A method, system and device for data encryption and decryption

Abstract

The present application discloses a method for data encryption and decryption, including: monitoring the memory-mapped file creation operation initiated by an application, and allocating virtual memory of the same size as the memory-mapped file; using a vectored exception handler to modify the protection attribute of the virtual memory to a readable and writable state; decrypting the encrypted data located at the location of the data to be processed, and writing the decrypted data into the virtual memory, so that the application can read the data in the virtual memory. The present application determines the data processing type of the application and the location of the data to be processed by processing the memory protection exception, thereby realizing transparent encryption and decryption of files. Compared with the prior art, the present application has low complexity and is easier to implement, which greatly reduces the software development cost and improves the stability of transparent encryption and decryption of files. The present application also provides a system, device and readable storage medium for data encryption and decryption, which have the above-mentioned beneficial effects.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a method, system, device and readable storage medium for data encryption and decryption. Background Art

[0002] Transparent file encryption and decryption means that the application can access the encrypted files normally without changing the usage mode, that is, the encryption and decryption operation is imperceptible to the application. At present, the vast majority of transparent file encryption and decryption products on the market are implemented based on file filter drivers. Since the development of file filter drivers is more difficult than that of general applications and the level of practitioners is uneven, the reliability of such products has always been less than ideal. Moreover, the file filter driver is installed in the operating system kernel, and once an exception occurs, it will affect the stability of the entire system.

[0003] Therefore, how to improve the stability of transparent file encryption and decryption is a technical problem that technical personnel in this field currently need to solve. Summary of the invention

[0004] The purpose of this application is to provide a method, system, device and readable storage medium for data encryption and decryption, so as to improve the stability of transparent encryption and decryption of files.

[0005] In order to solve the above technical problems, the present application provides a method for data encryption and decryption, which comprises:

[0006] Monitor the memory-mapped file creation operations initiated by the application and allocate virtual memory of the same size as the memory-mapped file;

[0007] Modifying the protection attribute of the virtual memory to an inaccessible state so that a memory protection exception is generated when the application accesses the virtual memory;

[0008] Determine the data processing type of the application and the location of the data to be processed according to the memory mapping file creation operation;

[0009] When the data processing type is data reading, a vectored exception handler is used to modify the protection attribute of the virtual memory to a readable and writable state;

[0010] The encrypted data located at the location of the data to be processed is decrypted, and the decrypted data is written into the virtual memory, so that the application program can read the data in the virtual memory.

[0011] Optionally, after the memory-mapped file creation operation initiated by the monitoring application and before allocating virtual memory of the same size as the memory-mapped file, the method further includes:

[0012] Determine whether the memory-mapped file is an encrypted file;

[0013] If yes, then executing the step of allocating virtual memory of the same size as the memory mapped file;

[0014] If not, determining whether the memory-mapped file needs to be encrypted;

[0015] If the memory-mapped file needs to be encrypted, encrypt the memory-mapped file, and execute the step of allocating virtual memory of the same size as the memory-mapped file;

[0016] If the memory-mapped file does not need to be encrypted, the base address of the memory-mapped file is returned to the application as a result.

[0017] Optionally, before using the vectored exception handler to modify the protection attribute of the virtual memory to a readable and writable state, the method further includes:

[0018] The vectored exception handler is registered using a preset function.

[0019] Optionally, also include:

[0020] When the data processing type is data writing, a vectored exception handler is used to modify the protection attribute of the virtual memory to a readable and writable state, and a monitoring thread is started;

[0021] The monitoring thread is used to track the writing of the virtual memory, and the tracked data is written into the location of the data to be processed.

[0022] Optionally, the using the monitoring thread to track the writing of the virtual memory and writing the tracked data into the location of the data to be processed includes:

[0023] Using the monitoring thread to call a preset function to track writing to the virtual memory;

[0024] When the application finishes writing data, the preset function is controlled to return to the memory writing page with the tracked data;

[0025] The data written into the memory page is encrypted and saved in the data location to be processed.

[0026] Optionally, encrypting and saving the data written into the memory page to the to-be-processed data location includes:

[0027] storing all of the memory write pages into a delayed write queue;

[0028] The delayed write queue is executed to periodically encrypt and save the data in the memory write page to the to-be-processed data location.

