.

[0129] In Figure 7, in the case of interface 303-2, the private key device has been connected and the private key verification is successful. If either of these two conditions is not met, interface 303 switches to another state. For the former, the electronic device is in an authorized state, and the user can perform encryption operations, ciphertext-related operations, decryption operations, and ciphertext transfer operations. Among them, ciphertext-related operations may include sharing ciphertext data and uploading ciphertext data to the cloud. For the latter, the electronic device is in a public state, and the user's permissions will be limited. In some examples, in the public state, the user cannot perform any operations on the data in the ciphertext management interface, as shown in 303-3 in Figure 7. In some other examples, in the public state, the user can only perform encryption operations and ciphertext-related operations.

[0130] In some examples, a state variable can be set, and different values ​​can be assigned to the state variable in different states. For example, a state variable secretKeyAuth can be set with a Boolean type. The value of the state variable in the public state is False, and the value of the state variable in the authorized state is True. During the operation of the electronic device or the ciphertext manager in the electronic device, the private key will be continuously monitored. If the monitoring signal is abnormal, a private key verification request is sent to the encryption device, and the corresponding True / False value is directly assigned to the state variable based on the verification result.

[0131] In some embodiments, when the electronic device is in an authorized state, files in the ciphertext management interface can be displayed as thumbnails. For example, similar to a normal browser interface, the ciphertext management interface can display thumbnails of images, PDF documents, videos, and other files to provide a user-friendly experience.

[0132] The display of thumbnails can be implemented in a variety of ways. In some examples, when the electronic device is in an authorized state, the encryption device can be called to completely decrypt the ciphertext data on the hard disk into the memory, and the decrypted plaintext data can be displayed as a preview thumbnail. In other examples, when the electronic device is in an authorized state, the encryption device can be called to partially decrypt the ciphertext data on the hard disk into the memory, obtaining only the portion of the plaintext data required to generate the thumbnail, and the portion of the plaintext data can be displayed as a preview thumbnail.

[0133] For the switching between the two states, Figures 10a-10b show flow charts of state switching methods 340 and 350 according to an embodiment of the present application. Detailed descriptions of each step in method 340 and method 350 are given below.

[0134] In method 340, the electronic device switches from the authorized state to the public state. In S341, data generated in the authorized state is deleted. All decrypted plaintext data in the memory in the authorized state or part of the decrypted plaintext data can be deleted.

[0135] In S342, the preview thumbnail is deleted and the preview thumbnail disappears in the ciphertext manager interface.

[0136] In S343, the additional process in the authorized state is terminated. Other processes in the authorized state are terminated.

[0137] Correspondingly, in method 350, the electronic device switches from the public state to the authorized state. In S351, data required for the authorized state is generated, for example, all decrypted plaintext data or part of the decrypted plaintext data used to generate a thumbnail.

[0138] In S352, a preview thumbnail is generated and displayed. A thumbnail corresponding to the plaintext data is generated and displayed on the ciphertext manager interface.

[0139] In S353, the additional process in the authorized state is opened and the other processes except the thumbnail generation process are restored to execute the user's operation.

[0140] This application also discloses a data encryption and decryption system, see 400 in FIG11 . Data encryption and decryption system 400 includes a ciphertext management device 410, an encryption device 420, and a private key device 430. Private key device 430 is used to store a private key, encryption device 420 is used for encryption and decryption operations and to store a public key, and ciphertext management device 410 is used to execute the aforementioned data encryption method and data decryption method.

[0141] Referring now to FIG12 and now to FIG5 , a block diagram of an electronic device 500 according to one embodiment of the present application is shown. The electronic device 500 may include one or more processors 502, a system control logic 508 connected to at least one of the processors 502, a system memory 504 connected to the system control logic 508, a non-volatile memory (NVM) 506 connected to the system control logic 508, and a network interface 510 connected to the system control logic 508.

[0142] The processor 502 may include one or more single-core or multi-core processors. The processor 502 may include any combination of general-purpose processors and special-purpose processors (e.g., graphics processors, application processors, baseband processors, etc.). In the embodiments herein, the processor 502 may be configured to execute one or more embodiments according to various embodiments as shown in Figures 2-10.

[0143] In some embodiments, system control logic 508 may include any suitable interface controller to provide any suitable interface to at least one of processors 502 and / or any suitable device or component in communication with system control logic 508 .

[0144] In some embodiments, the system control logic 508 may include one or more memory controllers to provide an interface to the system memory 504. The system memory 504 may be used to load and store data and / or instructions. In some embodiments, the memory 504 of the device 500 may include any suitable volatile memory, such as a suitable dynamic random access memory (DRAM).

[0145] NVM / memory 506 may include one or more tangible, non-transitory computer-readable media for storing data and / or instructions. In some embodiments, NVM / memory 506 may include any suitable non-volatile memory such as flash memory and / or any suitable non-volatile storage device, such as at least one of an HDD (Hard Disk Drive), a CD (Compact Disc) drive, and a DVD (Digital Versatile Disc) drive.

