WO2020155812A1

WO2020155812A1 - Data storage method and device, and apparatus

Info

Publication number: WO2020155812A1
Application number: PCT/CN2019/120669
Authority: WO
Inventors: 应鹏飞; 殷山
Original assignee: 阿里巴巴集团控股有限公司
Priority date: 2019-01-31
Filing date: 2019-11-25
Publication date: 2020-08-06
Also published as: TW202031010A; CN110032874A

Abstract

Disclosed are a data storage method and device, and an apparatus. The method comprises: during data storage, encrypting multiple pieces of data by means of a subkey, and encrypting the subkey by means of a master key, so as to perform merging to form double-layer encrypted files, wherein each double-layer encrypted file contains a subkey ciphertext for data decryption, and the master key for decrypting the subkey ciphertext is kept by a user, thereby achieving an encryption technique employing two independent keys for data storage.

Description

Data storage method, device and equipment

Technical field

The embodiments of this specification relate to the field of information technology, and in particular to a data storage method, device, and equipment.

Background technique

Generally speaking, current user data is stored in a cloud disk, PC or mobile phone, etc., and users can access or read the data conveniently.

Many of the data stored by users are often personal private data, such as identity information, social information, business information, and so on. When storing data, on the one hand, there are external threats from hackers, on the other hand, it is also possible that internal misoperation of the enterprise may cause the leakage of collected user privacy data. Every data leakage may affect the privacy of users and affect the core interests of users.

Based on this, a more secure data storage method is needed.

Summary of the invention

In view of the infringement of user privacy caused by data leakage in existing data storage, in order to achieve safer data storage and protect user privacy, the embodiments of this specification provide a more secure data storage solution. In the first aspect, an embodiment of this specification provides a data storage method, including:

Determine the data to be stored;

Obtaining a randomly generated subkey, symmetrically encrypting the data to be stored using the subkey, and generating subkey encrypted data;

Obtain a master key generated based on user information, and use the master key to symmetrically encrypt the subkey to generate a subkey ciphertext, wherein the user information includes a user password or user biometric information;

Combine the sub-key encrypted data and the sub-key cipher text to generate a double-layer encrypted file and store it.

In the second aspect, an embodiment of this specification provides a decryption method based on the above double-layer encrypted file, including:

Determining the subkey encrypted data and the subkey ciphertext contained in the double-layer encrypted file;

Obtaining a master key authorized by the user, decrypting the subkey ciphertext using the master key, and generating a subkey, wherein the master key is generated based on user information;

Use the generated subkey to decrypt the subkey encrypted data, and generate usable decrypted data for the user to use.

Corresponding to the method of the first aspect, an embodiment of this specification also provides a data storage device, including:

Determine the module to determine the data to be stored;

The subkey encryption module obtains a randomly generated subkey, symmetrically encrypts the data to be stored using the subkey, and generates subkey encrypted data;

The master key encryption module obtains a master key generated based on user information, and uses the master key to symmetrically encrypt the subkey to generate a subkey ciphertext, wherein the user information includes user password or user biometric information ；

The merging module merges the sub-key encrypted data and the sub-key ciphertext to generate a double-layer encrypted file;

The storage module stores the double-layer encrypted file.

Corresponding to the method of the second aspect, an embodiment of this specification also provides a decryption device based on the aforementioned double-layer encrypted file, including:

The determining module determines the subkey encrypted data and the subkey ciphertext contained in the double-layer encrypted file;

The master key decryption module obtains the master key authorized by the user, uses the master key to decrypt the subkey ciphertext, and generates a subkey, wherein the master key is generated based on user information;

The subkey decryption module uses the generated subkey to decrypt the subkey encrypted data and generates usable decrypted data for the user to use.

During data storage, multiple data is encrypted by the subkey, and the subkey is encrypted by the master key at the same time, so as to merge to form a double-layer encrypted file. Each double-layer encrypted file contains the subkey secret used to decrypt the data. The master key used to decrypt the sub-key ciphertext is stored in the user's hands, forming an independent dual-key encryption method, which reduces the possibility of information leakage and helps protect user privacy.

