File access system and method, electronic device, storage medium and program product

Abstract

The invention provides a file access system and method, electronic equipment, a storage medium and a program product, and belongs to the technical field of computers, and the system comprises a sending module which creates a file object corresponding to an access request based on the access request of an application program, and sends the file object to a file filtering driving module, the access request comprises an identifier of a to-be-accessed file; the file filtering driving module is used for determining a target cache region accessed by the access request according to the permission type of the application program, the identifier of the to-be-accessed file and a first section of object pointer and a second section of object pointer associated with a file object in the stream context information; and the encryption and decryption module is used for determining an encryption and decryption strategy for the to-be-accessed file in the target cache region based on the permission type of the application program and the type of the access request. The method and the device are used for solving the problem of how to stably and conveniently realize secure encryption and decryption caching of enterprise data.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a file access system, a file access method, an electronic device, a machine-readable storage medium, and a computer program product. Background Art

[0002] In the modern business environment, companies often need to store large amounts of sensitive data, including customer information, financial data, technical information, etc. Protecting this data from unauthorized access is crucial to avoid data leaks and potential legal liabilities.

[0003] Traditionally, caching methods involve refreshing and clearing the cache between authorized and unauthorized processes, ensuring that unauthorized processes cannot see the plaintext in the cache. However, this leads to significant system instability. Later, the Layered File System Driver (FSD) emerged, implementing dual caching by designing a separate layered file system and creating two FCBs (File Control Blocks). However, the amount of code required to implement this is almost the same as implementing a single file system driver. Furthermore, Windows file systems are not open source and therefore cannot be universally used. Therefore, the question of how to stably and conveniently implement encryption and decryption caching for enterprise data security has become a pressing technical challenge. Summary of the Invention

[0004] The purpose of the embodiments of the present invention is to provide a file access system, a file access method, an electronic device, a machine-readable storage medium and a computer program product to solve the problem of how to stably and conveniently implement encryption and decryption caching for enterprise data security.

[0005] To achieve the above objectives, an embodiment of the present invention provides a file access system, comprising:

[0006] a sending module, which creates a file object corresponding to the access request based on an access request of an application program, and sends the file object to a file filtering driver module, wherein the access request includes an identifier of a file to be accessed;

[0007] A file filtering driver module determines a target cache area to be accessed by the access request according to the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information;

[0008] an encryption and decryption module, which determines an encryption and decryption strategy for the to-be-accessed file in the target cache area based on the permission type of the application and the type of the access request;

[0009] The first section object pointer points to the cache in the plaintext cache area, and the second section object pointer points to the cache in the ciphertext cache area.

[0010] Optionally, determining the target cache area to be accessed by the access request based on the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information includes:

[0011] When the permission type of the application is an authorized process and the identifier of the file to be accessed indicates that plaintext data is to be accessed, the file filter driver module determines that the access request performs a cache access to the plaintext cache area based on the first section object pointer.

[0012] Optionally, determining the target cache area to be accessed by the access request based on the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information includes:

[0013] When the permission type of the application is unauthorized process and the identifier of the file to be accessed indicates that ciphertext data is to be accessed, the file filter driver module determines that the access request performs cache access to the ciphertext cache area based on the second section object pointer.

[0014] Optionally, the first section object pointer and the second section object pointer are created by the following steps:

[0015] In the case of creating the file to be accessed, creating a ciphertext buffer area on the file filter driver module and storing the second section object pointer in the stream context information;

[0016] When reading the file to be accessed, the cache manager module creates a plaintext cache area and stores the first section object pointer in the stream context information.

[0017] Optionally, determining an encryption and decryption strategy for the to-be-accessed file in the target cache area based on the permission type of the application and the type of the access request includes:

[0018] When the permission type of the application is an authorized process, the type of the access request is a read request, and the target cache area is a plaintext cache area, the encryption and decryption module decrypts the file to be accessed in the plaintext cache area;

[0019] When the permission type of the application is an authorized process, the type of the access request is a write request, and the target cache area is a plaintext cache area, the encryption and decryption module decrypts the file to be accessed in the plaintext cache area, and the encryption and decryption module encrypts the data stream after data is written to the file to be accessed in the plaintext cache area.

[0020] Optionally, determining an encryption and decryption strategy for the to-be-accessed file in the target cache area based on the permission type of the application and the type of the access request includes:

[0021] In the case that the permission type of the application is an unauthorized process, the type of the access request is a read request or a write request, and the target buffer area is a ciphertext buffer area, the encryption and decryption module does not process the file to be accessed.

[0022] On the other hand, an embodiment of the present invention further provides a file access method, comprising:

[0023] Creating a file object corresponding to the access request based on an access request of an application program, and sending the file object to a file filtering driver module, wherein the access request includes an identifier of a file to be accessed;

[0024] The file filter driver module determines the target buffer area to be accessed by the access request according to the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information;

[0025] The encryption and decryption module determines an encryption and decryption strategy for the file to be accessed in the target cache area based on the permission type of the application and the type of the access request;

[0026] The first section object pointer points to the cache in the plaintext cache area, and the second section object pointer points to the cache in the ciphertext cache area.

[0027] On the other hand, the present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned file access method when executing the program.