[0029] Optionally, after encrypting and saving the data written into the memory page to the to-be-processed data location, the method further includes:

[0030] Resetting the write status of the memory write page;

[0031] The step of using the monitoring thread to call a preset function to track writing to the virtual memory is repeatedly performed until the virtual memory is closed.

[0032] The present application also provides a data encryption and decryption system, the system comprising:

[0033] A monitoring module, used for monitoring the memory-mapped file creation operation initiated by the application and allocating virtual memory of the same size as the memory-mapped file;

[0034] A first modification module, used for modifying the protection attribute of the virtual memory to an inaccessible state, so that a memory protection exception is generated when the application accesses the virtual memory;

[0035] A determination module, used to determine the data processing type of the application and the location of the data to be processed according to the memory mapping file creation operation;

[0036] A second modification module is used for modifying the protection attribute of the virtual memory to a readable and writable state by using a vectored exception handler when the data processing type is data reading;

[0037] The first writing module is used to decrypt the encrypted data located at the location of the data to be processed, and write the decrypted data into the virtual memory, so that the application program can read the data in the virtual memory.

[0038] The present application also provides a data encryption and decryption device, the data encryption and decryption device comprising:

[0039] Memory for storing computer programs;

[0040] A processor is used to implement the steps of the data encryption and decryption method as described in any one of the above items when executing the computer program.

[0041] The present application also provides a readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for data encryption and decryption as described in any one of the above items are implemented.

[0042] The data encryption and decryption method provided by the present application includes: monitoring the memory mapping file creation operation initiated by the application, and allocating virtual memory of the same size as the memory mapping file; modifying the protection attribute of the virtual memory to an inaccessible state, so that a memory protection exception is generated when the application accesses the virtual memory; determining the data processing type of the application and the location of the data to be processed according to the memory mapping file creation operation; when the data processing type is data reading, using a vectorized exception handler to modify the protection attribute of the virtual memory to a readable and writable state; decrypting the encrypted data located at the location of the data to be processed, and writing the decrypted data into the virtual memory, so that the application reads the data in the virtual memory.

[0043] The technical solution provided by the present application uses virtual memory instead of memory-mapped files to enable the application to operate on the virtual memory, and by modifying the protection attribute of the virtual memory to an inaccessible state, a memory protection exception is generated when the application accesses the virtual memory. By processing the memory protection exception, the data processing type of the application and the location of the data to be processed are determined, thereby realizing transparent encryption and decryption of files. Compared with the prior art, the present application has low complexity and is easier to implement, greatly reducing the software development cost and improving the stability of transparent encryption and decryption of files. The present application also provides a system, device and readable storage medium for data encryption and decryption, which have the above-mentioned beneficial effects and are not repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0045] Figure 1 A flowchart of a method for data encryption and decryption provided in an embodiment of the present application;

[0046] Figure 2 A flowchart of another data encryption and decryption method provided in an embodiment of the present application;

[0047] Figure 3 A structural diagram of a data encryption and decryption system provided in an embodiment of the present application;

[0048] Figure 4 A structural diagram of a data encryption and decryption device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] The core of this application is to provide a method, system, device and readable storage medium for data encryption and decryption, which are used to improve the stability of transparent encryption and decryption of files.

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0051] The transparent file encryption and decryption technology can be divided into the following generations according to the order of development: The first generation technology is represented by function hooks (API Hook), which implements dynamic encryption and decryption of file data by hooking file read and write functions such as ReadFile and WriteFile. That is, the part of the file that the application reads and writes is encrypted and decrypted. The second generation technology uses a file filter driver (FSFilter or MiniFilter), which can take over all file access in the operating system kernel, including the access of memory-mapped files. When the data passes through the file filter driver, it can be encrypted and decrypted, and the user and the application are unaware of this operation. The third generation technology is called a layered file system (Layered FileSystem), which implements a relatively complete file system through a file filter driver, and can accurately control the same file to show different states (encryption or decryption state) to different applications. This file system is located above the original file system of the operating system, and the application first accesses this upper file system, so this technology is called a layered file system. Both the second and third generation technologies use file filter drivers, which are sometimes collectively referred to as file filter driver technology.

