Virtual disk encryption method and device based on Ukey

Abstract

The invention belongs to the technical field of information security, and discloses a virtual disk encryption method and device based on a Ukey. The method comprises the following steps: after Ukey access is detected, creating a virtual disk partition, generating a blank mirror image file according to input file information, writing a preset file content structure and encrypted information obtained by encrypting a symmetric encryption key generated by a secure random number generator by using an encryption certificate exported by the Ukey into the blank mirror image file, and storing the blank mirror image file in the virtual disk partition; and finally, encrypting formatted file data in a file system by using a symmetric encryption key to obtain ciphertext data, generating an encrypted disk mirror image file by combining the ciphertext data with the written preset file content structure, realizing separation management of the key and the data by using UKey equipment, and storing the key in the UKey. A physical chip is used for protecting the secret key, the risk of secret key leakage is greatly reduced, the data safety is improved, meanwhile, encrypted mirror image file data in a unified format can be seamlessly used between different platforms, and higher flexibility and convenience are achieved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a virtual disk encryption method and device based on Ukey. Background Art

[0002] Currently, most systems in this field use default file encryption to protect data on disk using symmetric encryption technology (usually symmetric encryption algorithms such as AES), and use access control and user permissions to limit which users or groups can view, modify, and delete files.

[0003] The disadvantage of this type of encryption method is that it uses account passwords or key files to protect data. Key management is difficult and once leaked, if the user forgets the decryption password or loses the key file, it will become very difficult or even impossible to recover the encrypted data.

[0004] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of the present invention is to provide a virtual disk encryption method and device based on Ukey, aiming to solve the technical problem that the current encryption methods all use account passwords or key files to protect data, the key management is difficult and once leaked, if the user forgets the decryption password or loses the key file when using it, then recovering the encrypted data will become very difficult or even impossible.

[0006] To achieve the above object, the present invention provides a virtual disk encryption method based on Ukey, and the virtual disk encryption method based on Ukey comprises the following steps:

[0007] After detecting the Ukey access, receive the virtual disk partition creation request;

[0008] Creating a virtual disk partition based on the virtual disk partition creation request;

[0009] Generate a blank image file based on the input file information, and write a preset file content structure into the blank image file to obtain a first image file, wherein the file information includes an image file name, an image file path, and an image file size;

[0010] Export the encryption certificate from the connected Ukey;

[0011] Generate symmetric encryption keys using a secure random number generator;

[0012] Encrypting the symmetric encryption key based on the encryption certificate, and writing the encrypted information obtained after encryption into the first image file to obtain a second image file;

[0013] Mounting the second image file to the file system using the disk drive corresponding to the virtual disk partition for formatting, and after the file system is formatted, decrypting the symmetric encryption key from the second image file, and encrypting the formatted file data in the file system using the symmetric encryption key to obtain ciphertext data;

[0014] The ciphertext data is written into the second image file to generate an encrypted disk image file.

[0015] In some embodiments, encrypting the symmetric encryption key based on the encryption certificate and writing the encrypted information obtained after encryption into the first image file includes:

[0016] Determining an encryption algorithm corresponding to the encryption certificate;

[0017] If the encryption algorithm is the SM2 encryption algorithm, the symmetric encryption key is encrypted using the SM2 asymmetric encryption algorithm, and after the encryption is completed, the asymmetric encryption algorithm parameters, the length of the asymmetric encryption algorithm parameters, the symmetric encryption key and the associated parameters, and the length of the symmetric encryption key and the associated parameters are written into the first image file, wherein the encryption structure of the symmetric encryption key includes a 16-byte key, a 4-byte counter occupancy, and a 32-byte formatting vector.

[0018] In some embodiments, writing the ciphertext data into the second image file includes:

[0019] Filling an isolation band in the second image file, wherein the size of the isolation band is 1024 bytes;

[0020] The ciphertext data is filled after the isolation band.

[0021] In some embodiments, the method further comprises:

[0022] Determine whether the Ukey is accessed for the first time;

[0023] If it is the first access, the step of receiving the virtual disk partition creation request is executed;

[0024] If it is not the first access, the stored encrypted disk image file is decrypted to obtain the decrypted file data;

[0025] A write request is received, the decrypted file data is updated based on the write request, and the updated file data is re-encrypted.

