Encrypting read / write method in use for NAS storage system

Abstract

The invention discloses an encrypted reading and writing method at the kernel state file system layer. The method is located between the virtual file system and the physical file system. During the reading operation, the read ciphertext data is first decrypted and then transmitted to the upper layer virtual file system; when writing, first determine the type of write operation, if it is a write operation, first encrypt the plaintext data to be written, and then pass the intercepted ciphertext data to the underlying physical file system, if it is a modification operation , the ciphertext data read into the memory will be partially decrypted, overwritten, globally encrypted, and partially intercepted. This method not only has the inherent high efficiency of kernel state operations, but also uses partial decryption and partial interception to improve the efficiency of data operations. From the test process and test data, it can be known that using the encrypted reading and writing method of the present invention can simultaneously overcome the inconvenience of the application layer encryption program and the low efficiency of the user state encrypted file system.

Description

technical field [0001] The invention belongs to the technical field of network storage, and in particular relates to an encrypted reading and writing method for a NAS storage system. Background technique [0002] The storage capacity of most enterprises doubles every 6 to 8 months. When the storage capacity continues to increase, the threatened data also increases. Theft, tampering and destruction of data are sometimes fatal to enterprises. At present, there is a very important application - Network Attached Storage (NAS). NAS mainly uses network protocols (such as Network File System, NFS) to back up and share data resources on Ethernet. Therefore, NAS has many security risks, such as Sniffing attacks, illegal copying, etc., the use of applications to protect data has the disadvantages of high overhead and inconvenient use. For example, users are usually not used to using applications to encrypt data. One idea is to implement encryption operations in the file system. [00...

AI Technical Summary

Problems solved by technology

[0004] Although the Cryptographic File System (CFS) designed by Matt Blaze realizes the encryption of the file system layer, see Matt Blaze's paper "A Cryptographic File System for UNIX", http: / / www.crypto.com / papers / cfs. pdf, but CFS is implemented in user mode, excessive context switching and data copying reduce the performance of this type of file system

Images