An operating system kernel security encryption method based on AES algorithm

Abstract

This invention discloses a secure encryption method for the operating system kernel based on the AES algorithm, relating to the fields of operating system security and data encryption technology. The method comprises the following steps: S1, traversing and scanning the data in the operating system kernel, identifying sensitive data, and classifying it according to its sensitivity level; S2, generating an encryption master key and hierarchical subkeys based on the AES algorithm; S3, encrypting data of different sensitivity levels using AES encryption algorithms with different rounds and encryption modes; S4, dynamically updating the key and encrypting and storing the updated key in the kernel secure storage area; S5, adding a checksum to the encrypted sensitive data and verifying data integrity; S6, reading the corresponding key and decrypting the data to complete data access. This invention significantly improves key security and data integrity, effectively balances encryption efficiency and system performance, has strong adaptability and high practicality, and is easy to promote and apply.

Description

Technical Field

[0001] This invention relates to the field of operating system security and data encryption technology, and in particular to an operating system kernel security encryption method based on the AES algorithm. Background Technology

[0002] The operating system kernel is the core component of the entire computer system, undertaking critical tasks such as hardware resource management, memory allocation, process scheduling, and data storage. Its security performance directly determines the security level of the entire computer system. With the rapid development of digital technology, operating system kernels in various sensitive data processing fields store a large amount of core sensitive information. Once this data is leaked or tampered with, it will cause serious privacy breaches, property losses, and even affect the normal operation of related businesses.

[0003] Currently, operating system kernel encryption protection mostly uses the traditional AES encryption algorithm. This method has many technical defects in practical applications: First, the key generation method is singular, often using fixed keys or simple random generation modes, which are vulnerable to brute-force attacks, linear attacks, or integral attacks, resulting in weak anti-attack capabilities. Second, the encryption strategy lacks specificity, failing to take into account the special characteristics of kernel data and using the same encryption method for sensitive and ordinary data, leading to low encryption efficiency and affecting system performance. Third, there is a lack of a sound dynamic key update mechanism, making keys prone to leakage if they remain unchanged for a long time, and the integrity verification of encrypted data is insufficient, making it impossible to detect data tampering in a timely manner. Fourth, it has poor adaptability, making it difficult to balance encryption strength and system response speed, and failing to meet the dual requirements of data security and real-time performance in various sensitive fields.

[0004] AES (Advanced Encryption Standard), as the most widely used symmetric encryption algorithm, supports key lengths of 128, 192, and 256 bits. It encrypts data through multiple rounds of encryption steps, including SubBytes, ShiftRows, MixColumns, and AddRoundKey. However, traditional AES algorithms do not fully consider the access characteristics of operating system kernel data and the actual needs of sensitive domains, thus limiting their security and practicality. Therefore, there is an urgent need for an improved AES-based operating system kernel security encryption method to address the aforementioned technical shortcomings and enhance the security, efficiency, and adaptability of kernel encryption. Summary of the Invention

[0005] The purpose of this invention is to propose a secure encryption method for operating system kernels based on the AES algorithm. By optimizing the key generation mechanism, dividing encryption levels, adding a dynamic update mechanism and integrity verification, this invention solves the problems of low key security, insufficient encryption efficiency, lack of dynamic updates and integrity verification in existing AES encryption methods for operating system kernels. This achieves high-security and high-efficiency encryption of kernel data, meeting the special data protection needs of various sensitive fields.

[0006] To achieve the above objectives, this invention proposes a secure encryption method for the operating system kernel based on the AES algorithm, the specific steps of which are as follows: Step S1: Perform a traversal scan of the data in the operating system kernel, identify sensitive data, and classify it into three categories according to the data sensitivity level: core sensitive data, general sensitive data, and ordinary data. Step S2: Combining kernel hardware information, system timestamp, and random number, generate encryption master key and hierarchical subkeys based on the AES algorithm; Step S3: For data with different sensitivity levels, use AES encryption algorithms with different rounds and encryption modes for encryption; Step S4: Based on the system operating status and preset cycle, dynamically update the key and encrypt and store the updated key in the kernel secure storage area; Step S5: Add a verification code to the encrypted sensitive data and verify the data integrity using a hash algorithm; Step S6: Verify the access subject's permissions. After the permission verification is passed, read the corresponding key and decrypt the data to complete the data access.