[0146] NVM / storage 506 may comprise a portion of storage resources installed on a device of apparatus 500, or it may be accessible to the apparatus but not necessarily a part of the apparatus. For example, NVM / storage 506 may be accessed over a network via network interface 510.

[0147] In particular, system memory 504 and NVM / storage 506 may include, respectively, a temporary copy and a permanent copy of instructions 520. Instructions 520 may include instructions that, when executed by at least one of processors 502, cause device 500 to implement the methods illustrated in Figures 2, 4-6, and 8-10b. In some embodiments, instructions 520, hardware, firmware, and / or software components thereof may additionally or alternatively reside in system control logic 508, network interface 510, and / or processor 502.

[0148] The network interface 510 may include a transceiver for providing a radio interface for the device 500 to communicate with any other suitable devices (such as a front-end module, an antenna, etc.) via one or more networks. In some embodiments, the network interface 510 may be integrated with other components of the device 500. For example, the network interface 510 may be integrated with at least one of the processor 502, the system memory 504, the NVM / storage 506, and a firmware device (not shown) having instructions. When at least one of the processors 502 executes the instructions, the device 500 implements one or more of the various embodiments shown in Figures 2-10.

[0149] The network interface 510 may further include any suitable hardware and / or firmware to provide a multiple-input multiple-output radio interface. For example, the network interface 510 may be a network adapter, a wireless network adapter, a telephone modem, and / or a wireless modem.

[0150] In one embodiment, at least one of the processors 502 may be packaged together with logic for one or more controllers of the system control logic 508 to form a system-in-package (SiP). In one embodiment, at least one of the processors 502 may be integrated on the same die with logic for one or more controllers of the system control logic 508 to form a system-on-chip (SoC).

[0151] Device 500 may further include an input / output (I / O) device 512. I / O device 512 may include a user interface to enable a user to interact with device 500; and a peripheral component interface to enable peripheral components to interact with device 500.

[0152] In some embodiments, the user interface may include, but is not limited to, a display (e.g., an LCD display, a touch screen display, etc.), a speaker, a microphone, one or more cameras (e.g., a still image camera and / or a video camera), a flashlight (e.g., an LED flash), and a keyboard.

[0153] In some embodiments, the peripheral component interface may include, but is not limited to, a non-volatile memory port, an audio jack, and a power interface.

[0154] Each method implementation method of the present application can be implemented in software, magnetic components, firmware, etc.

[0155] Program code can be applied to input instructions to perform the functions described herein and generate output information. The output information can be applied to one or more output devices in a known manner. For the purposes of this application, a processing system includes any system having a processor such as, for example, a digital signal processor (DSP), a microcontroller, an application specific integrated circuit (ASIC), or a microprocessor.

[0156] Program code can be implemented with a high-level programming language or an object-oriented programming language to communicate with the processing system. Where necessary, program code can also be implemented with assembly language or machine language. In fact, the mechanism described herein is not limited to the scope of any particular programming language. In either case, the language can be a compiled language or an interpreted language.

[0157] One or more aspects of at least one embodiment may be implemented as representative instructions stored on a computer-readable storage medium, which represent various logic within a processor and, when read by a machine, causes the machine to fabricate logic for performing the techniques described herein. These representations, known as "IP cores," may be stored on a tangible, computer-readable storage medium and supplied to various customers or manufacturing facilities to load into fabrication machines that actually manufacture the logic or processor.

[0158] An embodiment of the present application discloses a computer-readable medium storing one or more programs executable by one or more processors to implement the method of the present application.

[0159] An embodiment of the present application discloses a computer program product, including a computer program, which implements the method of the present application when executed by a processor.

[0160] The above is an explanation of the implementation mode of the present application by means of specific specific embodiments. Those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. Although the description of the present application will be introduced in conjunction with the preferred embodiment, this does not mean that the features of this invention are limited to this implementation mode. On the contrary, the purpose of introducing the invention in conjunction with the implementation mode is to cover other options or modifications that may be extended based on the claims of the present application. In order to provide an in-depth understanding of the present application, the above description contains many specific details. The present application can also be implemented without using these details. In addition, in order to avoid confusion or blurring the focus of the present application, some specific details will be omitted in the description. It should be noted that, in the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

[0161] Furthermore, various operations will be described as multiple discrete operations in a manner that is most helpful in understanding the illustrative embodiments; however, the order of description should not be construed as implying that these operations are necessarily order dependent. In particular, these operations do not need to be performed in the order presented.

[0162] Unless the context dictates otherwise, the terms "comprising," "having," and "including" are synonymous. The phrase "A / B" means "A or B." The phrase "A and / or B" means "(A and B) or (A or B)."

