Unified Encryption Storage Method, System and Computer-Readable Storage Medium

Abstract

The present invention discloses a unified encryption storage method, system and computer-readable storage medium. The unified encryption storage system includes a unified encryption subsystem, an algorithm adaptation module and a target driving module. By implementing the unified encryption subsystem, the target driving module and the algorithm adaptation module, the differences in the underlying encryption card drivers are shielded, and different algorithms are constructed to support the encryption and decryption requirements of different storage systems through standard interfaces. The unified encryption subsystem provides functions such as encryption algorithm registration, encryption card scheduling, and key generation. Block storage, file storage and object storage complete the encryption and decryption of data through the unified algorithm interface by calling their respective selected algorithms. Each storage type does not need to pay attention to the specific algorithm implementation and the differences in the underlying encryption cards, avoiding the impact on their respective storage IO stacks.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and particularly to a general unified encryption storage method, system and computer-readable storage medium. Background Art

[0002] With the increasing emphasis on the security of data generated by computer networks, various requirements for the secure storage of data have been put forward. Units with different confidentiality levels have different requirements for encryption devices and data encryption granularity. Even in the same system, different encryption and decryption schemes may be adopted for data with different security levels.

[0003] Common encryption devices generally include two forms: software algorithms and hardware cards. The former means implementing the encryption and decryption interfaces related to the encryption algorithm and the key loading function in a pure software manner, usually occupying the host processor to complete the data operation process. The hardware card refers to encrypting and decrypting data through a dedicated smart card hardware. Compared with the software algorithm, since the encryption and decryption keys of the hardware card do not leave the card and are difficult to be attacked by means such as tracking or decompilation, it has better data security. At the same time, its operation process does not occupy the computer host processor, so it is more conducive to improving the encryption and decryption processing performance and is a commonly used method in data encryption and decryption schemes with a higher confidentiality level. However, the implementation schemes and interface forms of hardware cards from different manufacturers are not the same, and usually need to be adapted specifically. In addition, it may be switched and used with the software algorithm in the same system, which poses a great challenge to the flexibility and scalability of the data encryption system that needs to support different smart cards. The conventional adaptation method usually introduces a specific software version, and even impacts the call methods of the encryption and decryption interfaces of various types of storage systems, which significantly increases the complexity of version management and logic management, not only resulting in an increase in workload but also reducing the reliability of the system.

[0004] According to different data storage application scenarios, the granularity of data encryption and decryption can generally be divided into three types: block, file, and object, corresponding to block storage, file storage, and object storage respectively. Different storage types usually have different data encryption and decryption methods. For example, block storage usually uses logical volumes as the key management unit, and different logical volumes use different keys for data encryption and decryption. File storage allocates keys according to the principle of one file, one key, and object storage assigns different keys to each object. In addition, block encryption and file encryption are usually processed in the operating system kernel mode, while object storage is generally processed in the user mode. Different application methods result in obvious differences in the call of the encryption and decryption interfaces and the form of key management. Different storage methods have synchronous or asynchronous requirements for the encryption and decryption interfaces. Moreover, it is usually necessary to support one or more of block encryption storage, file encryption storage, and object encryption storage in the same system, which further amplifies the complexity of the encryption system hardware card adaptation, function extension, and version management. As the number of application scenarios and the types of adapted hardware cards increases, it is extremely easy to cause the system to become bloated, the stability to decrease, and it brings great resource overhead to maintenance and version management.

[0005] In summary, in order to adapt to the continuously rich data encryption storage forms and support different types of hardware card interfaces, how to propose a general unified encryption storage system and method from the technical solution to achieve fast support for different models of encryption cards while ensuring security, stability, and performance, decoupling the application form and encryption form as much as possible, is an urgent problem to be solved in the existing technology. Summary of the Invention

[0006] The main object of the present invention is to provide a unified encryption storage method, system, and computer-readable storage medium to solve the above technical problems.

[0007] To achieve the above object, a unified encryption storage system provided by the present invention includes: a unified encryption subsystem, an algorithm adaptation module, and a target driver module; wherein,

[0008] The target driver module is used to receive and respond to the request of the block storage accessing and registering the target driver module through device mapper, select and call the unified encryption subsystem to complete the encryption and decryption operations of the block storage;

[0009] The unified encryption subsystem communicates with the operating system algorithm management module. The unified encryption subsystem includes: an encryption and decryption algorithm abstraction module, which is used to abstract algorithm rules matching the encryption and decryption algorithms for each encryption and decryption algorithm according to preset abstraction rules; a key generation algorithm abstraction module, which is used to abstract a random number generation algorithm for the key generation process of each encryption card according to preset abstraction rules; a virtual character device for direct access by the user-mode application management program, and in the form of an ioctl system call, to operate the underlying encryption card according to business needs.