[0026] In some embodiments, decrypting the stored encrypted disk image file includes:

[0027] Receive the input image file path and the virtual disk partition to be mounted;

[0028] Obtaining the stored encrypted disk image file according to the image file path;

[0029] Mapping the stored encrypted disk image file to the virtual disk partition, and performing format parsing and conversion on the encrypted data in the stored encrypted disk image file to obtain structured format data;

[0030] Receiving a read request, and acquiring a certificate key pair matching the Ukey through the virtual disk partition based on the read request;

[0031] The structured format data is decrypted based on the certificate key to obtain decrypted file data.

[0032] In some embodiments, the method further comprises:

[0033] Obtaining header information of the stored encrypted disk image file;

[0034] Verifying the stored encrypted disk image file based on the header information;

[0035] If the verification passes, the step of mapping the stored encrypted disk image file to the virtual disk partition is performed;

[0036] Accordingly, the method further comprises:

[0037] If the certificate key pair matching the Ukey is not obtained, or the obtained certificate key pair does not match the Ukey, the user is reminded that the file data decryption loading failed.

[0038] In some embodiments, updating the decrypted file data based on the write request and re-encrypting the updated file data includes:

[0039] Acquire a corresponding symmetric encryption key and updated file information based on the write request;

[0040] updating the decrypted file data based on the updated file information;

[0041] Encrypting the updated file data based on the symmetric encryption key to obtain new ciphertext data;

[0042] The new ciphertext data is formatted and stored to obtain an updated encrypted disk image file.

[0043] In addition, to achieve the above purpose, the present invention also proposes a virtual disk encryption device based on Ukey, and the virtual disk encryption device based on Ukey includes:

[0044] The request receiving module is used to receive a virtual disk partition creation request after detecting that the Ukey is connected;

[0045] A partition creation module, used to create a virtual disk partition based on the virtual disk partition creation request;

[0046] A file generation module, configured to generate a blank image file based on input file information, and write a preset file content structure into the blank image file to obtain a first image file, wherein the file information includes an image file name, an image file path, and an image file size;

[0047] The certificate acquisition module is used to export the encryption certificate from the connected Ukey;

[0048] A key generation module, used to generate symmetric encryption keys using a secure random number generator;

[0049] A file encryption module, used for encrypting the symmetric encryption key based on the encryption certificate, and writing the encrypted information obtained after encryption into the first image file to obtain a second image file;

[0050] The file encryption module is used to mount the second image file to a file system using a disk drive corresponding to the virtual disk partition for formatting, and after the file system is formatted, decrypt the symmetric encryption key from the second image file, and use the symmetric encryption key to encrypt the formatted file data in the file system to obtain ciphertext data;

[0051] The file generation module is used to write the ciphertext data into the second image file to generate an encrypted disk image file.

[0052] In some embodiments, the file encryption module is used to determine the encryption algorithm corresponding to the encryption certificate;

[0053] If the encryption algorithm is the SM2 encryption algorithm, the symmetric encryption key is encrypted using the SM2 asymmetric encryption algorithm, and after the encryption is completed, the asymmetric encryption algorithm parameters, the length of the asymmetric encryption algorithm parameters, the symmetric encryption key and the associated parameters, and the length of the symmetric encryption key and the associated parameters are written into the first image file, wherein the encryption structure of the symmetric encryption key includes a 16-byte key, a 4-byte counter occupancy, and a 32-byte formatting vector.

[0054] In some embodiments, the file generation module is used to fill the isolation band in the second image file, and the isolation band size is 1024 bytes;

[0055] The ciphertext data is filled after the isolation band.

[0056] In the present invention, after detecting the access of Ukey, a virtual disk partition creation request is received; a virtual disk partition is created based on the virtual disk partition creation request; a blank image file is generated based on the input file information, and a preset file content structure is written into the blank image file to obtain a first image file; an encryption certificate is derived from the connected Ukey; a symmetric encryption key is generated using a secure random number generator; the symmetric encryption key is encrypted based on the encryption certificate, and the encrypted information obtained after encryption is written into the first image file to obtain a second image file; the second image file is mounted to the file system using the disk drive corresponding to the virtual disk partition for formatting, and after the file system is formatted, the symmetric encryption key is decrypted from the second image file, and the formatted file data in the file system is encrypted using the symmetric encryption key to obtain ciphertext data; the ciphertext data is written into the second image file to generate an encrypted disk image file, and the UKey device is used to realize the separation management of keys and data, the keys are stored in the UKey, and the physical chip is used to protect the keys, which greatly reduces the risk of key leakage and improves the security of data. At the same time, the encrypted image file data in a unified format can be seamlessly used between different platforms, with higher flexibility and convenience. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a flow chart of a first embodiment of a virtual disk encryption method based on Ukey according to the present invention;