[0163] In some cases, the disclosed embodiments can be implemented in hardware, firmware, software or any combination thereof. The disclosed embodiments can also be implemented as instructions carried or stored on one or more temporary or non-temporary machine-readable (e.g., computer-readable) storage media, which can be read and executed by one or more processors. For example, instructions can be distributed over a network or through other computer-readable media. Therefore, machine-readable media may include any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computer), but not limited to, a floppy disk, an optical disk, an optical disk, a read-only memory (CD-ROM), a magneto-optical disk, a read-only memory (ROM), a random access memory (RAM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic card or an optical card, a flash memory, or a tangible machine-readable memory for transmitting information through the Internet via electrical, optical, acoustic or other forms of propagation signals. Therefore, machine-readable media include any type of machine-readable media suitable for storing or transmitting electronic instructions or information in a form readable by a machine (e.g., a computer).

[0164] In the accompanying drawings, some structural or method features are shown in a specific arrangement and / or order. However, it should be understood that such specific arrangement and / or order may not be required. In some embodiments, these features may be arranged in a manner and / or order different from that shown in the illustrative drawings. In addition, the inclusion of structural or method features in a particular figure does not imply that such features are required in all embodiments, and in some embodiments, these features may not be included or may be combined with other features.

[0165] It should be understood that although the terms "first," "second," and the like may be used herein to describe various elements or data, these elements or data should not be limited by these terms. These terms are used only to distinguish one feature from another. For example, a first feature may be referred to as a second feature, and similarly, a second feature may be referred to as a first feature without departing from the scope of the exemplary embodiments.

[0166] It should be noted that in this specification, similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0167] While the present invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention.

Claims

1. A method for encrypting data applied to an electronic device, the method comprising the steps of accept an encryption request from a user, where the encryption request contains public data to be encrypted; load open data into the memory of an electronic device; accessing an encryption device to encrypt public data based on an asymmetric encryption algorithm to obtain encrypted data, wherein the asymmetric encryption algorithm generates a pair of a public key and a private key and uses the public key to encrypt public data; define a first path for storing open data and a second path for storing encrypted data; storing the encrypted data in a second storage path; and remove open data from the first storage path.

2. The method according to claim 1, wherein the public key is stored in the encryption device and the private key is stored in the peripheral storage device.

3. The method according to claim 2, further comprising the steps of receive a request to transmit encrypted data from a user, wherein the request to transmit encrypted data contains encrypted data and a second user. accessing the encryption device to generate second encrypted data based on the secret key, the encrypted data and a second public key corresponding to a second user, wherein the second public key is generated in a pair with the second secret key using an asymmetric encryption algorithm; store the second encrypted data in the third storage path.

4. The method according to claim 1, wherein at the stage of accessing the encryption device for encrypting open data based on an asymmetric encryption algorithm to obtain encrypted data, the open data is deleted from the memory if the encrypted data cannot be successfully obtained.

5. The method of claim 1, wherein the second storage path is generated from the first storage path based on a given rule.

6. The method of claim 1, further comprising the step of: deleting open data in memory.

7. The method according to claim 1, further comprising the step of: deleting encrypted data from the memory.

8. The method of claim 1, further comprising the step of: accessing the encrypted data and the clear data in the form of a path.

9. The method of claim 8, wherein the path type comprises one or more of the following: a shortcut, a path alias, and a soft link.

10. A method for decrypting data applied to an electronic device, wherein the method comprises the steps of accept a decryption request from the user, where the decryption request contains encrypted data to be decrypted; download encrypted data into the memory of an electronic device; read the secret key and access the encryption device to decrypt the encrypted data based on the asymmetric encryption algorithm to obtain the public data, wherein in the asymmetric encryption algorithm, the secret key is generated in pair with the public key and the secret key is used to decrypt the encrypted data; define the fourth path for storing encrypted data and the fifth path for storing open data; store the open data in the fifth storage path; and remove encrypted data from the fourth storage path.

11. The method of claim 10, wherein the public key is stored in the encryption device and the private key is stored in the peripheral storage device.

12. The method according to claim 10, further comprising the steps of verify the secret key; If the verification results in the secret key being invalid, the process is terminated and all generated data is deleted.

13. The method according to claim 10, further comprising the steps of determine the file extension corresponding to the open data; based on the file extension, create a new process and open the open data in memory; and If the process is completed, the open data is re-encrypted and imported into the sixth storage path.

14. The method of claim 10, wherein the fifth storage path is generated from the fourth storage path based on a given rule.

15. The method of claim 10, further comprising the step of deleting encrypted data from the memory.

16. The method of claim 10, further comprising the step of removing open data from the memory.

17. The method of claim 11, wherein the peripheral storage device is one or more of the following: a USB device, a Lightning interface device, a magnetic interface device, an IC card, and a near field communication device.

18. A data encryption and decryption system comprising an encrypted data management device, a device with a secret key, and an encryption device, wherein the device with a secret key is used to store the secret key, the encryption device is used for encryption and decryption operations and storing the public key, and the encrypted data management device is used to perform the data encryption method according to paragraphs 1-9 and the data decryption method according to paragraphs 10-17.

19. An electronic device comprising a memory in which machine-readable instructions are stored, and a processor; when the processor executes the instructions, the instructions cause the device to implement the method according to any one of paragraphs 1-17.

20. A machine-readable storage medium storing one or more programs, wherein said one or more programs can be executed by one or more processors to implement the method according to any of paragraphs 1-17.