[0010] Multiple preset algorithm templates are stored in the unified encryption subsystem. Each algorithm template includes a common mechanism, an algorithm processing mechanism, a request processing mechanism, and a configuration management mechanism.

[0011] An algorithm adaptation module is used to obtain the algorithm rules matching the encryption and decryption algorithms and the random number generation algorithm corresponding to the retrieved algorithm template from the unified encryption subsystem, and perform corresponding encryption and decryption operations.

[0012] Furthermore, the algorithm rules matching the encryption and decryption algorithms include an encryption card scheduling strategy, an encryption card self-check rule, a performance statistics rule, a performance tuning rule, and an encryption verification rule.

[0013] Furthermore, the unified encryption subsystem is also used to register the data encryption algorithm and the key generation algorithm configured by the preset algorithm template on the operating system.

[0014] The present invention also provides a unified encryption storage method for the unified encryption storage system described in any one of the above. The method includes the steps:

[0015] Step S1, in response to an encryption and decryption service request, determine the encryption algorithm corresponding to the encryption and decryption service request and complete the setting of the initial attributes of the encryption algorithm; wherein, the encryption and decryption service request includes an encryption and decryption service request initiated by block storage when creating a logical volume, an encryption and decryption service request initiated by file storage when mounting a file system, and an encryption and decryption service request initiated by object storage when starting an object.

[0016] Step S2, in the IO process, find the selected encryption algorithm through the crypto API, call the corresponding standard key generation interface and data encryption and decryption interface, and obtain a preset algorithm template through the algorithm standard interface; wherein, the algorithm template includes a common mechanism, an algorithm processing mechanism, a request processing mechanism, and a configuration management mechanism.

[0017] Step S3, parse the algorithm configuration and operation parameters according to the abstracted algorithm template, and call the encryption card driver interface according to the form of the encryption card driver interface to complete the encryption and decryption process of the data.

[0018] Step S4, replace the source data in the IO process with the data after the encryption and decryption operations are completed, and continue to complete the data reading and writing operations according to the original IO process.

[0019] Furthermore, before the step S1, there is also a step S00: register the data encryption algorithm and the key generation algorithm configured in the preset algorithm template on the operating system.

[0020] Furthermore, the step S00 includes:

[0021] Step S01, check the initial configuration of the algorithm defined according to the preset algorithm template in sequence. After the check is correct, register the algorithm template on the operating system;

[0022] Step S02, after the algorithm template is registered, use the data encryption algorithm and the key generation algorithm in the algorithm template to perform self-check on the encryption card;

[0023] Step S031, when the self-check passes and the number of encryption cards meets the application requirements, complete the registration of the algorithm template;

[0024] Step S032, when the self-check fails or the number of encryption cards does not meet the application requirements, remove all the algorithms registered for this encryption card.

[0025] Furthermore, when the encryption and decryption service request is an encryption and decryption service request initiated by the block storage when creating a logical volume, the step S4 includes:

[0026] Enter the operating system kernel through the read and write system call interface to access the virtual file system;

[0027] After the virtual file system recognizes that it is a block IO request, transfer the request to the general block layer for processing, and the general block layer further hands it over to the device mapper;

[0028] The device mapper finds the block storage encryption and decryption target driver kdcs according to the virtual block device accessed by the block IO request and the mapping table bound to the virtual block device;

[0029] The target driver module looks up the configured encryption and decryption algorithm from the operating system algorithm management module according to the mapping table bound by the device mapper. When the algorithm lookup fails, return an IO error and end the access request; when the algorithm lookup is successful, call the standard encryption and decryption interface corresponding to the encryption and decryption algorithm;

[0030] The algorithm standard encryption and decryption interface calls the encryption and decryption interface defined by the algorithm template matching the encryption and decryption algorithm in the unified encryption subsystem;

[0031] The encryption and decryption interface defined by the algorithm template continues to call the encryption card driver interface adapted by the algorithm adaptation module to complete the encryption and decryption processing of the data;

[0032] The target driver module replaces the data in the IO stack with the encrypted and decrypted data, and then transfers the read / write request to the IO scheduling layer for processing. The IO scheduling layer further submits it to the block device to complete the read / write operation of the block storage, and ends the encryption and decryption service request initiated by the block storage when creating a logical volume.