It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the embodiments of this specification.

In addition, any one of the embodiments of the present specification does not need to achieve all the above-mentioned effects.

Description of the drawings

In order to more clearly explain the technical solutions in the embodiments of this specification or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only These are some of the embodiments described in the embodiments of this specification. For those of ordinary skill in the art, other drawings can be obtained from these drawings.

FIG. 1 is a schematic flowchart of a data storage method provided by an embodiment of this specification;

Figure 2 is a schematic diagram of an overall architecture involved in an embodiment of the specification;

3 is a schematic flowchart of a method for decrypting a double-layer encrypted file provided by an embodiment of this specification;

Figure 4 is a schematic structural diagram of a data storage device provided by an embodiment of this specification;

FIG. 5 is a schematic structural diagram of a decryption device for double-layer encrypted files provided by an embodiment of this specification;

Fig. 6 is a schematic structural diagram of a device for configuring the method of the embodiment of this specification.

detailed description

In order to enable those skilled in the art to better understand the technical solutions in the embodiments of this specification, the technical solutions in the embodiments of this specification will be described in detail below in conjunction with the drawings in the embodiments of this specification. Obviously, the described implementation The examples are only a part of the embodiments in this specification, not all the embodiments. Based on the embodiments in this specification, all other embodiments obtained by a person of ordinary skill in the art should fall within the scope of protection.

The technical solutions provided by the embodiments of this specification will be described in detail below with reference to the drawings. Fig. 1 is a schematic flowchart of a data storage method provided by an embodiment of this specification. As shown in Fig. 1, the process specifically includes the following steps:

S101: Determine data to be stored.

In the embodiments of this specification, the data to be stored can be provided by the user immediately; it can also be a file that the user has uploaded and stored in a specified path. The specified path here can include the local path of the user device or The path on the server that connects with the user client. The data may include various forms of data such as audio, video, text, image (such as picture, dynamic picture GIF, etc.).

S103: Obtain a randomly generated subkey, use the subkey to symmetrically encrypt the data to be stored, and generate subkey encrypted data.

The subkey is a parameter in the preset encryption algorithm. The form of the subkey is a character string. When a symmetric encryption algorithm is used, its length is generally 128 bits or 256 bits.

The encryption algorithm is used to convert the data to be stored from plain text to cipher text to generate sub-key encrypted data. In the embodiment of this specification, the encryption algorithm is a symmetric encryption algorithm. In other words, based on the subkey, the generated subkey can encrypt data and convert it back to the plaintext form of the data to be stored.

S105. Obtain a master key generated based on user information, and use the master key to symmetrically encrypt the subkey to generate a subkey ciphertext, where the user information includes a user password or user biometric information.

In the foregoing steps, the subkey is also required for subsequent decryption. At this time, the subkey is also in a plaintext state. Therefore, the subkey can also be symmetrically encrypted to generate the subkey ciphertext.

Specifically, a preset key derivation function (KDF) may be used to generate a master key based on user information. Then use the master key to encrypt the subkey to obtain the subkey ciphertext. For example, the master key can be encrypted based on DEs-based UNIX Crypt-function, FreeBSD MD5 crpty, PKCS#5 PBKDF2, GNU SHA-256/512 crypt, Windows NT LAN Manager (NTLM) hash, or Blowfish-based bcrypt. For the master key and the subkey, both are generated by the key derivation function, and the derivation function used can be the same or different.

For the key derivation function that generates the master key, when the input parameters are the same, the same master key can be obtained. Therefore, when the master key needs to be used again, the user can directly provide the master key, or the user provides the same user information again, and the preset key derivation function generates the same master key based on the same user information.