[0007] Preferably, in step S1, the identification of sensitive data adopts the feature matching method. By using a preset sensitive data feature library, the kernel data is traversed and matched with the feature library to identify sensitive data. The core sensitive data includes core business data and privacy data. General sensitive data includes system configuration parameters, user permission information, and process scheduling logs. Ordinary data includes kernel redundant data and temporary cache data.

[0008] Preferably, in step S2, an encryption master key and hierarchical subkeys are generated based on the improved AES algorithm, and the specific steps are as follows: Step S21: Collect kernel hardware information, including CPU serial number and hard disk physical address, and perform hash processing on the hardware information to obtain hardware feature value H; Step S22: Obtain the current system timestamp T and generate a random number R (R∈[0,2)). 128 )); Step S23: Generate an encryption master key based on the hardware feature value H, timestamp T, and random number R. The formula is as follows: ; in, XOR operation; SHA-256 is a hash algorithm. This indicates that AES-128 encryption is performed using H as the key and R as the plaintext. Step S24, based on the master key Generate hierarchical subkeys The formula is as follows: ; in, RotL This is a circular left shift operation. CRC32 This is a cyclic redundancy check (CRC) algorithm; 8 indicates a cyclic left shift of 8 bits; master key. 256-bit hierarchical subkey It has 128 bits.

[0009] Preferably, in step S3, the specific steps of hierarchical AES encryption are as follows: Step S31: Core sensitive data is encrypted using the AES-256 algorithm combined with CBC mode, with 14 rounds of encryption. An improved column hybrid transformation is used during the encryption process; the improved column hybrid transformation formula is as follows: ; in, After column hybrid transformation, the state matrix of the first... x The output vector of the column, For polynomial coefficients, Before column mixing transformation, the state matrix is... x The input vector of the column, For modulo operation, This is a circular right shift operation; Step S32: Generally sensitive data is encrypted using the AES-128 algorithm combined with CTR mode, with 10 encryption rounds. During encryption, an improved byte substitution operation S-box is used, optimized through optimal affine transformation and inverse multiplication. The improved S-box transformation formula is as follows: ; in, For byte data output after passing through the improved S-box, For the finite field GF(2) 8 Multiplicative inverse on ) x for S Input byte data before box transformation Affine Represents the optimal affine transformation. Random (0 x 01,0 xFF ) indicates generating 0 x 01 to 0 xFFA random number between the given numbers is then XORed with the given number. Step S33: Ordinary data is not encrypted and is directly stored in the kernel's ordinary storage area.

[0010] Preferably, in step S4, the specific steps for dynamically updating the key are as follows: Step S41: Preset key update cycle Meanwhile, the system's operating status is monitored in real time. When abnormal access occurs, the number of times the key is used reaches a threshold, or the time reaches the update cycle, the key is updated. Step S42: Generate a new master key according to the method in step S2. and hierarchical subkeys ; Step S43: Use the RSA-2048 asymmetric encryption algorithm to encrypt the new key with the preset public key, as shown in the following formula: ; in, The key after RSA-2048 encryption. For the newly generated keys, including the master key and hierarchical subkeys ; For public keys; Step S44: Store the encrypted new key in the kernel secure storage area, and delete the old key to complete the key update.

[0011] Preferably, in step S5, the specific steps for verifying data integrity are as follows: Step S51: Perform a hash operation on the encrypted sensitive data C to generate a verification code. The formula for generating the verification code is as follows: ; in, The timestamp used when the data was encrypted; Step S52: Transfer the verification code Stored together with encrypted data C; Step S53: When accessing encrypted data is required, recalculate the checksum of the read encrypted data C. ,contrast With storage If the two are consistent, the data is complete; if they are inconsistent, the data is determined to have been tampered with, triggering an abnormal alarm mechanism and prohibiting access to the data.

[0012] Preferably, in step S6, the specific steps are as follows: Step S61: Obtain the identity information and permission level of the access subject, and verify the legality and scope of permission of the access subject; Step S62: If the accessing entity has administrator privileges, it can access all encrypted data and read the master key. and hierarchical subkeys The data is decrypted using the inverse operation of the corresponding AES algorithm; if the accessing entity has ordinary permissions, it can only access general sensitive data and read the hierarchical subkey. Decrypt generally sensitive data; Step S63: After decryption, the data is temporarily loaded into memory. After access is completed, the plaintext data and key in memory are immediately cleared to prevent data leakage.

[0013] Preferably, the operating system includes Linux, Windows Server, or Unix, and is compatible with existing hardware implementations of the AES algorithm, requiring no modification to existing hardware.