[0028] On the other hand, the present invention further provides a machine-readable storage medium having a computer program stored thereon, which implements the above-mentioned file access method when executed by a processor.

[0029] On the other hand, the present invention further provides a computer program product, comprising a computer program, wherein the computer program implements the above-mentioned file access method when executed by a processor.

[0030] Through the above technical solution, the embodiment of the present invention determines the target cache area to be accessed by the access request based on the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information through the file filtering driver module; and determines the encryption and decryption strategy for the file to be accessed in the target cache area based on the permission type of the application and the type of the access request through the encryption and decryption module. Thus, the present invention implements transparent encryption and decryption of double cache through the first section object pointer and the second section object pointer. Compared with the traditional method of refreshing and clearing the cache between the authorized process and the unauthorized process, and creating two FCBs to implement the double cache function, the file access system provided by the embodiment of the present invention can stably and conveniently implement encryption and decryption caching for enterprise data security.

[0031] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following detailed description, they are used to explain the embodiments of the present invention, but do not constitute a limitation of the embodiments of the present invention. In the accompanying drawings:

[0033] Figure 1 is a schematic diagram of a file access system provided by the present invention;

[0034] Figure 2 This is a flow chart of the application initiating a cache read operation provided by the present invention;

[0035] Figure 3 This is one of the schematic diagrams comparing the technical concepts of the present invention and the traditional method;

[0036] Figure 4 This is a schematic diagram of the file object pointing process provided by the present invention;

[0037] Figure 5 This is the second schematic diagram comparing the technical concepts of the present invention and the traditional method;

[0038] Figure 6 It is a schematic diagram of the process of creating a double buffer provided by the present invention;

[0039] Figure 7 It is a schematic diagram of the data in the plaintext buffer area and the ciphertext buffer area provided by the present invention being out of sync;

[0040] Figure 8 This is one of the flowcharts of the file access method provided by the present invention;

[0041] Figure 9This is the second flowchart of the file access method provided by the present invention;

[0042] Figure 10 This is the third flowchart of the file access method provided by the present invention;

[0043] Figure 11 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0044] The following describes the specific implementation of the embodiment of the present invention in detail with reference to the accompanying drawings. It should be understood that the specific implementation described herein is only used to illustrate and explain the embodiment of the present invention and is not used to limit the embodiment of the present invention.

[0045] The cache is a block of memory maintained jointly by the cache manager and the memory manager. After an authorized process performs a cache read, the cache contains plaintext. If an unauthorized process attempts a cache read, it will also read plaintext, which is clearly incorrect. One approach is to flush and clear the cache between the two processes, but such frequent cache operations often lead to system instability. Another approach is to maintain two caches using two file control blocks (FCBs), but this approach is cumbersome.

[0046] In view of this, embodiments of the present invention provide a file access system, a file access method, an electronic device, a machine-readable storage medium, and a computer program product to solve the problem of how to stably and conveniently implement encryption and decryption caching for enterprise data security.

[0047] System Example

[0048] Please refer to Figure 1 An embodiment of the present invention provides a file access system, which includes a sending module 10, a file filtering driver module 20 and an encryption and decryption module 30.

[0049] The sending module 10 creates a file object corresponding to the access request based on the access request of the application program, and sends the file object to the file filtering driver module 20 , wherein the access request includes an identifier of the file to be accessed.

[0050] When a user creates an access request for a file to be accessed in an application (e.g., a text editor), the sending module 10 interacts with the file through a file object provided by the operating system (e.g., Windows) (e.g., the object returned by the open() function in Python) and sends the file object to the file filtering driver module 20. The file object encapsulates parameters such as the file path and read / write permissions of the file to be accessed, and provides specific operations such as the read() and write() functions. The identifier of the file to be accessed can be the file ID of the file to be accessed or the file path of the file to be accessed.

[0051] The file filter driver module 20 determines the target cache area for the access request according to the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information.

[0052] In an embodiment of the present invention, the file filter driver module 20 serves as a discriminator for determining the target cache area for an access request. Application permissions include authorized and unauthorized processes. In one embodiment, a ciphertext cache area can be established in the file microfilter driver module of the file filter driver module 20, and a plaintext cache area can be established in the cache manager module of the original file system driver. The ciphertext cache area corresponds to a second section object pointer, and the plaintext cache area corresponds to a first section object pointer. The first section object pointer points to the cache in the plaintext cache area, and the second section object pointer points to the cache in the ciphertext cache area. The first and second section object pointers are stored in the stream context information of the file filter driver module 20. The stream context information stores the first and second section object pointers corresponding to the identifier of the file to be accessed. In this embodiment of the present invention, authorized processes use the plaintext cache area, while unauthorized processes use the ciphertext cache area. That is, authorized processes access the cache in the plaintext cache area using the first section object pointer, while unauthorized processes access the cache in the plaintext cache area using the second section object pointer. This effectively elevates the traditional FCB approach to use two FileObjects. The amount of code is very small, and the functions implemented are exactly the same.

[0053] The encryption and decryption module 30 determines an encryption and decryption strategy for the file to be accessed in the target cache area based on the permission type of the application and the type of the access request.