The master key should have the following properties: it is very unlikely that other users will get the master key. Therefore, in practical applications, it is possible to ensure that it is difficult for other users to obtain the master key by the following methods: the generated master key is held by the user and stored in a path or file that only the user can reach, for example, the generated master key The master key is physically isolated from other data; or, the generated master key is not saved, only the user can reproduce the master key again. At this time, an practicable way is to generate a master key based on unique user information, and it is very unlikely that other users will obtain the user information. For example, the user's account password, or the user's biometric information, etc. The biometric information may include unique biometrics such as fingerprints, voiceprints, iris, etc. In this way, when the master key needs to be used again, the above-mentioned unique biological characteristics can be used as parameters to generate the same master key based on the same KDF function.

Further, when using unique user information to generate the master key, some other variables can be added as parameters of the key derivation function. For example, adding a mnemonic word for reminding as a variable, the form of the mnemonic word can be a character, or a word, etc., when the master key needs to be generated again in the future, the mnemonic word and user information are obtained to generate the master password key. Or, when the master key is generated for the first time, a random number is added as a variable, and the random number is saved to the local device. When the master key needs to be generated again in the future, the random number and user information are obtained to generate the master key. For example, the master key = KDF (user password + random number + mnemonic phrase).

S107: Combine the sub-key encrypted data and the sub-key cipher text to generate a double-layer encrypted file, and store it.

You can perform operations such as splicing, inserting, etc. on the sub-key encrypted data and the sub-key ciphertext based on the preset merging method to generate a double-layer encrypted file and store it in the location specified by the user. In the double-layer encrypted file, the order and the types of the two do not need to be limited, as long as the sub-key encrypted data and the sub-key cipher text can be obtained in the encrypted file. As shown in FIG. 2, FIG. 2 is a schematic diagram of an overall architecture involved in an embodiment of the specification. In this schematic diagram, the user has stored the ID card information in the form of a double-layer encrypted file through his personal master key. Among them, H in the figure represents the file header of the double-layer encrypted file, which is the subkey ciphertext obtained after the main key encrypts the subkey. And, in the file header, in addition to the subkey ciphertext, other information may also be included. For example, it may also include the name of the encryption algorithm used when the subkey encrypts the data to be stored for prompting. In the figure, different encrypted files are encrypted with different subkeys, so the file headers are also different. In this schematic diagram, the user stores the information on a designated cloud disk. In practical applications, it is also feasible to store the information on the user's local device.

In the solution provided by the embodiment of this specification, when data is stored, multiple data is encrypted by the subkey, and the subkey is encrypted by the master key at the same time, so as to combine to form a double-layer encrypted file. Contains the sub-key ciphertext used to decrypt data, and the master key used to decrypt the sub-key ciphertext is stored in the user's hands, forming an independent dual-key encryption method, which reduces the possibility of information leakage and helps protect user privacy .

In a specific implementation, when there are multiple data to be stored, obtaining a randomly generated subkey includes: randomly obtaining multiple different subkeys for each data to be stored. For example, when users need to store their ID cards, driving licenses, and social files separately. Then every time a file is obtained, a random subkey can be generated based on the system time when the file is obtained. Using different subkeys for different files can further enhance data security.

In a specific implementation, when there are multiple data to be stored, the same master key generated based on user information can also be obtained; the same master key is used to symmetrically encrypt multiple subkeys, and generate Multiple sub-key ciphertexts generated by the same master key encryption, wherein the sub-key ciphertext corresponds to the data to be stored in a one-to-one correspondence. The advantage of using the same master key to encrypt multiple subkeys is that it is convenient for user management. For example, when the user's double-layer encrypted file is stored in the cloud, the user can use a master key to log in, add encrypted files, delete encrypted files, etc., to manage multiple files in the cloud. In addition, users can also use multiple encrypted files by authorizing a master key to a third party.

In a specific implementation, when merging files, the sub-key encrypted data and the sub-key cipher text can be directly spliced, or one file can be inserted into another file. For example, place the subkey ciphertext at the head, tail, or the middle position of the specified offset of the subkey encrypted data. In practical applications, the format of the double-layer encrypted file can be pre-defined as "file header + file body", in which the file header with a certain length is preset, the subkey ciphertext is placed in the file header, and the file body is placed with the subkey Encrypt data. Therefore, when decryption is needed, the file header can be directly decrypted by the subkey to obtain the subkey ciphertext, which is convenient for decryption and subsequent use.