[0033] Further, when the encryption and decryption service request is an encryption and decryption service request initiated by file storage when mounting a file system, the step S4 includes:

[0034] Enter the operating system kernel through the read / write system call interface to access the virtual file system;

[0035] The virtual file system transfers the request to the encrypted file system according to the operating system directory accessed by the file storage;

[0036] The encrypted file system searches for the encryption and decryption algorithm from the operating system algorithm management module according to the file system mount configuration. When the algorithm search fails, it returns an IO error and ends the access request; when the algorithm search is successful, it calls the standard encryption and decryption interface corresponding to the encryption and decryption algorithm;

[0037] The algorithm standard encryption and decryption interface calls the encryption and decryption interface defined by the algorithm template that matches the encryption and decryption algorithm in the unified encryption subsystem;

[0038] The encryption and decryption interface defined by the algorithm template continues to call the encryption card driver interface adapted by the algorithm adaptation module to complete the encryption and decryption processing of the data;

[0039] The encrypted file system replaces the original data with the encrypted and decrypted data, and then submits it to the block device to complete the read / write operation of the file system, and ends the encryption and decryption service request initiated by the file storage when mounting the file system.

[0040] Further, when the encryption and decryption service request is an encryption and decryption service request initiated by object storage when starting an object, the step S4 includes:

[0041] In the user state, search for the encryption and decryption algorithm from the operating system algorithm management module according to the object encryption and decryption service start configuration. When the algorithm search fails, return an IO error and end the access request; when the algorithm search is successful, call the standard encryption and decryption interface corresponding to the encryption and decryption algorithm;

[0042] The algorithm standard encryption and decryption interface calls the encryption and decryption interface defined by the algorithm template that matches the encryption and decryption algorithm in the unified encryption subsystem;

[0043] The encryption and decryption interface defined by the algorithm template continues to call the encryption card driver interface adapted by the algorithm adaptation module to complete the encryption and decryption processing of the data;

[0044] Replace the original data of the object with the data after encryption and decryption, and then call the object storage interface to complete the read and write operations of the object, ending the encryption and decryption service request initiated by the startup object for the object storage.

[0045] The present invention also provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the steps of the unified encryption storage method described in any one of the above are implemented.

[0046] In the technical solution of the present invention, in the existing IO system architecture, by implementing a unified encryption subsystem, a target driver (kdcs), and an algorithm adaptation module, the differences in the underlying encryption card drivers are shielded, and different algorithms are constructed to support the encryption and decryption requirements of different storage systems through standard interfaces. The unified encryption subsystem provides functions such as encryption algorithm registration, encryption card scheduling, and key generation. Block storage, file storage, and object storage complete the encryption and decryption of data through a unified algorithm interface by calling their respective selected algorithms. Each storage type does not need to pay attention to the specific algorithm implementation and the differences in the underlying encryption cards, avoiding the impact on their respective storage IO stacks. Compared with the prior art, it has at least the following advantages:

[0047] (1) The block storage, file storage, and object storage are unifiedly managed in one, and each storage type is completely decoupled from the specific implementation of the algorithm, the encryption card driver module, and the encryption card interface form, enabling each type of storage system and encryption and decryption algorithm to be independently developed, avoiding the drawback of having to modify the storage system when adapting to different encryption card types, and significantly improving the development efficiency while ensuring the stability of the system.

[0048] (2) The unified encryption subsystem constructs a general layer between the operating system algorithm management module and the specific algorithm implementation of the encryption card, providing many general functions such as encryption card scheduling strategies, encryption card self-check, performance statistics, performance tuning, and encryption verification for various algorithms, so that when implementing the algorithm and adapting the encryption card, there is no need to pay too much attention to these complex function logics and strategy implementations, effectively ensuring the consistency of general function behaviors and the flexibility of function expansion.

[0049] (3) The unified encryption subsystem abstracts algorithms that meet specific behaviors into algorithm templates. These algorithm templates not only natively support various general functions provided by the unified encryption subsystem but also publish relevant processing interfaces related to the specific encryption card interface form, encryption and decryption request initialization, etc. to the algorithm adaptation module, which performs corresponding adaptation. This not only simplifies the support for multiple types of encryption cards but also enables targeted performance optimization based on the encryption card or specific storage application method.