[0058] Figure 2 This is a schematic diagram of the functional modules in the virtual disk encryption method based on Ukey of the present invention;

[0059] Figure 3 This is a schematic diagram of the user operation interface in the virtual disk encryption method based on Ukey of the present invention;

[0060] Figure 4 A schematic diagram of creating a virtual encrypted disk partition and file system data mapping in the virtual disk encryption method based on Ukey of the present invention;

[0061] Figure 5 It is a flow chart of the overall solution of mounting a virtual encrypted disk in the virtual disk encryption method based on Ukey of the present invention;

[0062] Figure 6 This is a structural block diagram of the first embodiment of the virtual disk encryption device based on Ukey of the present invention.

[0063] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0064] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0065] The embodiment of the present invention provides a virtual disk encryption method based on Ukey, referring to Figure 1 , Figure 1 The figure is a flowchart of a first embodiment of a virtual disk encryption method based on Ukey of the present invention.

[0066] In this embodiment, the virtual disk encryption method based on Ukey includes the following steps:

[0067] Step S10: After detecting that the Ukey is connected, a virtual disk partition creation request is received.

[0068] In this embodiment, the executor of this embodiment is a Ukey-based virtual disk encryption device, wherein the Ukey-based virtual disk encryption device has functions such as data processing, data communication and program running. The Ukey-based virtual disk encryption device can be a computer terminal device or other network device, and of course it can also be other devices with similar functions, and this embodiment does not limit this.

[0069] It should be noted that the disadvantage of current encryption methods is that they all use account passwords or key files to protect data. Key management is difficult and once leaked, if the user forgets the decryption password or loses the key file, then recovering the encrypted data will become very difficult or even impossible.

[0070] In order to solve the above technical problems, in this embodiment, after detecting that Ukey is connected, a virtual disk partition creation request is received; a virtual disk partition is created based on the virtual disk partition creation request; a blank image file is generated based on the input file information, and a preset file content structure is written into the blank image file to obtain a first image file; an encryption certificate is derived from the connected Ukey; a symmetric encryption key is generated using a secure random number generator; the symmetric encryption key is encrypting based on the encryption certificate, and the encrypted information obtained after encryption is written into the first image file to obtain a second image file; the second image file is mounted to the file system using the disk drive corresponding to the virtual disk partition. The symmetric encryption key is decrypted from the second image file after the file system is formatted, and the formatted file data in the file system is encrypted using the symmetric encryption key to obtain ciphertext data; the ciphertext data is written into the second image file to generate an encrypted disk image file. The UKey device is used to realize the separation management of the key and the data. The key is stored in the UKey, and the physical chip is used to protect the key, which greatly reduces the risk of key leakage and improves the security of the data. At the same time, the encrypted image file data in a unified format can be seamlessly used between different platforms, with higher flexibility and convenience. Specifically, it can be implemented as follows.

[0071] In the specific implementation, the overall functional structure of the solution is first described in this embodiment, and the specific Figure 2 As shown, Figure 2It is divided into user space and kernel space. Regarding user space, users can use virtual disk tools to create virtual disk encryption files, set the file name of the image file, the path where the file is stored, the size of the space used by the image file, and select the encryption certificate for protection. You can select multiple encryption certificates, and multiple certificates can be obtained in other ways. Selecting multiple encryption certificates means supporting simultaneous sharing by multiple people, as well as setting the encryption symmetric algorithm. The symmetric algorithm is the national encryption algorithm SM4, and the working mode uses CTR. After determining the above parameters, click the confirmation button to generate the image file. Regarding kernel space, it is implemented through a virtual disk encryption driver, which is mainly used for key generation, data encryption, and the generation and management of the final image file, and is linked to the file system to use the virtual disk to store encrypted data. Among them, the virtual disk user tool is a tool provided to users, through which encrypted disks can be created and mounted for use; the virtual disk encryption driver is the kernel of the operating system, responsible for implementing the core processing logic of disk encryption; it includes sub-modules such as the disk device management module, key management module, encryption module, and image file management module; the disk device management module is responsible for processing the general logic of the disk, such as disk initialization, opening, closing, exceptions and other processing processes; the key management module is responsible for communicating with UKey and processing key-related information. The encryption module is responsible for implementing the encryption and decryption algorithm and providing highly secure algorithm core logic functions; the image file management module is responsible for implementing the format conversion of encrypted disk files, writing and reading data files and other operational functions.