[0054] The types of access requests include read requests, write requests, and create requests. A read request may include a file information query request. The encryption / decryption module 30 of this embodiment of the present invention can determine an encryption / decryption strategy for the file to be accessed in the target cache based on the permission type of the application and the type of the access request.

[0055] In one embodiment, determining an encryption and decryption strategy for a file to be accessed in the target cache based on the permission type of the application and the type of the access request includes:

[0056] When the permission type of the application is an authorized process, the type of the access request is a read request, and the target cache is a plaintext cache, the encryption / decryption module 30 decrypts the file to be accessed in the plaintext cache;

[0057] When the permission type of the application is an authorized process, the type of the access request is a write request, and the target cache area is a plaintext cache area, the encryption and decryption module 30 decrypts the file to be accessed in the plaintext cache area, and the encryption and decryption module 30 encrypts the data stream after data is written to the file to be accessed in the plaintext cache area.

[0058] The data of the file to be accessed, whether in the plaintext or ciphertext buffer, is ciphertext data. If the application's permission type is authorized process, the access request type is a read request or a write request, and the target buffer is a plaintext buffer, the encryption / decryption module 30 will first decrypt the file to be accessed in the plaintext buffer. If the access request type is a read request, the decrypted file to be accessed is directly read; if the access request type is a write request, the encryption / decryption module 30 will encrypt the data stream after the data is written to the file to be accessed in the plaintext buffer.

[0059] In another embodiment, the encryption and decryption strategy for the file to be accessed in the target cache area is determined based on the permission type of the application and the type of the access request, including: when the permission type of the application is an unauthorized process, the type of the access request is a read request or a write request, and the target cache area is a ciphertext cache area, the encryption and decryption module 30 does not process the file to be accessed.

[0060] When the permission type of the application is unauthorized process and the type of the access request is a read request or a write request, in the embodiment of the present invention, the unauthorized process uses the ciphertext buffer area to access, and no matter whether the access request is a read request or a write request, the encryption / decryption module 30 does not process the file to be accessed in the ciphertext buffer area, thereby preventing the unauthorized process from reading the file to be accessed and modifying the file to be accessed.

[0061] The embodiment of the present invention determines the target cache area to be accessed by the access request according to the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information through the file filtering driver module 20; and determines the encryption and decryption strategy for the file to be accessed in the target cache area based on the permission type of the application and the type of the access request through the encryption and decryption module 30. Therefore, the present invention realizes transparent encryption and decryption of double cache through the first section object pointer and the second section object pointer. Compared with the traditional method of refreshing and clearing the cache between the authorized process and the unauthorized process, and creating two fcb (file control block) to realize the double cache function, the embodiment of the present invention stably and conveniently realizes the encryption and decryption cache for enterprise data security.

[0062] In other aspects of the embodiment of the present invention, the technical idea of ​​the embodiment of the present invention to realize the double buffering function based on the first section object pointer and the second section object pointer is as follows: Figure 2 The file microfilter driver module, also known as the Minifilter, is a component within the Windows operating system file system and is managed uniformly by the Filter Manager (file filter driver module 20). By registering the events it wants to monitor in the file microfilter driver module, it can filter IRP requests sent by the IO manager to the file system driver, including create (Create), read operations (Read), and write operations (Write). This operation is a cache read operation initiated by the application. At this time, the cache has not yet been established, so the IRP is established by the IO manager and sent to the file system driver (referred to as the file system driver) through the file microfilter driver module. The file system driver then establishes the cache. The cache manager module and the memory manager module collaborate to initiate a non-cached paged read operation (arrow 6). This request is encapsulated into an IRP by the IO manager and sent again to the file system driver through the file microfilter driver module. The file system driver reads the file from the disk (arrows 7, 8, and 9), and then gradually returns. As can be seen, each time an IRP is sent from the IO manager to the file system driver, it enters the file microfilter driver module once. When it returns from the file system driver to the IO manager, it also enters the file microfilter driver module. In read operations, the former is called PreRead and the latter is called PostRead.

[0063] Please refer to Figure 3Because IRP requests repeatedly enter the file microfilter driver module, the present invention employs a different approach. This approach allocates a separate block of memory to the cache structure within the FileObject. This private cache structure is then used to create a ciphertext cache area within the file microfilter driver module. A plaintext cache area is then created within the original file system driver's cache manager module. Authorized processes use the plaintext cache area, while unauthorized processes use the ciphertext cache area. This effectively elevates the original FCB concept to use two file objects (a plaintext file object and a ciphertext file object). This approach requires minimal code and achieves identical functionality.