After the double-layer encrypted file is generated based on the above-mentioned method, in the second aspect of the solution of this specification, a decryption method based on the above-mentioned double-layer encrypted file is also provided, as shown in FIG. 3, which is a method provided by an embodiment of this specification. The schematic flow diagram of the decryption method for double-layer encrypted files includes:

S301: Determine the sub-key encrypted data and the sub-key cipher text contained in the double-layer encrypted file; for example, directly read the sub-key encrypted data and the sub-key cipher text from the file header and file body of the double-layer encrypted file;

S303. Obtain a master key authorized by the user, decrypt the subkey ciphertext using the master key, and generate a subkey, where the master key is generated based on user information, and the user information is related to the generated master key The user information is the same;

S305: Use the generated subkey to decrypt the subkey encrypted data, and generate usable decrypted data for the user to use.

Since symmetric encryption is used in the encryption process, the master key and subkey can be used directly for symmetric decryption in the embodiments of this specification. In this decryption method, because it has been defaulted that the master key is basically impossible for other users to obtain, the data storage party (for example, the cloud storing the data) can perform decryption when receiving the master key. The authorization object of the master key can be the user himself, for example, when the user logs in to the account successfully, the authorization is successful by default. The authorized object of the master key may also be a third party. For example, when a user uses some third-party applications, the third-party application is allowed to use his own master key to perform certain specific authority operations, including query, verification, and so on.

The solutions provided in the embodiments of this specification can be implemented in the following application scenarios: a program application APP for data storage methods is provided in the user's local device (which may include a smart phone, a personal computer, a smart tablet, etc.), and the user An account is established on the APP, and the APP creates a master key through the user's login password or the user's biological characteristics (fingerprints, voiceprints, etc.). Therefore, when the user uses the login password or biometrics, the master key is uniquely determined. Furthermore, the user can provide the file he wants to encrypt in the interface provided by the APP by dragging, selecting, and other operations in the interface . The APP randomly generates a subkey for encryption at this time to encrypt the file. At the same time, the master key encrypts the subkey to obtain the subkey ciphertext, and puts the subkey ciphertext in the head to generate an encrypted double-layer file. The APP can receive instructions from the user to determine the storage location; or, provide corresponding location setting options to store the encrypted double-layer file in the storage location selected by the user in advance. The storage location can be in the user's local device or in the server docking with the APP. Through the above methods, users can safely store some of their private information (such as identity information and social information). Even if data is leaked on the server, the user's privacy will not be leaked.

In the above storage method, if a third party needs to query or verify some private information of the user, the user can authorize the master key to provide the third party with the master key when verification is required, so that the third party can rely on the master key. The key authorization goes to the server to request, and the server decrypts the user's personal information based on the master key, and performs the verification. In this way, on the one hand, the user only needs to use a master key to manage multiple data; on the other hand, the user only needs to store personal data in encrypted form on the server, without the need for third parties (in fact, the first The number of three parties is quite large) Provide their own private information to avoid the leakage of their own data by third parties.

Corresponding to the first aspect, an embodiment of this specification also provides a data storage device, as shown in FIG. 4, which is a schematic structural diagram of a data storage device provided by an embodiment of this specification, the device includes:

The determining module 401 determines the data to be stored;

The subkey encryption module 403 obtains a randomly generated subkey, uses the subkey to symmetrically encrypt the data to be stored, and generates subkey encrypted data;

The master key encryption module 405 obtains a master key generated based on user information, and uses the master key to symmetrically encrypt the subkey to generate a subkey ciphertext, wherein the user information includes a user password or user biometric characteristics information;

The merging module 407 merges the sub-key encrypted data and the sub-key ciphertext to generate a double-layer encrypted file;

The storage module 409 stores the double-layer encrypted file.

Further, the master key encryption module 405 obtains a master key generated in advance according to user information from a path specified by the user; or, obtains user information, and uses a preset key derivation function to generate a master key based on the user information. key.

Further, the subkey encryption module 403 randomly obtains multiple different subkeys for each data to be stored.