[0052] However, most of the transparent file encryption and decryption products on the market are based on file filter drivers. Since the development of file filter drivers is more difficult than that of general applications and the level of practitioners is uneven, the reliability of such products has always been less than ideal. Moreover, the file filter driver is installed in the operating system kernel, and once an abnormality occurs, it will affect the stability of the entire system; therefore, this application provides a method for data encryption and decryption to solve the above problems.

[0053] Please refer to Figure 1 , Figure 1 A flowchart of a method for data encryption and decryption provided in an embodiment of the present application.

[0054] It specifically includes the following steps:

[0055] S101: monitoring a memory-mapped file creation operation initiated by an application, and allocating virtual memory having the same size as the memory-mapped file;

[0056] The memory-mapped file mentioned here refers to the mapping from a file to a block of memory. When using memory-mapped files to process files stored on disk, there is no need to perform I / O operations on the files, which means that there is no need to apply for and allocate cache for the files when processing them. All file cache operations are directly managed by the system. Since the steps of loading file data into memory, writing data back from memory to files, and releasing memory blocks are eliminated, memory-mapped files can play a very important role in processing large amounts of data. The Windows operating system provides functions that allow applications to map files to virtual memory, such as the CreateFileMapping function and the MapViewOfFile function.

[0057] In this step, the purpose of allocating virtual memory of the same size as the memory-mapped file is to use virtual memory instead of the memory-mapped file, so that the application's operation on the memory-mapped file is converted into the operation on the virtual memory, thereby eliminating the need to implement transparent encryption and decryption of files through a file filter driver;

[0058] Specifically, you can use the VirtualAlloc function or the NtAllocateVirtualMemory function to allocate virtual memory of the same size as the memory-mapped file, where the flAllocationType parameter value of the VirtualAlloc function is MEM_RESERVE|MEM_WRITE_WATCH, indicating that write tracking is enabled for this memory area.

[0059] Optionally, to improve the processing efficiency of transparent encryption and decryption of files, after the memory-mapped file creation operation initiated by the monitoring application and before allocating virtual memory of the same size as the memory-mapped file, the following steps may be performed:

[0060] Determine whether the memory-mapped file is an encrypted file;

[0061] If so, performing the step of allocating virtual memory of the same size as the memory mapped file;

[0062] If not, determine whether the memory-mapped file needs to be encrypted;

[0063] If the memory-mapped file needs to be encrypted, encrypt the memory-mapped file and perform the step of allocating virtual memory of the same size as the memory-mapped file;

[0064] If the memory-mapped file does not need to be encrypted, the base address of the memory-mapped file is returned to the application as a result.

[0065] S102: modifying the protection attribute of the virtual memory to an inaccessible state, so that a memory protection exception is generated when the application accesses the virtual memory;

[0066] Modern operating systems use paging to manage memory. The size of each memory page is 4KB. Each page of memory can be individually set with protection attributes to control whether the page of memory is readable, writable, executable, etc.

[0067] In this step, the purpose of modifying the protection attribute of the virtual memory to an inaccessible state is to generate a memory protection exception when the application accesses the virtual memory. By processing the memory protection exception, the data processing type of the application and the location of the data to be processed are determined, thereby realizing transparent encryption and decryption of files.

[0068] Specifically, the VirtualProtect function or the NtProtectVirtualMemory function may be used to modify the protection attribute of the virtual memory.

[0069] S103: Determine the data processing type of the application and the location of the data to be processed according to the memory mapping file creation operation;

[0070] When an application initiates a memory-mapped file creation operation, it proves that the application needs to perform corresponding processing operations on the memory-mapped file. This application determines the application's data processing type and the location of the data to be processed based on the memory-mapped file creation operation, so that the virtual memory can realize transparent encryption and decryption of files based on the data processing type and the location of the data to be processed.

[0071] S104: When the data processing type is data reading, the protection attribute of the virtual memory is modified to a readable and writable state by using a vectored exception handler;

[0072] In this step, the purpose of using the vectored exception handler to modify the protection attribute of the virtual memory to a readable and writable state is to decrypt the encrypted data located at the data location to be processed and then write the decrypted data into the virtual memory so that the application can read the data in the virtual memory.