[0064] There are two key fields in the file object (FileObject) structure, FsContext and SectionObjectPointer (section object pointer). FsContext1 points to fcb (file control block), SectionObjectPointer points to the file mapping in the cache manager module, and fcb (FsContext2) also points to SectionObjectPointer. Therefore, the flowchart is as follows Figure 4As shown. FileObject->PrivateCacheMap and FileObject->SectionObjectPointer are the cache-related parts of FileObject. SectionObjectPointer is a pointer to a NonPagedPool (non-paged memory) allocated by the lookaside list in fcb. This memory is shared by all FileObjects (file objects) of a file, which also means that all FileObjects of the same file use one cache. DataSectionObject and SharedCacheMap of SectionObjectPointer are two pointers used by file cache. DataSectionObject is ControlArea, which is the part where the memory manager module manages the cache. SharedCacheMap is the part where the cache manager module manages the cache. PrivateCacheMap is private to each file object, and stores the history of the file object's read operations, providing the pre-read position and pre-read length for the Read Ahead algorithm. It does not store the actual cache. The embodiment of the present invention does not need to consider PrivateCacheMap, because the memory it points to is either a pre-prepared memory in FileObject->SectionObjectPointer->SharedCacheMap, or newly allocated memory by the cache manager module, and then inserted into the PrivateList linked list corresponding to SharedCacheMap. That is, PrivateCacheMap and SharedCacheMap have a many-to-one correspondence. Because the embodiment of the present invention starts processing the file object in PostCreate, the PrivateCacheMap is not established at this time. As long as the embodiment of the present invention replaces the SectionObjectPointer (section object pointer) before the cache is established, the PrivateCacheMap corresponds to the ShadowSectionObjectPointer (pointer to the ciphertext cache area) established later by the embodiment of the present invention.

[0065] Because the file system driver is implemented to take performance into consideration, the file cache is not created when it is created, but when it is read or written. It is judged by whether the SectionObjectPointer and PrivateCacheMap of the FileObject are empty. In one embodiment, the first section object pointer (plaintext section object pointer) and the second section object pointer (ciphertext section object pointer) are created by the following steps: when creating a file to be accessed, a ciphertext cache area is created on the file filter driver module 20 (such as a file micro-filter driver module) and the second section object pointer is stored in the stream context information; when reading a file to be accessed, the cache manager module creates a plaintext cache area and stores the first section object pointer in the stream context information. Please refer to Figure 5 The embodiment of the present invention implements a double buffering function through a first section object pointer (plaintext section object pointer) and a second section object pointer (ciphertext section object pointer).

[0066] Specifically, the embodiment of the present invention first creates a cache for a file when creating, which actually creates a second section object pointer (SectionObjectPointer, that is, a pointer to a section object, storing the address of the section object in the memory). This cache can be used as plain text or as cipher text depending on the needs. For example, in the embodiment of the present invention, this cache is used as a cipher text cache. Then the embodiment of the present invention saves the second section object pointer of this cache into the context of the file filter driver module 20. After the embodiment of the present invention creates this cache, the embodiment of the present invention actually continues to deceive the file system driver to make the file system driver think that the cache has not been created. Therefore, the file system driver will also create a cache when reading and writing, and create a corresponding first section object pointer. In fact, this process of creating a new cache can be said to be transparent to the file system. Double cache creation is as follows. Figure 6 As shown below.

[0067] After establishing dual buffering, one issue is distinguishing between authorized processes and allocated buffers. This embodiment of the present invention creates a new cache during create time, which naturally also determines the authorized process during create time, replacing the cache within the file object. The technical solution of this application is to use a plaintext buffer for authorized processes and a ciphertext buffer for unauthorized processes.

[0068] Specifically, the file filtering driver module 20 determines the target cache area for access by the access request based on the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information, including: when the permission type of the application is an authorized process and the identifier of the file to be accessed indicates that plaintext data is to be accessed, the file filtering driver module 20 determines that the access request performs cache access to the plaintext cache area based on the first section object pointer.

[0069] Among them, if the identifier of the file to be accessed includes a confidentiality tag of the file attribute, it indicates that ciphertext data is to be accessed; otherwise, if the identifier of the file to be accessed does not include a confidentiality tag of the file attribute, it indicates that plaintext data is to be accessed. In the case where the permission type of the application is an authorized process, and the identifier of the file to be accessed indicates that plaintext data is to be accessed, based on the technical idea of ​​the authorized process using the plaintext cache, the file filtering driver module 20 determines that the access request performs cache access to the plaintext cache based on the first section object pointer. Subsequently, in the case where the permission type of the application is an authorized process, the type of the access request is a read request or a write request, and the target cache is a plaintext cache, the encryption and decryption module 30 will perform decryption on the file to be accessed in the plaintext cache. If the type of the access request is a read request, the decrypted file to be accessed is directly read at this time; if the type of the access request is a write request, the encryption and decryption module 30 will perform encryption on the data stream after the data is written to the file to be accessed in the plaintext cache.

[0070] In other aspects of the embodiments of the present invention, the file filter driver determines the target cache area for the access request based on the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information, including: when the permission type of the application is an unauthorized process and the identifier of the file to be accessed indicates that ciphertext data is to be accessed, the file filter driver module 20 determines that the access request performs cache access to the ciphertext cache area based on the second section object pointer.

[0071] If the application's permission type is unauthorized process, and the identifier of the file to be accessed indicates that ciphertext data is to be accessed, the unauthorized process uses the technical concept of the ciphertext cache, and the file filtering driver module 20 determines that the access request is to cache access to the ciphertext cache based on the second section object pointer. Subsequently, if the application's permission type is unauthorized process, and the access request is a read request or a write request, since the unauthorized process uses the ciphertext cache for access in this embodiment of the present invention, the encryption / decryption module 30 does not process the file to be accessed, regardless of whether the access request is a read request or a write request. This prevents the unauthorized process from reading or modifying the file to be accessed.