[0072] The user interface corresponding to the above user space and kernel space and the process of creating a virtual encrypted disk partition can be referred to respectively. Figure 3 and Figure 4 See Figure 3 As shown, the interface includes multiple function options. The first is a file selection button that allows users to select an image file path in write / create mode. For the selection box of the symmetric key algorithm, users can choose symmetric encryption algorithms such as SM4-CTR. The disk space size is filled in manually by the operator, and the unit can be modified through the selection box, supporting MB and GB units. In addition, there are two buttons, "Add from File" and "Add from U-Key", through which users can add encryption certificates. The added certificate will be displayed in the certificate grid, including information such as the certificate subject name, certificate type, and validity period. Finally, the purpose of the Load Partition button is to help users select the disk partition to be encrypted and incorporate its contents into the encryption process to ensure that all data in the selected partition is protected. This button ensures that users can easily load and process partitions, and the disk data required to perform encryption tasks can be added to the overall structure of the encrypted disk in a timely manner. Reference Figure 4As shown, after the user initiates a request to create a partition, the virtual disk user tool will create a corresponding partition according to the preset disk size, and then initialize the file system through virtual disk encryption. After the initialization is completed, the data of the initialized file system is encrypted and stored in the image file, and then the corresponding virtual disk partition is mapped to the file system. Finally, the user can view the virtual disk partition associated with the file system. Among them, create a disk partition request: the user uses the virtual disk user tool to initiate a request to create a disk partition, and the request comes to the virtual disk encryption driver for processing. Initialize the virtual disk partition: the virtual disk encryption driver interacts with the file system driver to initialize a new virtual disk partition and file system data. Initialize the file system: after the file system is formatted, the initialization data is sent to the virtual disk driver through a write request. The virtual disk driver. Use a secure random number to generate a symmetric key E1, use the symmetric key to encrypt the file system formatted data to generate FileSystemEnc, and use the asymmetric key E2 of the encryption certificate to encrypt the generated symmetric key E1. The algorithm uses the certificate algorithm. If it is an SM2 certificate, use the SM2 algorithm to encrypt the symmetric key to generate KeyEncryptedData, KeyEncryptedData = Enc (E2, E1). After the encryption is completed, FileSystemEnc, KeyEncryptedData, asymmetric encryption algorithm parameter length, asymmetric encryption algorithm parameters, the length of the result of encrypting the symmetric key and related parameters, and the result of encrypting the symmetric key and related parameters are written to the image file. Mapping the file system: virtual disk driver, calling the UKey interface, the user enters the password, decrypts the symmetric key for encrypting the file system data, and activates the key management module and encryption module. The file system maps the disk partition to the file system of the operating system, and the user can access the disk partition normally. Display virtual partitions: users can see and access the newly created disk partition and start using the encrypted partition. In addition, the overall flow diagram of this solution combined with the above two processes can be referred to Figure 5 shown.

[0073] Specifically, in this embodiment, it is necessary to detect the access of Ukey first. After detecting the access of Ukey, it is necessary to detect whether the Ukey is accessed for the first time. If it is the first time, an encrypted disk image file needs to be generated to receive a virtual disk partition creation request.

[0074] Step S20: creating a virtual disk partition based on the virtual disk partition creation request.

[0075] After receiving the virtual disk partition request, determine the disk size, and then create the corresponding virtual disk partition according to the disk size. The disk size can be determined based on the size of the encrypted disk image file to be created. The file size can be MB or GB. The specific size can be set according to actual needs, and this is not limited in this embodiment.

[0076] Step S30: Generate a blank image file based on the input file information, and write a preset file content structure into the blank image file to obtain a first image file.

[0077] The input file information in this embodiment includes the image file name, the image file path and the image file size. According to this information, a blank image file can be generated in this embodiment. The blank image file has no file data and is not encrypted. Then, the preset file content structure is absorbed into the blank image file to obtain a first image file, wherein the preset file content structure can be shown in Table 1 below.

[0078] Table 1:

[0079]

[0080]

[0081] The structure of the encrypted image file also consists of two parts, the first part is the file header, followed by the encrypted file body. In the encrypted image file, all integers use big-endian order, and all lengths are in bytes.

[0082] Step S40: Export the encryption certificate from the connected Ukey.