[0073] Optionally, before using the vectored exception handler to modify the protection attribute of the virtual memory to a readable and writable state, the vectored exception handler may be registered using a preset function, thereby implementing registration of the vectored exception handler for handling all application exceptions;

[0074] Specifically, the preset function may be an AddVectoredExceptionHandler function or a RtlAddVectoredExceptionHandler function.

[0075] S105: decrypt the encrypted data located at the location of the data to be processed, and write the decrypted data into the virtual memory, so that the application program can read the data in the virtual memory.

[0076] Based on the above technical scheme, a method for data encryption and decryption provided by the present application utilizes virtual memory instead of memory mapped files to enable an application to operate on the virtual memory, and modifies the protection attribute of the virtual memory to an inaccessible state so that a memory protection exception is generated when the application accesses the virtual memory. By processing the memory protection exception, the data processing type of the application and the location of the data to be processed are determined, thereby realizing transparent encryption and decryption of files. Compared with the prior art, the present application has low complexity and is easier to implement, which greatly reduces the software development cost and improves the stability of transparent encryption and decryption of files.

[0077] With respect to step S103 of the previous embodiment, after determining the data processing type of the application and the location of the data to be processed according to the memory mapping file creation operation, when the data processing type is data writing, the following steps may also be performed: Figure 2 The steps shown below are combined Figure 2 Provide explanation.

[0078] Please refer to Figure 2 , Figure 2 for Figure 1 A flowchart of an actual expression of S103 in a method for data encryption and decryption is provided.

[0079] It specifically includes the following steps:

[0080] S201: When the data processing type is data writing, the protection attribute of the virtual memory is modified to a readable and writable state by using a vectored exception handler, and a monitoring thread is started;

[0081] S202: Using a monitoring thread to track writes to the virtual memory, and writing the tracked data into a location of data to be processed.

[0082] Optionally, the use of a monitoring thread to track writes to the virtual memory and writes the tracked data into the location of the data to be processed may be specifically:

[0083] Using the monitoring thread to call a preset function to track the writing of virtual memory;

[0084] When the application finishes writing data, the control preset function returns the memory write page with the tracked data;

[0085] The data written into the memory page is encrypted and saved in the data location to be processed.

[0086] Optionally, the preset function mentioned here may specifically be a GetWriteWatch function and / or a NtGetWriteWatch function.

[0087] Furthermore, in order to improve performance and reduce the impact of data storage on performance, the data written to the memory page is encrypted and saved to the location of the data to be processed. This can be achieved by executing the following steps:

[0088] Store all memory write pages into the delayed write queue;

[0089] The execution delay write queue periodically encrypts and saves the data in the memory write page to the data location to be processed.

[0090] Optionally, after encrypting and saving the data written into the memory page to the data location to be processed, the following steps may be performed to implement duplicate writing tracking of the virtual memory:

[0091] Reset the write status of the memory write page;

[0092] The step of using the monitoring thread to call a preset function to track writing to the virtual memory is repeated until the virtual memory is closed.

[0093] Specifically, the write status of the memory write page may be reset through the ResetWriteWatch function and / or the NtResetWriteWatch function.

[0094] Please refer to Figure 3 , Figure 3 A structural diagram of a data encryption and decryption system provided in an embodiment of the present application.

[0095] The system may include:

[0096] The monitoring module 100 is used to monitor the memory-mapped file creation operation initiated by the application program and allocate virtual memory of the same size as the memory-mapped file;

[0097] A first modification module 200, used to modify the protection attribute of the virtual memory to an inaccessible state, so that a memory protection exception is generated when the application accesses the virtual memory;

[0098] A determination module 300, for determining a data processing type of an application and a location of data to be processed according to a memory mapping file creation operation;

[0099] The second modification module 400 is used to modify the protection attribute of the virtual memory to a readable and writable state by using a vectored exception handler when the data processing type is data reading;

[0100] The first writing module 500 is used to decrypt the encrypted data located at the location of the data to be processed, and write the decrypted data into the virtual memory so that the application program can read the data in the virtual memory.