[0014] Preferably, in step S1, the preset sensitive data feature library is dynamically updated according to the actual application scenario, supports the addition and deletion of sensitive data features, and the update process adopts an encrypted transmission method.

[0015] Preferably, in step S6, the access subject's permission level is divided into multiple levels, with different permission levels corresponding to different encrypted data access ranges. The division of permission levels is customized according to actual system requirements, and the permission change process requires multiple approvals from the administrator.

[0016] Therefore, this invention proposes a secure encryption method for the operating system kernel based on the AES algorithm, which has the following advantages: (1) The present invention adopts an improved key generation mechanism that combines kernel hardware information, system timestamp and random number, which avoids the problem that traditional fixed keys or simple random keys are easy to crack. At the same time, through the design of master key and hierarchical sub-key, hierarchical key management is realized, which further improves key security and can effectively resist common encryption attack methods such as linear attack and integral attack. (2) This invention classifies kernel data and uses different rounds and modes of AES encryption algorithm for data with different sensitivity levels, avoiding the system performance loss caused by using high-strength encryption for all data. Under the premise of ensuring the security of core sensitive data, it improves the system operating efficiency and is suitable for various sensitive scenarios with high real-time requirements. (3) The key dynamic update mechanism of the present invention can prevent the risk of leakage caused by long-term use of the key, and the integrity verification can detect data tampering behavior in a timely manner, improve the security and reliability of encrypted data, and meet the strict requirements of various sensitive data for integrity and confidentiality. (4) This invention can be widely applied to kernel encryption of various operating systems such as Linux, Windows Server, and Unix. It is suitable for various sensitive data processing fields and can effectively protect core sensitive data. It solves the problem of mismatch between encryption methods and sensitive field requirements in the existing technology. At the same time, it is compatible with the hardware implementation of the existing AES algorithm. No modification of existing hardware is required, which facilitates its promotion and application.

[0017] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating an operating system kernel security encryption method based on the AES algorithm in an embodiment of the present invention. Figure 2 This is a comparative diagram of encryption efficiency in embodiments of the present invention; Figure 3 This is a comparative diagram of anti-attack capabilities in embodiments of the present invention. Detailed Implementation

[0019] To make the technical solutions, advantages, and objectives of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below. The described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention without creative effort are within the protection scope of the present invention.

[0020] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains.

[0021] Example 1 The application scenario of this implementation case is a hospital information system (HIS system). The system uses the Linux CentOS 8 operating system with kernel version 5.14.0. The server configuration is as follows: CPU is Intel Xeon E3-1230 v6 (4 cores and 8 threads), memory is 16GB, and hard disk is 1TB SSD. It is mainly used to store patient personal information, medical records, medical expenses, drug management and other data. Among them, patient ID number, core medical data, and medical expense details are core sensitive data, system configuration parameters and user permission information are general sensitive data, and kernel temporary cache and redundant logs are ordinary data.

[0022] In this implementation case, the preset sensitive data feature database includes features such as patient ID number (18 digits), keywords in medical records (such as "diagnosis result" and "medical orders"), and keywords in medical expenses (such as "amount" and "payment"). The key update cycle is set to 24 hours, and the key usage threshold is set to 1000 times. The RSA-2048 public key is preset as a dedicated public key for the hospital information system, and the private key is stored in an offline security device. The hash algorithm used is SHA-256 and SHA-512, and the cyclic redundancy check uses CRC32.

[0023] like Figure 1 As shown, this invention provides a secure encryption method for the operating system kernel based on the AES algorithm, with the following specific steps: Step S1: Perform a traversal scan of the data in the operating system kernel, identify sensitive data, and classify it.

[0024] Using feature matching, all data in the Linux operating system kernel is traversed and matched against a pre-defined sensitive data feature library to identify sensitive data, which is then categorized according to its sensitivity level. Core sensitive data: patient ID number (e.g., 410105XXX1234), medical records (e.g., "Patient XXX, male, 35 years old, diagnosed with hypertension, prescribed nifedipine sustained-release tablets"), medical expense details (e.g., "outpatient payment amount, payment time"), a total of 10,000 core sensitive data records were collected, with each record ranging from 128 to 512 bytes in size; General sensitive data: system configuration parameters (such as database connection address and port number), user permission information (such as administrator account and permission range of ordinary medical staff), a total of 2,000 general sensitive data were collected, with the size of a single data item ranging from 64 to 128 bytes; Regular data: Kernel temporary cache data and redundant logs, a total of 5,000 regular data entries were collected, with each data entry ranging from 32 to 64 bytes in size.

