A File Encryption System Based on Bridge File System

Abstract

The invention relates to a document encryption system based on a bridge document system. The system comprises a document encryption filter drive and the bridge document system, wherein when a trusted process opens or establishes an encrypted document or opens or establishes a secure document catalog or one document in a secure document disk, the document encryption filter drive will reorient the operation of document opening or establishment to a virtual document disk or a document in a virtual document catalog mapped by or corresponding to the bridge document system; the bridge document system converts all the operations of the trusted process aiming at the reoriented document into operations aiming at an original document before reorientation; document data read by the trusted process through the bridge document system is unencrypted data, and data directly read by a non-trusted process from the document is encrypted data; and the trusted process and the non-trusted process of the same document are opened simultaneously by different document FCBs and buffers, so that problems about violent buffer clearance or buffer refreshing can be avoided, and the buffered unencrypted data and the encrypted data are avoided from being mixed.

Description

technical field [0001] The invention belongs to the technical field of information security, in particular to a file encryption system based on a bridge file system. Background technique [0002] The transparent file encryption system based on the file filter driver (File Filter Driver) can automatically realize the encryption and decryption of files without affecting the user's usage habits, and is an important technical means to ensure data security. However, the current transparent file encryption technology based on the file filter driver generally has the following problems. [0003] The current file system (such as the Windows file system) is a file system with a cache, that is, when a program process reads the data of a file, the file system first checks whether there is data to be read by the program process cached in the memory. If yes, directly return the data cached in the memory; otherwise, the file system reads a certain amount of file data (usually several pag...

AI Technical Summary

Problems solved by technology

The double buffering scheme changes the operation and processing of file I / O at the kernel layer, trying to make the trusted process and the untrusted process read different cached data, but the technical solution is complicated

The multi-FCB scheme (such as SEFS based on LayerFSD technology, see the SEFS transparent encryption platform technology white paper based on LayerFSD technology) actually introduces a new file system, which enables each process to have its own FCB and cache, and develops a Of course, the new file system is a very complicated matter, and the memory utilization rate and the problem of repeatedly reading data exist. The biggest problem with this solution is that users and programs cannot directly operate on the original file system, but in the new file system. Operate on the imported file system

Images