[0101] Based on the above embodiment, in a specific embodiment, the system may further include:

[0102] A first judgment module, used to judge whether the memory-mapped file is an encrypted file;

[0103] A first execution module, configured to execute the step of allocating virtual memory having the same size as the memory-mapped file if yes;

[0104] The second judgment module is used to judge whether the memory-mapped file needs to be encrypted if no;

[0105] A second execution module is used for encrypting the memory-mapped file if the memory-mapped file needs to be encrypted, and executing the step of allocating virtual memory of the same size as the memory-mapped file;

[0106] The return module is used to return the base address of the memory-mapped file to the application as a result if the memory-mapped file does not need to be encrypted.

[0107] Based on the above embodiment, in a specific embodiment, the system may further include:

[0108] A registration module is used to register a vectored exception handler using a preset function.

[0109] Based on the above embodiment, in a specific embodiment, the system may further include:

[0110] The third modification module is used for modifying the protection attribute of the virtual memory to a readable and writable state by using a vectored exception handler when the data processing type is data writing, and starting a monitoring thread;

[0111] The second writing module is used to use the monitoring thread to track the writing of the virtual memory, and write the tracked data into the position of the data to be processed.

[0112] Based on the above embodiment, in a specific embodiment, the second writing module may include:

[0113] The tracking submodule is used to track the writing of virtual memory by calling a preset function through a monitoring thread;

[0114] A control submodule, used to control a preset function to return the traced data to the memory write page when the application completes data writing;

[0115] The saving submodule is used to encrypt and save the data written into the memory page to the data location to be processed.

[0116] Based on the above embodiment, in a specific embodiment, the preservation submodule may include:

[0117] A storage unit for storing all memory write pages into a delayed write queue;

[0118] The execution unit is used to execute the delayed write queue to periodically encrypt and save the data written into the memory page into the position of the data to be processed.

[0119] Based on the above embodiment, in a specific embodiment, the system may further include:

[0120] A reset module is used to reset the write status of the memory write page;

[0121] The repeating module is used to repeatedly execute the step of using the monitoring thread to call a preset function to track the writing of the virtual memory until the virtual memory is closed.

[0122] Since the embodiments of the system part correspond to the embodiments of the method part, please refer to the description of the embodiments of the method part for the embodiments of the system part, which will not be repeated here.

[0123] Please refer to Figure 4 , Figure 4 A structural diagram of a data encryption and decryption device provided in an embodiment of the present application.

[0124] The data encryption and decryption device 600 may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 422 (for example, one or more processors) and memory 432, one or more storage media 430 (for example, one or more mass storage devices) storing application programs 442 or data 444. Among them, the memory 432 and the storage medium 430 can be temporary storage or permanent storage. The program stored in the storage medium 430 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the device. Furthermore, the processor 422 can be configured to communicate with the storage medium 430 to execute a series of instruction operations in the storage medium 430 on the data encryption and decryption device 600.

[0125] The data encryption and decryption device 600 may also include one or more power supplies 424, one or more wired or wireless network interfaces 450, one or more input and output interfaces 458, and / or one or more operating systems 441, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.

[0126] Above Figure 1 to Figure 2 The steps in the described data encryption and decryption method are performed by the data encryption and decryption device based on the Figure 4 The structure shown is implemented.

[0127] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0128] In the several embodiments provided in the present application, it should be understood that the disclosed devices, equipment and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0129] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0130] In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0131] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a function calling device, or a network device, etc.) to execute all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program code.

[0132] The above is a detailed introduction to a method, system, device and readable storage medium for data encryption and decryption provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core ideas of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