[0025] Step 2: Combining kernel hardware information, system timestamps, and random numbers, generate an encryption master key and hierarchical subkeys based on the AES algorithm; Step S21: Collect kernel hardware information. The CPU serial number is BFEBFBFF000806EC, and the hard disk physical address is 00:1B:21:8D:6A:E0. Perform SHA-256 hash processing on the hardware information to obtain the hardware feature value. H=7a2f9d4e8b1c3e5f0a6b7d8e9f0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c; Step S22: Obtain the current system timestamp T and generate a random number: R=0x1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d; Step S23: Generate an encryption master key based on the hardware feature value H, timestamp T, and random number R. The formula is as follows: ; The calculation yielded: =2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b (256 bits); Step S24, based on the master key Generate hierarchical subkeys The formula is as follows: ; Calculated =3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e (128-bit).

[0026] Step S3: For data with different sensitivity levels, use AES encryption algorithms with different rounds and encryption modes for encryption; Step S31: Core sensitive data is encrypted using the AES-256 algorithm combined with CBC mode, with 14 rounds of encryption. An improved column hybrid transformation is used. Taking a patient's medical record (plaintext: "Patient XXX, male, 35 years old, diagnosed with hypertension, prescribed nifedipine sustained-release tablets", size 256 bytes) as an example, the encryption process is as follows: 1. Divide the plaintext into 16-byte blocks (16 blocks in total), and initialize the initialization vector as follows: IV=0x0102030405060708090a0b0c0d0e0f10; 2. After the first plaintext block is XORed with the IV, 14 rounds of AES-256 encryption are performed. Each round includes byte substitution (SubBytes), row shifting (ShiftRows), improved column mixing (MixColumns), and round key addition (AddRoundKey). The improved column mixing transformation follows the formula... implement; 3. After each subsequent plaintext block is XORed with the previous ciphertext block, the same 14 rounds of encryption operations are performed to finally obtain the ciphertext: C1=0x1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f0a1b2c3d4e5f6a7b8c9d0e1f2a3b... (256 bytes); Step S32: Generally sensitive data is encrypted using the AES-128 algorithm combined with CTR mode, with 10 rounds of encryption. An improved S-box transformation is used. Taking a system configuration parameter (plaintext: "database connection address: 192.168.1.100, port number: 3306", size 96 bytes) as an example, the encryption process is as follows: 1. Generate a counting sequence: T1=0x00000000000000000000000000000001, T2=0x000000000000000000000000000000002, ... T6=0x00000000000000000000000000000006; 2. Using hierarchical subkeys Each counting sequence is encrypted using AES-128 to obtain a pseudo-random code block; 3. XOR the plaintext block with the corresponding pseudo-random code block to obtain the ciphertext: C2=0x3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d... (96 bytes); Step S33: Ordinary data is not encrypted and is directly stored in the kernel's ordinary storage area.

[0027] Step S4: Based on the system operating status and preset cycle, dynamically update the key and encrypt and store the updated key in the kernel secure storage area; Step S41: The preset key update cycle is 24 hours. When 24 hours have elapsed, the key update is triggered. Step S42: Following the method in step S2, re-collect the hardware feature value H', timestamp T', and random number R' to generate a new master key. and hierarchical subkeys ; Step S43: Encrypt the new key using the RSA-2048 public key P to obtain the encrypted key E(K); Step S44: Store E(K) in the kernel secure storage area and delete the old key to complete the key update.

[0028] Step S5: Add a verification code to the encrypted sensitive data and verify the data integrity using a hash algorithm; Step S51: Perform a hash operation on the encrypted core sensitive data C1 to generate a verification code. : ; The calculation yielded: =8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f; Step S52, to Stored together with C1; Step S53: When medical staff access the medical record, they read the encrypted data C1 and recalculate the checksum. ,contrast and If both are consistent, the data is deemed complete and access is allowed; if one byte of C1' is manually modified, the data is recalculated. ,and Inconsistency triggers an error alert and access is denied.