Further, the master key encryption module 405 obtains the same master key generated based on user information; uses the same master key to symmetrically encrypt multiple sub-keys respectively, and generates multiple sub-key secrets generated based on the same master key encryption. The ciphertext of the subkey corresponds to the data to be stored.

Further, the merging module 407 uses the subkey ciphertext as a file header, merges the subkey encrypted data, and generates a double-layer encrypted file whose file header does not exceed a preset length.

Corresponding to the second aspect, an embodiment of this specification also provides a decryption device for double-layer encrypted files, as shown in FIG. 5, which is a schematic structural diagram of a decryption device for double-layer encrypted files provided by the embodiment of this specification ,include:

The determining module 501 determines the subkey encrypted data and the subkey ciphertext contained in the double-layer encrypted file;

The master key decryption module 503 obtains a master key authorized by the user, uses the master key to decrypt the subkey ciphertext, and generates a subkey, wherein the master key is generated based on user information;

The subkey decryption module 505 uses the generated subkey to decrypt the subkey encrypted data to generate usable decrypted data for the user to use.

The embodiment of this specification also provides a computer device, which at least includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein the processor implements the data shown in FIG. 1 when the program is executed. Storage method.

FIG. 6 shows a more specific hardware structure diagram of a computing device provided by an embodiment of this specification. The device may include a processor 1010, a memory 1020, an input/output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input/output interface 1030, and the communication interface 1040 realize the communication connection between each other in the device through the bus 1050.

The processor 1010 may be implemented by a general CPU (Central Processing Unit, central processing unit), microprocessor, application specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, etc., for execution related Program to realize the technical solutions provided in the embodiments of this specification.

The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory, random access memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of the present specification are implemented through software or firmware, related program codes are stored in the memory 1020 and called and executed by the processor 1010.

The input/output interface 1030 is used to connect an input/output module to realize information input and output. The input/output/module can be configured in the device as a component (not shown in the figure), or can be connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and an output device may include a display, a speaker, a vibrator, an indicator light, and the like.

The communication interface 1040 is used to connect a communication module (not shown in the figure) to realize the communication interaction between the device and other devices. The communication module can realize communication through wired means (such as USB, network cable, etc.), or through wireless means (such as mobile network, WIFI, Bluetooth, etc.).

The bus 1050 includes a path for transmitting information between various components of the device (for example, the processor 1010, the memory 1020, the input/output interface 1030, and the communication interface 1040).

It should be noted that although the above device only shows the processor 1010, the memory 1020, the input/output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, the device may also include the equipment necessary for normal operation. Other components. In addition, those skilled in the art can understand that the above-mentioned device may also include only the components necessary to implement the solutions of the embodiments of this specification, and not necessarily include all the components shown in the figures.

The embodiment of this specification also provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the data storage method shown in FIG. 1 is implemented.

Computer-readable media includes permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

From the description of the foregoing implementation manners, it can be known that those skilled in the art can clearly understand that the embodiments of this specification can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the technical solutions of the embodiments of the present specification can be embodied in the form of software products, which can be stored in storage media, such as ROM/RAM, A magnetic disk, an optical disk, etc., include several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute the methods described in the various embodiments or some parts of the embodiments of this specification.

The systems, methods, modules or units explained in the above embodiments may be specifically implemented by computer chips or entities, or implemented by products with certain functions. A typical implementation device is a computer. The specific form of the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email receiving and sending device, and a game control A console, a tablet computer, a wearable device, or a combination of any of these devices.

The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. In particular, as for the method embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant part can refer to the part of the description of the method embodiment. The method embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separated. When implementing the solutions of the embodiments of this specification, the functions of the modules may be in the same Or multiple software and/or hardware implementations. It is also possible to select some or all of the modules according to actual needs to achieve the objectives of the solutions of the embodiments. Those of ordinary skill in the art can understand and implement it without creative work.