[0072] Please refer to Figure 7 It should be noted that in the embodiment of the present invention, the plaintext cache area and the ciphertext cache area will not perform data synchronization.

[0073] Therefore, the embodiment of the present invention implements dual caching based on the first section object pointer and the second section object pointer. The authorized process and the unauthorized process use the plaintext cache and the ciphertext cache respectively. The authorized process is allowed to modify the plaintext cache, and the unauthorized process is not allowed to modify the ciphertext cache. By providing a plaintext cache area for the authorized process and a ciphertext cache area for the unauthorized process, transparent management of the data status is achieved. Users and applications do not need to know whether the file is in an encrypted or decrypted state, and automatic management of the data status is achieved. The embodiment of the present invention realizes automatic encryption and decryption of files. This means that users and applications do not need to manually intervene in the encryption and decryption process and can use files as usual.

[0074] In other aspects of the embodiment of the present invention, the embodiment of the present invention uses StreamContext to store the encryption information and file header identifier of the file during runtime, and stores the decryption information required for the file in the 4KB header of the file. The encryption algorithm of the encryption and decryption module 30 of the embodiment of the present invention can use the AES-128ECB mode, and use the ciphertext stealing method to deal with the problem of padding required for plaintext with misaligned block sizes. By adopting the block cipher algorithm AES-128ECB mode and introducing ciphertext stealing padding, the confidentiality and integrity of the data can be ensured. The embodiment of the present invention can protect data from unauthorized access and tampering.

[0075] In other aspects of this embodiment of the present invention, Write and Read operations utilize SwapBuffers for transparent encryption and decryption. This embodiment utilizes a reentry mechanism for privileged file encryption and decryption, allowing the file microfilter driver module to reenter its own encryption or decryption code, enabling the driver to encrypt and decrypt files. Furthermore, to accommodate complex files such as Office files, special processing is performed during FileRenameInformation. This allows for automatic encryption and decryption of files such as docx, doc, pptx, ppt, xlsx, and xls that are read and written using the tmp file rename method. Regarding process control and protection, a doubly linked list is used to store process policies and register related process callback functions. The integrity of authorized process code segments (.text segments) is also periodically scanned to achieve process control and protection. Special processing is implemented for Office files to accommodate common office document formats. User-defined special file processing is also supported. The system also registers process callbacks to verify the integrity of process code segments, providing additional control and protection for processes.

[0076] In other aspects of the embodiments of the present invention, the embodiments of the present invention copy the authorized process normally and copy the unauthorized process normally. If the encrypted file is opened by an authorized process, other processes are not allowed to overwrite (drag and drop), which is also the mechanism of the Windows operating system; if it is not opened by an authorized process, then overwriting (drag and drop) is allowed. Because each software will implement some of its own file operations, such as whether the same file is synchronized when opened and edited by different software at the same time. Therefore, the software that needs to be focused on needs to be adapted separately. The clipboard is made using the user layer, and you can choose the system monitoring API recommended by Windows or process injection.

[0077] The file access system according to the embodiment of the present invention has the following advantages:

[0078] System compatibility: This dual-cache design is easy to implement, with cache mapping managed by the system. There is no need to modify the file system (such as NTFS, Ext4), and it is naturally compatible with various storage architectures.

[0079] Read and write performance: Relying on the operating system's preset cache scheduling algorithm (such as LRU, Least Recently Used) to reduce kernel-user mode switching overhead, the measured IO throughput increased by 15% to 20%.

[0080] Security isolation: Dynamically switch DataSectionObject mapping through process-level permission verification (MD5 / HASH). Unauthorized processes can only access the ciphertext cache, avoiding memory dump attacks.

[0081] Data synchronization: Utilize the operating system's native cache refresh mechanism (such as Flush Buffer) to ensure real-time synchronization of encrypted data stored on disk and plaintext in memory, thus avoiding the risk of Office temporary file leakage.

[0082] Convenience and Automation: Enterprises can easily deploy this system. Administrators can configure different basic policies, encryption and decryption policies, control policies, and scheduled tasks based on computing groups or authenticated users. This enables customized and precise enterprise management and control. Once a file is modified, the system automatically performs encryption operations to protect data security without requiring additional user intervention.

[0083] Method Example

[0084] Please refer to Figure 8 , an embodiment of the present invention further provides a file access method, comprising:

[0085] Step 100: Create a file object corresponding to the access request based on an access request of an application program, and send the file object to the file filter driver module 20. The access request includes an identifier of a file to be accessed.

[0086] When a user creates an access request for a file in an application (e.g., a text editor), the sending module 10 interacts with the file through a file object provided by the operating system (e.g., the object returned by the open() function in Python) and sends the file object to the file filtering driver module 20. The file object encapsulates parameters such as the file path and read / write permissions of the file to be accessed, and provides specific operations such as the read() and write() functions. The identifier of the file to be accessed can be the file ID or the file path of the file to be accessed.

[0087] Step 200: The file filter driver module 20 determines the target cache area for the access request based on the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information.