[0029] Step S6: Verify the access subject's permissions. After the permission verification is passed, read the corresponding key and decrypt the data to complete the data access. S61. Medical staff log in to the hospital information system with their account and password. The system verifies their identity information and permission level (ordinary medical staff, permission level 2). S62. Ordinary medical staff can only access generally sensitive data; the system reads the hierarchical subkey from the kernel secure storage area. The encrypted data C2 of general sensitive data is decrypted using AES-128 CTR mode to obtain plaintext data for medical staff to view; if the administrator logs in (privilege level 1), they can read the master key and hierarchical subkeys to decrypt all encrypted data. S63. After the access is completed, the system immediately clears the plaintext data and key from the memory to prevent data leakage.

[0030] To verify the implementation effect of this embodiment, the traditional AES-128 encryption method and the traditional AES-256 encryption method in the prior art were selected as comparison objects. The tests were conducted from five dimensions: encryption efficiency, decryption efficiency, anti-attack capability, data integrity, and system performance loss. The test data consisted of 10,000 core sensitive data and 2,000 general sensitive data. The test results are shown in Table 1.

[0031] Table 1. Comparison of performance indicators between the present invention and traditional encryption methods.

[0032] From Table 1 and Figures 2-3As can be seen, the method of this invention has significant improvements in all core indicators compared with existing traditional AES encryption methods: encryption efficiency is improved by 14.7% compared with traditional AES-128 encryption and by 57.6% compared with traditional AES-256 encryption; decryption efficiency is improved by 15.3% compared with traditional AES-128 encryption and by 56.0% compared with traditional AES-256 encryption; the anti-attack capability is greatly enhanced, and the cracking difficulty is more than 6 times higher than that of traditional AES-256 encryption, which can effectively resist various attack methods such as brute force cracking, linear attacks, and integral attacks; the data integrity tampering detection rate reaches 100%, which is improved by 12.1% compared with traditional AES-128 encryption and by 9.3% compared with traditional AES-256 encryption; the system performance loss is significantly reduced, and the CPU utilization rate is reduced by 33.2% compared with traditional AES-128 encryption and by 50.6% compared with traditional AES-256 encryption, achieving a synergistic improvement in security, efficiency, and system adaptability.

[0033] It is worth noting that all contents not described in detail in this invention are existing technologies and are well known to those skilled in the art.

[0034] Therefore, this invention provides an operating system kernel security encryption method based on the AES algorithm. Through the design of improved key generation, hierarchical encryption, dynamic key update and integrity verification, it significantly improves key security and data integrity, effectively balances encryption efficiency and system performance, has strong adaptability and high practicality, and can be widely used in fields involving various sensitive data, making it easy to promote and apply.

[0035] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A secure encryption method for operating system kernels based on the AES algorithm, characterized in that, The steps are as follows: Step S1: Perform a traversal scan of the data in the operating system kernel, identify sensitive data, and classify it into three categories according to the data sensitivity level: core sensitive data, general sensitive data, and ordinary data. Step S2: Combining kernel hardware information, system timestamp, and random number, generate encryption master key and hierarchical subkeys based on the improved AES algorithm; Step S3: For data with different sensitivity levels, use AES encryption algorithms with different rounds and encryption modes for encryption; Step S4: Based on the system operating status and preset cycle, dynamically update the key and encrypt and store the updated key in the kernel secure storage area; Step S5: Add a verification code to the encrypted sensitive data and verify the data integrity using a hash algorithm; Step S6: Verify the access subject's permissions. After the permission verification is passed, read the corresponding key and decrypt the data to complete the data access.

2. The operating system kernel security encryption method based on the AES algorithm according to claim 1, characterized in that, In step S1, the identification of sensitive data adopts the feature matching method. By using a preset sensitive data feature library, the kernel data is traversed and matched with the feature library to identify sensitive data. The core sensitive data includes core business data and privacy data. General sensitive data includes system configuration parameters, user permission information, and process scheduling logs. Ordinary data includes kernel redundant data and temporary cache data.

3. The operating system kernel security encryption method based on the AES algorithm according to claim 2, characterized in that, In step S2, an encryption master key and hierarchical subkeys are generated based on the improved AES algorithm. The specific steps are as follows: Step S21: Collect kernel hardware information, including CPU serial number and hard disk physical address, and perform hash processing on the hardware information to obtain hardware feature value H; Step S22: Obtain the current system timestamp T and generate a random number R (R∈[0,2)). 128 )); Step S23: Generate an encryption master key based on the hardware feature value H, timestamp T, and random number R. The formula is as follows: ； in, XOR operation; SHA-256 is a hash algorithm. This indicates that AES-128 encryption is performed using H as the key and R as the plaintext. Step S24, based on the master key Generate hierarchical subkeys The formula is as follows: ； in, RotL This is a circular left shift operation. CRC32 This is a cyclic redundancy check (CRC) algorithm; 8 indicates a cyclic left shift of 8 bits; master key. 256-bit hierarchical subkey It has 128 bits.