[0050] (4) Since various types of storage systems perform encryption and decryption on data through standard algorithm interfaces, it is supported that each type of storage system can select different encryption and decryption algorithms as needed. Further, as long as the system supports multiple types of hardware encryption cards, different types of storage systems are supported to use different encryption cards to perform data encryption and decryption respectively. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a block diagram of the overall structure module of the unified encryption storage system in an embodiment of the present invention;

[0052] Figure 2 It is a schematic diagram of the module structure of the unified encryption subsystem of the unified encryption storage system in an embodiment of the present invention;

[0053] Figure 3 It is a flowchart of the unified encryption storage method in an embodiment of the present invention;

[0054] The implementation of the object, functional features, and advantages of the present invention will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0055] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0056] In the following description, suffixes such as "module", "component", or "unit" used to represent elements are only for the convenience of describing the present invention, and they have no specific meaning in themselves. Therefore, "module", "component", or "unit" can be used interchangeably.

[0057] Please refer to Figure 1 and 2 , to achieve the above object, a unified encryption storage system 100 provided in an embodiment of the present invention includes: a unified encryption subsystem 20, an algorithm adaptation module 40, and a target driver module 30; wherein,

[0058] The target driver module 30 is configured to receive and respond to requests from the block storage accessing and registering the target driver module through device mapper, select and call the unified encryption subsystem 20 to complete the encryption and decryption operations of the block storage;

[0059] The unified encryption subsystem 20 communicates with the operating system algorithm management module 10. The unified encryption subsystem 20 includes: an encryption / decryption algorithm abstraction module 21, which abstracts algorithm rules matching the encryption / decryption algorithm for each encryption / decryption algorithm according to preset abstraction rules; a key generation algorithm abstraction module 22, which abstracts a random number generation algorithm for the key generation process of each encryption card according to preset abstraction rules; and a virtual character device 23 for direct access by a user-mode application management program, and in the form of an ioctl system call, operates the underlying encryption card according to service requirements.

[0060] Multiple preset algorithm templates are stored in the unified encryption subsystem 20. Each algorithm template includes a common mechanism, an algorithm processing mechanism, a request processing mechanism, and a configuration management mechanism.

[0061] An algorithm adaptation module 40 is configured to obtain, from the unified encryption subsystem 20 according to the retrieved algorithm template, the algorithm rules matching the encryption / decryption algorithm and the random number generation algorithm, and perform corresponding encryption / decryption operations.

[0062] Specifically, this embodiment provides a unified encryption storage system based on algorithms. In the existing IO system architecture, by implementing the unified encryption subsystem 20, the target driver module 30 (target driver) kdcs, and the algorithm adaptation module 40, the differences in the underlying encryption card drivers are shielded, and different algorithms are constructed to support the encryption / decryption requirements of different storage systems through standard interfaces. The unified encryption subsystem 20 provides functions such as encryption algorithm registration, encryption card scheduling, and key generation. Block storage, file storage, and object storage complete data encryption / decryption through the unified algorithm interface by calling their respective selected algorithms, and each storage type does not need to concern itself with the specific algorithm implementation and the differences in the underlying encryption cards, avoiding impacts on their respective storage IO stacks.

[0063] The target driver kdcs30 is a virtual device implemented for block storage encryption based on the device mapper framework. Block storage accesses the registered target driver kdcs through the device mapper, and then the target driver kdcs selects and calls the algorithm registered in the unified encryption subsystem to complete the encryption / decryption operation of the block.

[0064] The algorithm adaptation module 40 provides algorithm adaptation implementation based on the abstraction of the unified encryption subsystem 20, mainly including data encryption and decryption algorithms and key generator algorithms. The algorithm adaptation module 40 is closely related to the specific encryption card interface form. Each specific type of encryption card implements an algorithm adaptation module adapted to it. The abstracted algorithm template is improved according to the encryption and decryption logic of each card driver interface, so that the upper-layer application does not need to perceive the differences in the underlying encryption cards, and uses a unified algorithm view to complete the encryption and decryption functions. The encryption card driver module provides the key loading and data encryption and decryption interface of the hardware card. Different hardware cards usually have different interface implementations. According to the interface calling method, it can also be divided into synchronous and asynchronous interfaces. The differentiation of encryption card drivers is processed by the algorithm adaptation module.

[0065] Specifically, the encryption and decryption algorithm abstract module 21 mainly provides a unified abstraction for each encryption and decryption algorithm implementation, and can be applied to block encryption, file encryption and object encryption at the same time, so as to facilitate the centralized management of encryption and decryption algorithms. Each encryption and decryption algorithm needs to meet a series of rules defined by the encryption and decryption algorithm abstract module framework when it is implemented. These rules are usually used to support encryption card scheduling strategy, encryption card self-test, performance statistics, performance tuning, encryption verification and other functions. This module unifies the various common functional mechanisms in the algorithm to form a general submodule for encryption and decryption algorithms. This abstraction makes it only necessary to adapt according to simple rules when implementing specific encryption and decryption algorithms for encryption cards, focusing on the interface differences of the encryption card itself, and diluting various complex functional logics.