[0088] In one embodiment, a ciphertext cache area can be established in the file microfilter driver module of the file filter driver module 20, and a plaintext cache area can be established in the cache manager module of the original file system driver. The ciphertext cache area corresponds to a second section object pointer, and the plaintext cache area corresponds to a first section object pointer. The first section object pointer points to the cache in the plaintext cache area, and the second section object pointer points to the cache in the ciphertext cache area. The first section object pointer and the second section object pointer are stored in the stream context information of the file filter driver module 20. The stream context information stores the first section object pointer and the second section object pointer corresponding to the identifier of the file to be accessed. In this embodiment of the present invention, authorized processes use the plaintext cache area, while unauthorized processes use the ciphertext cache area. That is, authorized processes use the first section object pointer to point to the cache in the plaintext cache area for access, while unauthorized processes use the second section object pointer to point to the cache in the plaintext cache area for access. This effectively elevates the traditional FCB approach to a higher level, using two FileObjects (file objects). This approach requires minimal code and achieves identical functionality.

[0089] Specifically, the first section object pointer and the second section object pointer are created by the following steps:

[0090] In the case of creating the file to be accessed, creating a ciphertext buffer area on the file filter driver module 20 and storing the second section object pointer in the stream context information;

[0091] When reading the file to be accessed, the cache manager module creates a plaintext cache area and stores the first section object pointer in the stream context information.

[0092] The embodiment of the present invention first creates a cache for a file when creating, which actually creates a second section object pointer (SectionObjectPointer, i.e., a pointer to a section object, storing the address of the section object in the memory). This cache can be used as plaintext or as ciphertext depending on the needs. For example, in the embodiment of the present invention, this cache is used as a ciphertext cache. Then the embodiment of the present invention saves the second section object pointer of this cache into the context of the file filter driver module 20. After the embodiment of the present invention creates this cache, the embodiment of the present invention actually continues to deceive the file system driver to make the file system driver think that the cache has not been created. Therefore, the file system driver will also create a cache when reading and writing, and create a corresponding first section object pointer. In fact, this process of creating a new cache can be said to be transparent to the file system.

[0093] In another embodiment, the file filter driver module 20 determines the target cache area for access by the access request based on the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information, including: when the permission type of the application is an authorized process and the identifier of the file to be accessed indicates that plaintext data is to be accessed, the file filter driver module 20 determines that the access request performs cache access to the plaintext cache area based on the first section object pointer.

[0094] If the identifier of the file to be accessed includes a confidentiality tag of the file attribute, it indicates that ciphertext data is to be accessed; otherwise, if the identifier of the file to be accessed does not include a confidentiality tag of the file attribute, it indicates that plaintext data is to be accessed. If the permission type of the application is an authorized process and the identifier of the file to be accessed indicates that plaintext data is to be accessed, based on the technical concept of using a plaintext cache area for an authorized process, the file filtering driver module 20 determines that the access request is to cache access to the plaintext cache area based on the first section object pointer.

[0095] In other aspects of the embodiments of the present invention, the file filter driver determines the target cache area for the access request based on the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information, including: when the permission type of the application is an unauthorized process and the identifier of the file to be accessed indicates that ciphertext data is to be accessed, the file filter driver module 20 determines that the access request performs cache access to the ciphertext cache area based on the second section object pointer.

[0096] When the permission type of the application is an unauthorized process and the identifier of the file to be accessed indicates that ciphertext data needs to be accessed, the unauthorized process uses the technical idea of ​​the ciphertext cache area, and the file filtering driver module 20 determines that the access request performs cache access to the ciphertext cache area based on the second section object pointer.

[0097] Step 300: The encryption / decryption module 30 determines an encryption / decryption strategy for the file to be accessed in the target cache based on the permission type of the application and the type of the access request.

[0098] In one embodiment, the encryption / decryption module 30 determines an encryption / decryption strategy for the to-be-accessed file in the target cache based on the permission type of the application and the type of the access request, including:

[0099] When the permission type of the application is an authorized process, the type of the access request is a read request, and the target cache is a plaintext cache, the encryption / decryption module 30 decrypts the file to be accessed in the plaintext cache;

[0100] When the permission type of the application is an authorized process, the type of the access request is a write request, and the target cache area is a plaintext cache area, the encryption and decryption module 30 decrypts the file to be accessed in the plaintext cache area, and the encryption and decryption module 30 encrypts the data stream after data is written to the file to be accessed in the plaintext cache area.

[0101] The data of the file to be accessed, whether in the plaintext or ciphertext buffer, is ciphertext data. If the application's permission type is authorized process, the access request type is a read request or a write request, and the target buffer is a plaintext buffer, the encryption / decryption module 30 will first decrypt the file to be accessed in the plaintext buffer. If the access request type is a read request, the decrypted file to be accessed is directly read; if the access request type is a write request, the encryption / decryption module 30 will encrypt the data stream after the data is written to the file to be accessed in the plaintext buffer.

[0102] In another embodiment, determining the encryption and decryption strategy for the to-be-accessed file in the target cache based on the permission type of the application and the type of the access request includes:

[0103] When the permission type of the application is unauthorized process, the type of the access request is a read request or a write request, and the target buffer is a ciphertext buffer, the encryption / decryption module 30 does not process the file to be accessed.