The above are only specific implementations of the embodiments of this specification. It should be pointed out that for those of ordinary skill in the art, without departing from the principle of the embodiments of this specification, several improvements and modifications can be made. These Improvement and retouching should also be regarded as the protection scope of the embodiments of this specification.

Claims

A data storage method, including:

Determine the data to be stored;

Obtaining a randomly generated subkey, symmetrically encrypting the data to be stored using the subkey, and generating subkey encrypted data;

Obtain a master key generated based on user information, and use the master key to symmetrically encrypt the subkey to generate a subkey ciphertext, wherein the user information includes a user password or user biometric information;

Combine the sub-key encrypted data and the sub-key cipher text to generate a double-layer encrypted file and store it.
The method of claim 1, obtaining a master key generated based on user information, comprising:

Obtain the master key generated in advance based on user information from the path specified by the user; or,

Obtain user information, and use a preset key derivation function to generate a master key based on the user information.
The method according to claim 1, when there are multiple data to be stored, obtaining a randomly generated subkey includes:

For each data to be stored, multiple different subkeys are randomly obtained.
The method according to claim 3, obtaining a master key generated based on user information, using the master key to symmetrically encrypt the subkey, and generating a subkey ciphertext, comprising:

Obtain the same master key generated based on user information;

The same master key is used to symmetrically encrypt a plurality of subkeys respectively, and a plurality of subkey ciphertexts generated based on the same master key encryption are generated, wherein the subkey ciphertexts correspond to the data to be stored in a one-to-one correspondence.
The method of claim 1, combining the encrypted data and the subkey ciphertext to generate a double-layer encrypted file, comprising:

Using the sub-key cipher text as a file header, combining the sub-key encrypted data to generate a double-layer encrypted file whose file header does not exceed a preset length.
A method for decrypting a double-layer encrypted file based on any one of claims 1 to 5, comprising:

Determining the subkey encrypted data and the subkey ciphertext contained in the double-layer encrypted file;

Obtaining a master key authorized by the user, decrypting the subkey ciphertext using the master key, and generating a subkey, wherein the master key is generated based on user information;

Use the generated subkey to decrypt the subkey encrypted data, and generate usable decrypted data for the user to use.
A data storage device includes:

Determine the module to determine the data to be stored;

The subkey encryption module obtains a randomly generated subkey, symmetrically encrypts the data to be stored using the subkey, and generates subkey encrypted data;

The master key encryption module obtains a master key generated based on user information, and uses the master key to symmetrically encrypt the subkey to generate a subkey ciphertext, wherein the user information includes user password or user biometric information ；

The merging module merges the sub-key encrypted data and the sub-key ciphertext to generate a double-layer encrypted file;

The storage module stores the double-layer encrypted file.
7. The device of claim 7, wherein the master key encryption module obtains the master key generated in advance according to user information from a path specified by the user; or, obtains user information, using a preset key derivation function based on the User information generates a master key.
8. The device according to claim 7, wherein the subkey encryption module randomly obtains a plurality of different subkeys for each data to be stored.
9. The device according to claim 9, wherein the master key encryption module obtains the same master key generated based on user information; uses the same master key to symmetrically encrypt multiple sub-keys respectively, and generates an encrypted generation based on the same master key The multiple sub-key ciphertexts of, where the sub-key ciphertext corresponds to the data to be stored one-to-one.
7. The device according to claim 7, wherein the merging module uses the subkey ciphertext as a file header, merges the subkey encrypted data, and generates a double-layer encrypted file whose file header does not exceed a preset length.
A decryption device based on the double-layer encrypted file according to any one of claims 7 to 11, comprising:

The determining module determines the subkey encrypted data and the subkey ciphertext contained in the double-layer encrypted file;

The master key decryption module obtains the master key authorized by the user, uses the master key to decrypt the subkey ciphertext, and generates a subkey, wherein the master key is generated based on user information;

The subkey decryption module uses the generated subkey to decrypt the subkey encrypted data and generates usable decrypted data for the user to use.
A computer device, comprising a memory, a processor, and a computer program stored on the memory and capable of running on the processor, wherein the processor executes the program as described in any one of claims 1 to 6 method.