[0083] In this embodiment, the key is stored in the Ukey device, and each connected Ukey has its corresponding encryption certificate, from which the corresponding encryption certificate can be derived.

[0084] Step S50: Generate a symmetric encryption key using a secure random number generator.

[0085] Step S60: Encrypt the symmetric encryption key based on the encryption certificate, and write the encrypted information obtained after encryption into the first image file to obtain a second image file.

[0086] Specifically, the encryption certificate has its corresponding encryption algorithm, such as the SM2 encryption algorithm. If it is the SM2 encryption algorithm, after encrypting the symmetric encryption key, the asymmetric encryption algorithm parameters, the length of the asymmetric encryption algorithm parameters, the symmetric encryption key and associated parameters, and the length of the symmetric encryption key and associated parameters are written into the first mirror file, thereby obtaining the second mirror file.

[0087] Step S70: Mount the second image file to the file system using the disk drive corresponding to the virtual disk partition for formatting, and after the file system is formatted, decrypt the symmetric encryption key from the second image file, and use the symmetric encryption key to encrypt the formatted file data in the file system to obtain ciphertext data.

[0088] In a specific implementation, in this embodiment, the second image file is mounted to the file system using the disk drive corresponding to the virtual disk partition for formatting. Then, when encrypting, the symmetric encryption key is first encrypted from the second image file, and then the formatted data is encrypted.

[0089] Step S80: writing the ciphertext data into the second image file to generate an encrypted disk image file.

[0090] It should be noted that, in order to further improve data security, an isolation band is provided in this embodiment, and the isolation band is filled in the second image file. The size of the isolation band is 1024 bytes, and referring to the above-mentioned preset file content structure, it can be known that the ciphertext data is filled after the isolation band.

[0091] For example, after the file system formats the disk, the virtual disk encryption driver uses the symmetric key to encrypt the file system initialization data content and generate the encrypted file body FileSystemEnc. The isolation zone is filled in the image file, and the ciphertext data FileSystemEnc is filled in.

[0092] Furthermore, the above is for the first access situation. If the encrypted disk image file has been generated, the user can directly view it without repeating the above creation process. When viewing, decryption is required first. The decryption process specifically includes receiving the input image file path and the virtual disk partition to be mounted; obtaining the stored encrypted disk image file according to the image file path; mapping the stored encrypted disk image file to the virtual disk partition, and formatting and converting the encrypted data in the stored encrypted disk image file to obtain structured format data; receiving a read request, and obtaining the certificate key pair matching the Ukey through the virtual disk partition based on the read request; decrypting the structured format data based on the certificate key to obtain the decrypted file data.

[0093] It should be noted that decryption and encryption are opposite processes. Since encryption maps the file data of the virtual disk and the file system, when decrypting, structured format data can be obtained based on the virtual disk partition that needs to be mounted. Since the key is stored in the Ukey device, when the structured format data is finally decrypted, the certificate key pair matching the Ukey is required to complete the decryption.

[0094] In this embodiment, a verification process is also required. Specifically, the header information of the stored encrypted disk image file is obtained; the stored encrypted disk image file is verified based on the header information; if the verification passes, the subsequent decryption operation is performed. In actual situations, there may be a situation where the certificate key pair matching the Ukey is not obtained, or the obtained certificate key pair does not match the Ukey. In this case, the user will be reminded that the file data decryption loading failed in this embodiment. The mismatch can be determined by comparing the key identifier of the certificate key pair with the device identifier of the Ukey device.

[0095] Furthermore, when the user needs to modify the data, the present embodiment will first receive a write request, obtain the corresponding symmetric encryption key and updated file information according to the write request, update the decrypted file data based on the updated file information; encrypt the updated file data based on the symmetric encryption key to obtain new ciphertext data; format and store the new ciphertext data to obtain an updated encrypted disk image file. Through the above method, real-time encryption can be achieved after the modification, and it should be emphasized that the modification process is after the viewing process, so when the user has no permission to view, he has no permission to modify, and the viewing permission is limited to the certificate key pair stored in the connected Ukey device. This method can avoid the leakage of file data and prevent the file data from being tampered with.