[0104] If the application's permission type is unauthorized process and the access request type is a read request or a write request, and the unauthorized process uses the ciphertext buffer to access the file, the encryption / decryption module 30 will not process the file to be accessed, regardless of whether the access request is a read request or a write request. This prevents the unauthorized process from reading or modifying the file to be accessed.

[0105] The present invention implements transparent double-buffered encryption and decryption through first- and second-section object pointers. Compared to traditional methods that require flushing and clearing the cache between authorized and unauthorized processes and creating two file control blocks (FCBs), this embodiment of the present invention stably and conveniently implements secure encryption and decryption caching for enterprise data.

[0106] For other aspects of the present invention, please refer to Figure 9The logic of authorizing process IO to read files is implemented through the following steps:

[0107] In step 1, when the authorization process calls the Win32 API application programming interface to read a file, the Win32 API sends a read request to the file filter driver module 20. The read request carries an identifier of the file to be read. The identifier of the file to be read can be a file ID or a file path. Of course, those skilled in the art understand that the identifier is not limited thereto.

[0108] Step 2: The file filter driver module 20 decrypts and reads the plaintext data from the plaintext buffer according to the current authorization process, the identifier of the file to be read, and the first section object pointer and the second section object pointer associated with the file object in the stream context information.

[0109] Step 3: The cache manager module obtains the corresponding file content data from the memory mapping list.

[0110] Step 4: If the file is not mapped, the IO manager generates a page fault and sends a non-cached paged IO operation.

[0111] Step 5: Cache read request to open the encrypted file and read the encrypted data.

[0112] Step 6: The system file system decrypts and reads the ciphertext data from the ciphertext buffer.

[0113] Step 7: The cache management obtains the corresponding file content data from the memory mapping list.

[0114] Step 8: If the file is not mapped, the IO manager generates a page fault.

[0115] Step 9: The non-cached read request is directly sent to the original file system.

[0116] Step 10: Non-cached read request reads disk file data.

[0117] Step 11: Return the disk file data.

[0118] Step 12: Return the encrypted data.

[0119] Step 13: Return the memory-mapped ciphertext data.

[0120] Step 14: Return the encrypted data to the ciphertext buffer.

[0121] Step 15: The system file system receives the encrypted data.

[0122] Step 16: Return the encrypted data read from the cache to the file filtering driver module 20.

[0123] Step 17: The decrypted plaintext data is written into the mapped memory.

[0124] Step 18: Return the memory read request of the plaintext buffer area.

[0125] Step 19: Complete the read request of the plaintext buffer area.

[0126] Step 20: Return the plaintext data to the application.

[0127] For other aspects of the present invention, please refer to Figure 10 The logic of authorizing process IO to write files is implemented through the following steps:

[0128] Step 1: When the authorization process calls the Win32 API application programming interface to write a file, the Win32 API sends a write request to the file filter driver module 20. The write request carries the identifier of the file to be written. The identifier of the file to be written can be a file ID or a file path, but is not limited thereto.

[0129] Step 2: The file filter driver decrypts and writes the plaintext data into the plaintext buffer area according to the current authorization process, the identifier of the file to be written, and the first section object pointer and the second section object pointer associated with the file object in the stream context information.

[0130] Step 3: The cache manager searches for the corresponding file content mapping in the memory mapping list.

[0131] Step 4: If the file is not mapped, the IO manager generates a page fault and sends a non-cached paged IO operation.

[0132] Step 5: Cache write request to open the encrypted file.

[0133] Step 6: The system file system reads the ciphertext data from the ciphertext buffer.

[0134] Step 7: The cache management obtains the corresponding file content data from the memory mapping list.

[0135] Step 8: If the file is not mapped, the IO manager generates a page fault.

[0136] Step 9: The non-cached write request is directly sent to the original file system.

[0137] Step 10: Non-cached write request to read disk file data.

[0138] Step 11: Return the disk file data.

[0139] Step 12: Return the encrypted data read from the disk.

[0140] Step 13: The encrypted data is returned to the cache of the NTFS (New Technology File System).

[0141] Step 14: Return the encrypted data to the ciphertext buffer.

[0142] Step 15: The system file system receives the encrypted data.

[0143] Step 16: Return the encrypted data read from the NTFS cache to the file filter driver module 20.

[0144] Step 17: The decrypted plaintext data is written into the mapped memory.

[0145] Step 18: Return the memory write request of the plaintext buffer area.

[0146] Step 19: Complete the write request of the plaintext buffer area and modify the plaintext data.

[0147] Step 20 , returning the modified plaintext data to the application, and the encryption / decryption module 30 encrypts the data stream after the data of the file to be written in the plaintext buffer is written.

[0148] The dual-buffered transparent encryption and decryption system in this embodiment not only provides advanced data protection but also offers exceptional convenience in data use, offering businesses and organizations a more secure and efficient way to manage data while ensuring the privacy and integrity of sensitive data. This innovative technology elevates data security to a new level, providing businesses with a reliable data protection solution.