[0133] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims

1. A method for data encryption and decryption, characterized in that: include: Monitor the memory-mapped file creation operations initiated by the application and allocate virtual memory of the same size as the memory-mapped file; A memory-mapped file is a mapping of a file to a block of memory. When using a memory-mapped file to process a file stored on disk, no I / O operations are performed on the file. Using virtual memory instead of memory-mapped files, so that the application's operations on memory-mapped files are converted into operations on virtual memory; Modifying the protection attribute of the virtual memory to an inaccessible state so that a memory protection exception is generated when the application accesses the virtual memory; Determine the data processing type and the location of the data to be processed of the application program according to the memory mapping file creation operation, so that the virtual memory can realize transparent encryption and decryption of the file according to the data processing type and the location of the data to be processed; When the data processing type is data reading, a vectored exception handler is used to modify the protection attribute of the virtual memory to a readable and writable state; Decrypting the encrypted data located at the location of the data to be processed, and writing the decrypted data into the virtual memory, so that the application program can read the data in the virtual memory; When the data processing type is data writing, a vectored exception handler is used to modify the protection attribute of the virtual memory to a readable and writable state, and a monitoring thread is started; Using the monitoring thread to call a preset function to track writing to the virtual memory; When the application finishes writing data, the preset function is controlled to return to the memory writing page with the tracked data; Encrypting the data written into the memory page and saving it in the data location to be processed; Resetting the write status of the memory write page; The step of using the monitoring thread to call a preset function to track writing to the virtual memory is repeatedly performed until the virtual memory is closed.

2. The method according to claim 1, characterized in that After the memory-mapped file creation operation initiated by the monitoring application, and before allocating virtual memory of the same size as the memory-mapped file, it also includes: Determine whether the memory-mapped file is an encrypted file; If yes, then executing the step of allocating virtual memory of the same size as the memory mapped file; If not, determining whether the memory-mapped file needs to be encrypted; If the memory-mapped file needs to be encrypted, encrypt the memory-mapped file, and execute the step of allocating virtual memory of the same size as the memory-mapped file; If the memory-mapped file does not need to be encrypted, the base address of the memory-mapped file is returned to the application as a result.

3. The method according to claim 1, characterized in that Before using the vectored exception handler to modify the protection attribute of the virtual memory to a readable and writable state, the method further includes: The vectored exception handler is registered using a preset function.

4. The method according to claim 1, characterized in that: Encrypting the data written into the memory page and saving it in the data location to be processed includes: storing all of the memory write pages into a delayed write queue; The delayed write queue is executed to periodically encrypt and save the data in the memory write page to the to-be-processed data location.

5. A data encryption and decryption system, characterized in that: include: A monitoring module, used for monitoring the memory-mapped file creation operation initiated by the application and allocating virtual memory of the same size as the memory-mapped file; A memory-mapped file is a mapping of a file to a block of memory. When using a memory-mapped file to process a file stored on disk, no I / O operations are performed on the file. Using virtual memory instead of memory-mapped files, so that the application's operations on memory-mapped files are converted into operations on virtual memory; A first modification module, used for modifying the protection attribute of the virtual memory to an inaccessible state, so that a memory protection exception is generated when the application accesses the virtual memory; A determination module, used to determine the data processing type and the location of the data to be processed of the application according to the memory mapping file creation operation, so that the virtual memory can realize transparent encryption and decryption of files according to the data processing type and the location of the data to be processed; A second modification module is used for modifying the protection attribute of the virtual memory to a readable and writable state by using a vectored exception handler when the data processing type is data reading; A first writing module, used for decrypting the encrypted data located at the location of the data to be processed, and writing the decrypted data into the virtual memory, so that the application program can read the data in the virtual memory; The third modification module is used for modifying the protection attribute of the virtual memory to a readable and writable state by using a vectored exception handler when the data processing type is data writing, and starting a monitoring thread; A second writing module is used to use a monitoring thread to track the writing of the virtual memory and write the tracked data into the location of the data to be processed; The second writing module includes: a tracking submodule, which is used to use the monitoring thread to call a preset function to track the writing of the virtual memory; a control submodule, which is used to control the preset function to carry the tracked data and return to the memory writing page when the application completes the data writing; and a saving submodule, which is used to encrypt and save the data in the memory writing page to the data location to be processed; A reset module is used to reset the write status of the memory write page; The repeating module is used to repeatedly execute the step of using the monitoring thread to call a preset function to track the writing of the virtual memory until the virtual memory is closed.

6. A data encryption and decryption device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the method for data encryption and decryption as claimed in any one of claims 1 to 4 when executing the computer program.

7. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for data encryption and decryption according to any one of claims 1 to 4 are implemented.

Images