[0096] In this embodiment, after detecting the access of Ukey, a virtual disk partition creation request is received; a virtual disk partition is created based on the virtual disk partition creation request; a blank image file is generated based on the input file information, and a preset file content structure is written into the blank image file to obtain a first image file; an encryption certificate is derived from the connected Ukey; a symmetric encryption key is generated using a secure random number generator; the symmetric encryption key is encrypted based on the encryption certificate, and the encrypted information obtained after encryption is written into the first image file to obtain a second image file; the second image file is mounted to the file system for formatting using the disk drive corresponding to the virtual disk partition, and after the file system is formatted, the symmetric encryption key is decrypted from the second image file, and the formatted file data in the file system is encrypted using the symmetric encryption key to obtain ciphertext data; the ciphertext data is written into the second image file to generate an encrypted disk image file, and the UKey device is used to realize the separation management of keys and data, the keys are stored in the UKey, and the physical chip is used to protect the keys, which greatly reduces the risk of key leakage and improves the security of data. At the same time, the encrypted image file data in a unified format can be seamlessly used between different platforms, with higher flexibility and convenience.

[0097] Reference Figure 6 , Figure 6 This is a structural block diagram of the first embodiment of the virtual disk encryption device based on Ukey of the present invention.

[0098] like Figure 6 As shown, the virtual disk encryption device based on Ukey proposed in an embodiment of the present invention includes:

[0099] The request receiving module 10 is used to receive a virtual disk partition creation request after detecting that the Ukey is connected;

[0100] A partition creation module 20, configured to create a virtual disk partition based on the virtual disk partition creation request;

[0101] A file generation module 30, configured to generate a blank image file based on the input file information, and write a preset file content structure into the blank image file to obtain a first image file, wherein the file information includes an image file name, an image file path, and an image file size;

[0102] The certificate acquisition module 40 is used to derive the encryption certificate from the connected Ukey;

[0103] A key generation module 50, for generating a symmetric encryption key using a secure random number generator;

[0104] A file encryption module 60, configured to encrypt the symmetric encryption key based on the encryption certificate, and write the encrypted information obtained after encryption into the first image file to obtain a second image file;

[0105] The file encryption module 60 is used to mount the second image file to the file system using the disk drive corresponding to the virtual disk partition for formatting, and after the file system is formatted, decrypt the symmetric encryption key from the second image file, and use the symmetric encryption key to encrypt the formatted file data in the file system to obtain ciphertext data;

[0106] The file generation module 30 is used to write the ciphertext data into the second image file to generate an encrypted disk image file.

[0107] In this embodiment, after detecting the access of Ukey, a virtual disk partition creation request is received; a virtual disk partition is created based on the virtual disk partition creation request; a blank image file is generated based on the input file information, and a preset file content structure is written into the blank image file to obtain a first image file; an encryption certificate is derived from the connected Ukey; a symmetric encryption key is generated using a secure random number generator; the symmetric encryption key is encrypted based on the encryption certificate, and the encrypted information obtained after encryption is written into the first image file to obtain a second image file; the second image file is mounted to the file system for formatting using the disk drive corresponding to the virtual disk partition, and after the file system is formatted, the symmetric encryption key is decrypted from the second image file, and the formatted file data in the file system is encrypted using the symmetric encryption key to obtain ciphertext data; the ciphertext data is written into the second image file to generate an encrypted disk image file, and the UKey device is used to realize the separation management of keys and data, the keys are stored in the UKey, and the physical chip is used to protect the keys, which greatly reduces the risk of key leakage and improves the security of data. At the same time, the encrypted image file data in a unified format can be seamlessly used between different platforms, with higher flexibility and convenience.

[0108] In some embodiments, the file encryption module 60 is used to determine the encryption algorithm corresponding to the encryption certificate;

[0109] If the encryption algorithm is the SM2 encryption algorithm, the symmetric encryption key is encrypted using the SM2 asymmetric encryption algorithm, and after the encryption is completed, the asymmetric encryption algorithm parameters, the length of the asymmetric encryption algorithm parameters, the symmetric encryption key and the associated parameters, and the length of the symmetric encryption key and the associated parameters are written into the first image file, wherein the encryption structure of the symmetric encryption key includes a 16-byte key, a 4-byte counter occupancy, and a 32-byte formatting vector.

[0110] In some embodiments, the file generation module 30 is used to fill the isolation band in the second image file, and the isolation band size is 1024 bytes;

[0111] The ciphertext data is filled after the isolation band.