[0066] The key generation algorithm abstract module 22 abstracts the key generation process of the encryption card into a random number generation algorithm based on the operating system random number generator framework. The random number generation algorithm, like the encryption and decryption algorithm, is registered with the operating system algorithm management module to provide a consistent processing interface to each application in the form of an algorithm.

[0067] The encryption and decryption algorithms registered by the encryption and decryption algorithm abstract module 21 and the key generation algorithm abstract module 22 all support the standard crypo API of the operating system. Whether it is block encryption storage and file encryption storage implemented in kernel state, or object encryption storage implemented in user state, the corresponding algorithms can be accessed through the crypto API to complete key generation, key loading and data encryption and decryption processing, with a unified operation view based on the algorithm. In this way, the block storage system, file storage system and object storage system are completely decoupled from the encryption and decryption logic and interface form of the underlying encryption card, and the software hierarchy becomes clearer. Whether it is the customized development of the storage system or the addition of encryption cards adapted to different models, the impact of the change can be significantly reduced, greatly reducing the work expenses of development and maintenance.

[0068] To further reduce the difficulty of developing algorithms and adapting to encryption cards, the unified encryption subsystem 20 abstracts encryption and decryption algorithms in different modes into algorithm templates. The algorithm templates generally support basic functions such as encryption card scheduling strategies, encryption card self-check, performance statistics, performance tuning, and data verification, and are driven by the unified encryption subsystem 20. For the processing interfaces in the algorithm templates that are strongly related to the specific encryption card interface form and application scenario, such as specific encryption and decryption driver interface calls, performance statistics indicators, memory or performance tuning strategies, etc., they are standardized and implemented by the algorithm adaptation module 40.

[0069] The virtual character device 23 is a virtual device defined specifically for the control and management of encryption cards. It mainly completes operations such as obtaining the number of encryption cards, obtaining the number of available encryption cards, encryption card function and performance testing, and encryption card management strategy configuration by implementing the IO control callback interface of the device. The user-mode application management program can directly access the virtual character device and complete various operations on the underlying encryption card in the form of ioctl system calls according to business needs.

[0070] The algorithm adaptation module 40 mainly implements the adaptation of the algorithms abstracted by the unified encryption subsystem 20. It mainly includes a series of operations specialized for encryption cards and specific application scenarios, such as data encryption and decryption, key generation, memory tuning, and performance metric definition. They are usually closely related to the encryption card interface form and usage method. The product can define and specify the required algorithm strategies through the algorithm adaptation module 40.

[0071] For a specific encryption card, the algorithm adaptation module 40 needs to implement at least the data encryption and decryption algorithm and the key generation algorithm according to the algorithm framework abstracted by the unified encryption subsystem. It can also perform specific memory optimization and performance tuning according to application requirements (such as block storage, file storage, or object storage) or the encryption card interface form (such as synchronous interface or asynchronous interface).

[0072] Please refer to Figure 3 , to achieve the above object, in the first embodiment of the present invention, a unified encryption storage method is provided, including the steps:

[0073] Step S1, in response to an encryption and decryption service request, determine the encryption algorithm corresponding to the encryption and decryption service request and complete the setting of the initial attributes of the encryption algorithm; wherein, the encryption and decryption service request includes an encryption and decryption service request initiated by block storage when creating a logical volume, an encryption and decryption service request initiated by file storage when mounting a file system, and an encryption and decryption service request initiated by object storage when starting an object.

[0074] Step S2: In the IO process, search for the selected encryption algorithm through the crypto API, call the corresponding standard key generation interface and data encryption / decryption interface, and obtain the preset algorithm template through the algorithm standard interface; wherein, the algorithm template includes a common mechanism, an algorithm processing mechanism, a request processing mechanism, and a configuration management mechanism

[0075] Step S3: Analyze the algorithm configuration and operation parameters according to the abstracted algorithm template, and call the encryption card driver interface according to the form of the encryption card driver interface to complete the data encryption / decryption process;

[0076] Step S4: Use the data after the encryption / decryption operation to replace the source data in the IO process, and continue to complete the data reading and writing operations according to the original IO process.

[0077] Before the step S1, there is also a step S00: Register the data encryption algorithm and key generation algorithm configured in the preset algorithm template on the operating system.