[0149] Figure 11 An example of a physical structure diagram of an electronic device is shown below. Figure 11As shown, the electronic device may include: a processor 1110, a communication interface 1120, a memory 1130, and a communication bus 1140, wherein the processor 1110, the communication interface 1120, and the memory 1130 communicate with each other via the communication bus 1140. The processor 1110 may call logic instructions in the memory 1130 to execute a file access method, the method comprising: creating a file object corresponding to the access request based on an access request of an application, and sending the file object to a file filter driver module, wherein the access request includes an identifier of the file to be accessed; the file filter driver module determines a target cache area to be accessed by the access request based on the permission type of the application, the identifier of the file to be accessed, and a first section object pointer and a second section object pointer associated with the file object in the stream context information; and an encryption / decryption module determines an encryption / decryption strategy for the file to be accessed in the target cache area based on the permission type of the application and the type of the access request; wherein the first section object pointer points to a cache in a plaintext cache area, and the second section object pointer points to a cache in a ciphertext cache area.

[0150] In addition, the logic instructions in the above-mentioned memory 1130 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0151] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a machine-readable storage medium. When the computer program is executed by a processor, the computer can execute a file access method, which includes: creating a file object corresponding to the access request based on an access request of an application, and sending the file object to a file filtering driver module, wherein the access request includes an identifier of the file to be accessed; the file filtering driver module determines the target cache area accessed by the access request based on the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information; the encryption and decryption module determines the encryption and decryption strategy for the file to be accessed in the target cache area based on the permission type of the application and the type of the access request; wherein the first section object pointer points to the cache of the plaintext cache area, and the second section object pointer points to the cache of the ciphertext cache area.

[0152] On the other hand, the present invention also provides a machine-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute a file access method, the method comprising: creating a file object corresponding to the access request based on an access request of an application, and sending the file object to a file filtering driver module, wherein the access request includes an identifier of the file to be accessed; the file filtering driver module determines the target cache area accessed by the access request based on the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information; the encryption and decryption module determines the encryption and decryption strategy for the file to be accessed in the target cache area based on the permission type of the application and the type of the access request; wherein the first section object pointer points to the cache of the plaintext cache area, and the second section object pointer points to the cache of the ciphertext cache area.

[0153] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0154] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0155] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A file access system, characterized in that: include: a sending module, which creates a file object corresponding to the access request based on an access request of an application program, and sends the file object to a file filtering driver module, wherein the access request includes an identifier of a file to be accessed; A file filtering driver module determines a target cache area to be accessed by the access request according to the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information; an encryption and decryption module, which determines an encryption and decryption strategy for the to-be-accessed file in the target cache area based on the permission type of the application and the type of the access request; The first section object pointer points to the cache in the plaintext cache area, and the second section object pointer points to the cache in the ciphertext cache area.

2. The file access system according to claim 1, wherein: The step of determining a target cache area for access by the access request according to the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information includes: When the permission type of the application is an authorized process and the identifier of the file to be accessed indicates that plaintext data is to be accessed, the file filter driver module determines that the access request performs a cache access to the plaintext cache area based on the first section object pointer.

3. The file access system according to claim 1, wherein: The step of determining a target cache area for access by the access request according to the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information includes: When the permission type of the application is unauthorized process and the identifier of the file to be accessed indicates that ciphertext data is to be accessed, the file filter driver module determines that the access request performs cache access to the ciphertext cache area based on the second section object pointer.

4. The file access system according to claim 2 or 3, characterized in that: The first section object pointer and the second section object pointer are created by the following steps: In the case of creating the file to be accessed, creating a ciphertext buffer area on the file filter driver module and storing the second section object pointer in the stream context information; When reading the file to be accessed, the cache manager module creates a plaintext cache area and stores the first section object pointer in the stream context information.

5. The file access system according to claim 1, wherein: The determining of an encryption and decryption strategy for the to-be-accessed file in the target cache area based on the permission type of the application and the type of the access request includes: When the permission type of the application is an authorized process, the type of the access request is a read request, and the target cache area is a plaintext cache area, the encryption and decryption module decrypts the file to be accessed in the plaintext cache area; When the permission type of the application is an authorized process, the type of the access request is a write request, and the target cache area is a plaintext cache area, the encryption and decryption module decrypts the file to be accessed in the plaintext cache area, and the encryption and decryption module encrypts the data stream after data is written to the file to be accessed in the plaintext cache area.

6. The file access system according to claim 1, wherein: The determining of an encryption and decryption strategy for the to-be-accessed file in the target cache area based on the permission type of the application and the type of the access request includes: In the case that the permission type of the application is an unauthorized process, the type of the access request is a read request or a write request, and the target buffer area is a ciphertext buffer area, the encryption and decryption module does not process the file to be accessed.

7. A file access method, characterized in that: include: Creating a file object corresponding to the access request based on an access request of an application program, and sending the file object to a file filtering driver module, wherein the access request includes an identifier of a file to be accessed; The file filter driver module determines the target buffer area to be accessed by the access request according to the permission type of the application, the identifier of the file to be accessed, and the first section object pointer and the second section object pointer associated with the file object in the stream context information; The encryption and decryption module determines an encryption and decryption strategy for the file to be accessed in the target cache area based on the permission type of the application and the type of the access request; The first section object pointer points to the cache in the plaintext cache area, and the second section object pointer points to the cache in the ciphertext cache area.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the file access method according to claim 7 is implemented.

9. A machine-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the file access method according to claim 7 is implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the file access method according to claim 7 is implemented.

Images