[0112] In some embodiments, the device further comprises a determination module and a file decryption module;

[0113] The judging module is used to judge whether the Ukey is accessed for the first time;

[0114] The partition creation module 20 is used to execute the step of receiving a virtual disk partition creation request if it is the first access;

[0115] The file decryption module is used to decrypt the stored encrypted disk image file to obtain the decrypted file data if it is not the first access;

[0116] The file encryption module 60 is used to receive a write request, update the decrypted file data based on the write request, and re-encrypt the updated file data.

[0117] In some embodiments, the file decryption module is used to receive an input image file path and a virtual disk partition to be mounted;

[0118] Obtaining the stored encrypted disk image file according to the image file path;

[0119] Mapping the stored encrypted disk image file to the virtual disk partition, and performing format parsing and conversion on the encrypted data in the stored encrypted disk image file to obtain structured format data;

[0120] Receiving a read request, and acquiring a certificate key pair matching the Ukey through the virtual disk partition based on the read request;

[0121] The structured format data is decrypted based on the certificate key to obtain decrypted file data.

[0122] In some embodiments, the apparatus further comprises a verification module;

[0123] The verification module is used to obtain the header information of the stored encrypted disk image file;

[0124] Verifying the stored encrypted disk image file based on the header information;

[0125] The file decryption module is used to execute the step of mapping the stored encrypted disk image file to the virtual disk partition if the verification passes;

[0126] Accordingly, the device further includes an alarm reminder module:

[0127] The alarm reminder module is used to remind the user that the file data decryption loading fails if the certificate key pair matching the Ukey is not obtained, or the obtained certificate key pair does not match the Ukey.

[0128] In some embodiments, the file encryption module 60 is used to obtain the corresponding symmetric encryption key and updated file information based on the write request;

[0129] updating the decrypted file data based on the updated file information;

[0130] Encrypting the updated file data based on the symmetric encryption key to obtain new ciphertext data;

[0131] The new ciphertext data is formatted and stored to obtain an updated encrypted disk image file.

[0132] An embodiment of the present application also provides a virtual disk encryption device based on Ukey, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus, and the memory is used to store a virtual disk encryption program based on Ukey; the processor is used to implement the above-mentioned virtual disk encryption method based on Ukey when executing the program stored in the memory.

[0133] The communication bus mentioned in the Ukey-based virtual disk encryption device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0134] The communication interface is used for communication between the above-mentioned Ukey-based virtual disk encryption device and other devices.

[0135] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0136] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, and discrete hardware components.

[0137] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0138] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0139] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0140] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0141] It should be understood that the above is only an example and does not constitute any limitation on the technical solution of the present invention. In specific applications, technicians in this field can make settings as needed, and the present invention does not limit this.

[0142] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.

[0143] In addition, for technical details not described in detail in this embodiment, please refer to the Ukey-based virtual disk encryption method provided in any embodiment of the present invention, which will not be repeated here.

[0144] In addition, it should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0145] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0146] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0147] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0148] It is understandable that the system provided by the embodiment of the present invention corresponds to the method provided by the embodiment of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts in the above method.

Claims

1. A virtual disk encryption method based on Ukey, characterized in that: The virtual disk encryption method based on Ukey includes: After detecting the Ukey access, receive the virtual disk partition creation request; Creating a virtual disk partition based on the virtual disk partition creation request; Generate a blank image file based on the input file information, and write a preset file content structure into the blank image file to obtain a first image file, wherein the file information includes an image file name, an image file path, and an image file size; Export the encryption certificate from the connected Ukey; Generate symmetric encryption keys using a secure random number generator; Encrypting the symmetric encryption key based on the encryption certificate, and writing the encrypted information obtained after encryption into the first image file to obtain a second image file; Mounting the second image file to the file system using the disk drive corresponding to the virtual disk partition for formatting, and after the file system is formatted, decrypting the symmetric encryption key from the second image file, and encrypting the formatted file data in the file system using the symmetric encryption key to obtain ciphertext data; The ciphertext data is written into the second image file to generate an encrypted disk image file.

2. The virtual disk encryption method based on Ukey as claimed in claim 1, characterized in that: The encrypting the symmetric encryption key based on the encryption certificate and writing the encrypted information obtained after encryption into the first image file includes: Determining an encryption algorithm corresponding to the encryption certificate; If the encryption algorithm is the SM2 encryption algorithm, the symmetric encryption key is encrypted using the SM2 asymmetric encryption algorithm, and after the encryption is completed, the asymmetric encryption algorithm parameters, the length of the asymmetric encryption algorithm parameters, the symmetric encryption key and the associated parameters, and the length of the symmetric encryption key and the associated parameters are written into the first image file, wherein the encryption structure of the symmetric encryption key includes a 16-byte key, a 4-byte counter occupancy, and a 32-byte formatting vector.