4. The operating system kernel security encryption method based on the AES algorithm according to claim 3, characterized in that, In step S3, the specific steps of hierarchical AES encryption are as follows: Step S31: Core sensitive data is encrypted using the AES-256 algorithm combined with CBC mode, with 14 rounds of encryption. An improved column hybrid transformation is used during the encryption process; the improved column hybrid transformation formula is as follows: ； in, After column hybrid transformation, the state matrix of the th order is... x The output vector of the column, For polynomial coefficients, Before column mixing transformation, the state matrix is... x The input vector of the column, For modulo operation, This is a circular right shift operation; Step S32: Generally sensitive data is encrypted using the AES-128 algorithm combined with CTR mode, with 10 encryption rounds. During encryption, an improved byte substitution operation S-box is used, optimized through optimal affine transformation and inverse multiplication. The improved S-box transformation formula is as follows: ； in, For byte data output after passing through the improved S-box, For the finite field GF(2) 8 Multiplicative inverse on ) x for S Input byte data before box transformation Affine Represents the optimal affine transformation. Random (0 x 01,0 xFF ) indicates generating 0 x 01 to 0 xFF A random number between the two numbers is then XORed. Step S33: Ordinary data is not encrypted and is directly stored in the kernel's ordinary storage area.

5. A method for secure encryption of operating system kernels based on the AES algorithm according to claim 4, characterized in that, In step S4, the specific steps for dynamically updating the key are as follows: Step S41: Preset key update cycle Meanwhile, the system's operating status is monitored in real time. When abnormal access occurs, the number of times the key is used reaches a threshold, or the time reaches the update cycle, the key is updated. Step S42: Generate a new master key according to the method in step S2. and hierarchical subkeys ; Step S43: Use the RSA-2048 asymmetric encryption algorithm to encrypt the new key with the preset public key, as shown in the following formula: ； in, The key after RSA-2048 encryption. For the newly generated keys, including the master key and hierarchical subkeys ; For public keys; Step S44: Store the encrypted new key in the kernel secure storage area, and delete the old key to complete the key update.

6. The operating system kernel security encryption method based on the AES algorithm according to claim 5, characterized in that, In step S5, the specific steps for verifying data integrity are as follows: Step S51: Perform a hash operation on the encrypted sensitive data C to generate a verification code. The formula for generating the verification code is as follows: ； in, The timestamp used when the data was encrypted; Step S52: Transfer the verification code Stored together with encrypted data C; Step S53: When accessing encrypted data is required, recalculate the checksum of the read encrypted data C. ,contrast With storage If the two are consistent, the data is complete; if they are inconsistent, the data is determined to have been tampered with, triggering an abnormal alarm mechanism and prohibiting access to the data.

7. A method for secure encryption of operating system kernels based on the AES algorithm according to claim 6, characterized in that, In step S6, the specific steps are as follows: Step S61: Obtain the identity information and permission level of the access subject, and verify the legality and scope of permission of the access subject; Step S62: If the accessing entity has administrator privileges, it can access all encrypted data and read the master key. and hierarchical subkeys The data is decrypted using the inverse operation of the corresponding AES algorithm; if the accessing entity has ordinary permissions, it can only access general sensitive data and read the hierarchical subkey. Decrypt generally sensitive data; Step S63: After decryption, the data is temporarily loaded into memory. After access is completed, the plaintext data and key in memory are immediately cleared to prevent data leakage.

8. The operating system kernel security encryption method based on the AES algorithm according to claim 1, characterized in that, Operating systems include Linux, Windows Server, and Unix, and are compatible with existing hardware implementations of the AES algorithm, requiring no modification to existing hardware.

9. A method for secure encryption of operating system kernels based on the AES algorithm according to claim 1, characterized in that, In step S1, the preset sensitive data feature library is dynamically updated according to the actual application scenario, supporting the addition and deletion of sensitive data features, and the update process adopts an encrypted transmission method.

10. A method for secure encryption of operating system kernels based on the AES algorithm according to claim 1, characterized in that, In step S6, the access subject's permission level is divided into multiple levels. Different permission levels correspond to different encrypted data access ranges. The permission level division is customized according to the actual system requirements, and the permission change process requires multiple approvals from the administrator.

Images