[0078] The step S00 includes:

[0079] Step S01: Check the defined algorithm initial configuration according to the preset algorithm template in sequence. After the check is correct, register the algorithm template on the operating system;

[0080] Step S02: After the algorithm template is registered, use the data encryption algorithm and key generation algorithm in the algorithm template to perform self-check on the encryption card;

[0081] Step S031: When the self-check passes and the number of encryption cards meets the application requirements, complete the registration of the algorithm template;

[0082] Step S032: When the self-check fails or the number of encryption cards does not meet the application requirements, remove all algorithms registered for this encryption card.

[0083] When the encryption / decryption service request is an encryption / decryption service request initiated by the creation of a logical volume for block storage, the step S4 includes:

[0084] Enter the operating system kernel through the read / write system call interface to access the virtual file system;

[0085] After the virtual file system recognizes that it is a block IO request, transfer the request to the general block layer for processing, and the general block layer further hands it over to the device mapper;

[0086] The device mapper finds the block storage encryption / decryption target driver kdcs according to the virtual block device accessed by the block IO request and the mapping table bound to the virtual block device;

[0087] The target driver module looks up the configured encryption and decryption algorithms from the operating system algorithm management module according to the mapping table bound by the device mapper. When the algorithm lookup fails, it returns an I / O error and ends the access request. When the algorithm lookup is successful, it calls the standard encryption and decryption interface corresponding to the encryption and decryption algorithm.

[0088] The standard encryption and decryption interface of the algorithm calls the encryption and decryption interface defined by the algorithm template that matches the encryption and decryption algorithm in the unified encryption subsystem.

[0089] The encryption and decryption interface defined by the algorithm template continues to call the encryption card driver interface adapted by the algorithm adaptation module to complete the encryption and decryption processing of the data.

[0090] The target driver module replaces the data in the I / O stack with the encrypted and decrypted data, then transfers the read / write request to the I / O scheduling layer for processing. The I / O scheduling layer further submits it to the block device to complete the read / write operation of the block storage, and ends the encryption and decryption service request initiated by the block storage when creating a logical volume.

[0091] When the encryption and decryption service request is an encryption and decryption service request initiated by file storage when mounting a file system, step S4 includes:

[0092] Enter the operating system kernel through the read / write system call interface to access the virtual file system.

[0093] The virtual file system transfers the request to the encrypted file system according to the operating system directory accessed by the file storage.

[0094] The encrypted file system looks up the encryption and decryption algorithms from the operating system algorithm management module according to the file system mount configuration. When the algorithm lookup fails, it returns an I / O error and ends the access request. When the algorithm lookup is successful, it calls the standard encryption and decryption interface corresponding to the encryption and decryption algorithm.

[0095] The standard encryption and decryption interface of the algorithm calls the encryption and decryption interface defined by the algorithm template that matches the encryption and decryption algorithm in the unified encryption subsystem.

[0096] The encryption and decryption interface defined by the algorithm template continues to call the encryption card driver interface adapted by the algorithm adaptation module to complete the encryption and decryption processing of the data.

[0097] The encrypted file system replaces the original data with the encrypted and decrypted data, then submits it to the block device to complete the read / write operation of the file system, and ends the encryption and decryption service request initiated by the file storage when mounting a file system.

[0098] When the encryption and decryption service request is an encryption and decryption service request initiated by object storage when starting an object, step S4 includes:

[0099] In user mode, according to the startup configuration of the object encryption and decryption service, look up the encryption and decryption algorithm from the operating system algorithm management module. When the algorithm lookup fails, return an I / O error and end the access request; when the algorithm lookup is successful, call the standard encryption and decryption interface corresponding to the encryption and decryption algorithm.

[0100] The standard encryption and decryption interface of the algorithm calls the encryption and decryption interface defined by the algorithm template that matches the encryption and decryption algorithm in the unified encryption subsystem.

[0101] The encryption and decryption interface defined by the algorithm template continues to call the encryption card driver interface adapted by the algorithm adaptation module to complete the encryption and decryption processing of the data.

[0102] Replace the original data of the object with the encrypted and decrypted data, and then call the object storage interface to complete the read and write operations of the object, ending the encryption and decryption service request initiated by the startup object for the object storage.