3. The virtual disk encryption method based on Ukey as claimed in claim 1, characterized in that: The step of writing the ciphertext data into the second image file comprises: Filling an isolation band in the second image file, wherein the size of the isolation band is 1024 bytes; The ciphertext data is filled after the isolation band.

4. The virtual disk encryption method based on Ukey as claimed in claim 1, characterized in that: The method further comprises: Determine whether the Ukey is accessed for the first time; If it is the first access, the step of receiving the virtual disk partition creation request is executed; If it is not the first access, the stored encrypted disk image file is decrypted to obtain the decrypted file data; A write request is received, the decrypted file data is updated based on the write request, and the updated file data is re-encrypted.

5. The Ukey-based virtual disk encryption method according to claim 4, characterized in that: Decrypting the stored encrypted disk image file includes: Receive the input image file path and the virtual disk partition to be mounted; Obtaining the stored encrypted disk image file according to the image file path; Mapping the stored encrypted disk image file to the virtual disk partition, and performing format parsing and conversion on the encrypted data in the stored encrypted disk image file to obtain structured format data; Receiving a read request, and acquiring a certificate key pair matching the Ukey through the virtual disk partition based on the read request; The structured format data is decrypted based on the certificate key to obtain decrypted file data.

6. The virtual disk encryption method based on Ukey as claimed in claim 5, characterized in that: The method further comprises: Obtaining header information of the stored encrypted disk image file; Verifying the stored encrypted disk image file based on the header information; If the verification passes, the step of mapping the stored encrypted disk image file to the virtual disk partition is performed; Accordingly, the method further comprises: If the certificate key pair matching the Ukey is not obtained, or the obtained certificate key pair does not match the Ukey, the user is reminded that the file data decryption loading failed.

7. The virtual disk encryption method based on Ukey as claimed in claim 5, characterized in that: The updating of the decrypted file data based on the write request and re-encrypting the updated file data includes: Acquire a corresponding symmetric encryption key and updated file information based on the write request; updating the decrypted file data based on the updated file information; Encrypting the updated file data based on the symmetric encryption key to obtain new ciphertext data; The new ciphertext data is formatted and stored to obtain an updated encrypted disk image file.

8. A virtual disk encryption device based on Ukey, characterized in that: The Ukey-based virtual disk encryption device includes: The request receiving module is used to receive a virtual disk partition creation request after detecting that the Ukey is connected; A partition creation module, used to create a virtual disk partition based on the virtual disk partition creation request; A file generation module, configured to generate a blank image file based on input file information, and write a preset file content structure into the blank image file to obtain a first image file, wherein the file information includes an image file name, an image file path, and an image file size; The certificate acquisition module is used to export the encryption certificate from the connected Ukey; A key generation module, used to generate symmetric encryption keys using a secure random number generator; A file encryption module, used for encrypting the symmetric encryption key based on the encryption certificate, and writing the encrypted information obtained after encryption into the first image file to obtain a second image file; The file encryption module is used to mount the second image file to a file system using a disk drive corresponding to the virtual disk partition for formatting, and after the file system is formatted, decrypt the symmetric encryption key from the second image file, and use the symmetric encryption key to encrypt the formatted file data in the file system to obtain ciphertext data; The file generation module is used to write the ciphertext data into the second image file to generate an encrypted disk image file.

9. The virtual disk encryption device based on Ukey as claimed in claim 8, characterized in that: The file encryption module is used to determine the encryption algorithm corresponding to the encryption certificate; If the encryption algorithm is the SM2 encryption algorithm, the symmetric encryption key is encrypted using the SM2 asymmetric encryption algorithm, and after the encryption is completed, the asymmetric encryption algorithm parameters, the length of the asymmetric encryption algorithm parameters, the symmetric encryption key and the associated parameters, and the length of the symmetric encryption key and the associated parameters are written into the first image file, wherein the encryption structure of the symmetric encryption key includes a 16-byte key, a 4-byte counter occupancy, and a 32-byte formatting vector.

10. The virtual disk encryption device based on Ukey as claimed in claim 8, characterized in that: The file generation module is used to fill the isolation zone in the second image file, and the size of the isolation zone is 1024 bytes; The ciphertext data is filled after the isolation band.

Images