[0103] In the technical solution of the present invention, in the existing I / O system architecture, by implementing a unified encryption subsystem, a target driver kdcs, and an algorithm adaptation module, the differences in the underlying encryption card drivers are shielded, and different algorithms are constructed to support the encryption and decryption requirements of different storage systems through standard interfaces. The unified encryption subsystem provides functions such as encryption algorithm registration, encryption card scheduling, and key generation. Block storage, file storage, and object storage complete the encryption and decryption of data through a unified algorithm interface by calling their respective selected algorithms. Each storage type does not need to pay attention to the specific algorithm implementation and the differences in the underlying encryption cards, avoiding the impact on their respective storage I / O stacks. Compared with the prior art, it has at least the following advantages:

[0104] (1) The unified management of block storage, file storage, and object storage in one. Each storage type is completely decoupled from the specific implementation of the algorithm, the encryption card driver module, and the form of the encryption card interface, enabling each type of storage system and encryption and decryption algorithm to be developed independently, avoiding the drawback of having to modify the storage system when adapting to different encryption card types, significantly improving the development efficiency while ensuring the stability of the system.

[0105] (2) The unified encryption subsystem constructs a general layer between the operating system algorithm management module and the specific algorithm implementation of the encryption card, providing many general functions such as encryption card scheduling strategy, encryption card self-check, performance statistics, performance tuning, and encryption verification for various algorithms, so that when implementing the algorithm and adapting the encryption card, there is no need to pay too much attention to these complex function logics and strategy implementations, effectively ensuring the consistency of general function behaviors and the flexibility of function expansion.

[0106] (3) The unified encryption subsystem abstracts the algorithms that meet specific behaviors into algorithm templates. The algorithm templates not only natively support the general functions provided by the unified encryption subsystem, but also publish the relevant processing interfaces related to the specific encryption card interface form, encryption and decryption request initialization, etc. to the algorithm adaptation module for corresponding adaptation. This not only simplifies the support for multiple types of encryption cards, but also enables targeted performance optimization according to the encryption card or the specific storage application method.

[0107] (4) Since each type of storage system encrypts and decrypts data through standard algorithm interfaces, it supports each type of storage system to select different encryption and decryption algorithms as needed. Further, as long as the system supports multiple types of hardware encryption cards, it supports different types of storage systems to use different encryption cards to encrypt and decrypt data separately.

[0108] In addition, an embodiment of the present invention also provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the steps of the above unified encryption storage method are implemented.

[0109] Exemplarily, the computer program of the computer-readable storage medium includes computer program code, and the computer program code can be in the form of source code, object code, executable file or some intermediate form, etc. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disc, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal, and software distribution medium, etc.

[0110] In the description of this specification, the descriptions with reference to terms such as "one embodiment", "another embodiment", "other embodiments", or "the first embodiment to the Xth embodiment" mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, method steps, or characteristics described can be combined in a suitable manner in any one or more embodiments or examples.

[0111] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages and disadvantages of the embodiments.

[0112] The above are only the preferred embodiments of the present invention, and do not limit the patent scope of the present invention accordingly. Any equivalent structure or equivalent process transformation made by using the content of the specification and drawings of the present invention, or directly or indirectly applied in other related technical fields, shall be similarly included in the patent protection scope of the present invention.

Claims

1. A unified encrypted storage system, characterized in that, Including: A unified encryption subsystem, an algorithm adaptation module, a target-driven module, and an operating system algorithm management module; among them, The target-driven module is used to receive and respond to requests from the block storage to access and register the target-driven module through device mapper, and select and call the unified encryption subsystem to complete the encryption and decryption operations of the block storage; The unified encryption subsystem communicates with the operating system algorithm management module. The unified encryption subsystem includes: an encryption and decryption algorithm abstraction module, which is used to abstract algorithm rules matching the encryption and decryption algorithms for each encryption and decryption algorithm according to preset abstraction rules; a key generation algorithm abstraction module, which is used to abstract a random number generation algorithm for the key generation process of each encryption card according to preset abstraction rules; a virtual character device is used for direct access by the user-mode application management program, and in the form of ioctl system calls, the underlying encryption card is operated according to business needs; Multiple preset algorithm templates are stored in the unified encryption subsystem, and each algorithm template includes a common mechanism, an algorithm processing mechanism, a request processing mechanism, and a configuration management mechanism; The algorithm adaptation module is used to obtain the algorithm rules and random number generation algorithm matching the corresponding encryption and decryption algorithms from the unified encryption subsystem according to the retrieved algorithm template, and execute the corresponding encryption and decryption operations; Among them, the encryption and decryption algorithm abstraction module provides a unified abstraction for the implementation of each encryption and decryption algorithm, and is applicable to block encryption, file encryption, and object encryption; And the various common functional mechanisms in the encryption and decryption algorithms are uniformly implemented to form a common sub-module for the encryption and decryption algorithms; Among them, the key generation algorithm abstraction module registers with the operating system algorithm management module based on the operating system random number generator framework, and provides a consistent processing interface for each application in the form of an algorithm; Among them, the encryption and decryption algorithms registered by the encryption and decryption algorithm abstraction module and the key generation algorithm abstraction module support the operating system standard crypto API; Block encryption storage, file encryption storage, and object encryption storage access the corresponding algorithms through the crypto API to complete key generation, key loading, and data encryption and decryption processing to implement block encryption storage, file encryption storage, and object encryption storage; Access the corresponding algorithms through the crypto API to complete key generation, key loading, and data encryption and decryption processing, and have a unified operation view based on the algorithms.

2. The unified encrypted storage system according to claim 1, wherein The algorithm rules matching the encryption and decryption algorithms include an encryption card scheduling strategy, an encryption card self-check rule, a performance statistics rule, a performance tuning rule, and an encryption verification rule.

3. The unified encrypted storage system according to claim 1, characterized in that, The unified encryption subsystem is also used to register the data encryption algorithm and key generation algorithm configured by the preset algorithm template on the operating system.

4. A unified encryption storage method for a unified encryption storage system as described in any one of claims 1-3, characterized in that, Including steps: Step S1, in response to an encryption / decryption service request, determine the encryption algorithm corresponding to the encryption / decryption service request and complete the setting of the initial attributes of the encryption algorithm; wherein, the encryption / decryption service request includes an encryption / decryption service request initiated by block storage when creating a logical volume, an encryption / decryption service request initiated by file storage when mounting a file system, and an encryption / decryption service request initiated by object storage when starting an object. Step S2, in the IO process, find the selected encryption algorithm through the crypto API, call the corresponding standard key generation interface and data encryption / decryption interface, and obtain a preset algorithm template through the algorithm standard interface; wherein, the algorithm template includes a common mechanism, an algorithm processing mechanism, a request processing mechanism, and a configuration management mechanism. Step S3, parse the algorithm configuration and operation parameters according to the abstracted algorithm template, and call the encryption card driver interface according to the form of the encryption card driver interface to complete the data encryption / decryption process. Step S4, use the data after the encryption / decryption operation to replace the source data in the IO process, and continue to complete the data read / write operation according to the original IO process.

5. The method according to claim 4, wherein Before the step S1, there is also step S00: register the data encryption algorithm and key generation algorithm configured in the preset algorithm template on the operating system.

6. The method according to claim 5, characterized in that, The step S00 includes: Step S01, sequentially verify the initial algorithm configuration defined according to the preset algorithm template, and after verification, register the algorithm template on the operating system. Step S02, after registering the algorithm template, use the data encryption algorithm and key generation algorithm in the algorithm template to perform a self-check on the encryption card. Step S031, when the self-check is passed and the number of encryption cards meets the application requirements, complete the registration of the algorithm template. Step S032, when the self-check fails or the number of encryption cards does not meet the application requirements, remove all algorithms registered for this encryption card.

7. The method according to claim 4, wherein When the encryption / decryption service request is an encryption / decryption service request initiated by block storage when creating a logical volume, the step S4 includes: Enter the operating system kernel through the read / write system call interface and access the virtual file system. After the virtual file system recognizes that it is a block IO request, transfer the request to the general block layer for processing, and the general block layer further hands it over to the device mapper. The device mapper finds the block storage encryption / decryption target driver kdcs according to the virtual block device accessed by the block IO request and the mapping table bound to the virtual block device. The target driver module searches for the configured encryption / decryption algorithm from the operating system algorithm management module according to the mapping table bound by the device mapper. When the algorithm search fails, return an IO error and end the access request; when the algorithm search is successful, call the standard encryption / decryption interface corresponding to the encryption / decryption algorithm. The algorithm standard encryption / decryption interface calls the encryption / decryption interface defined by the algorithm template that matches the encryption / decryption algorithm in the unified encryption subsystem. The encryption / decryption interface defined by the algorithm template continues to call the encryption card driver interface adapted by the algorithm adaptation module to complete the data encryption / decryption process. The target-driven module replaces the data in the IO stack with the encrypted and decrypted data, and then transfers the read / write request to the IO scheduling layer for processing. The IO scheduling layer further submits it to the block device to complete the read / write operation of the block storage, and ends the encryption and decryption service request initiated by the block storage when creating a logical volume.

8. The method according to claim 4, wherein When the encryption and decryption service request is an encryption and decryption service request initiated by a file storage when mounting a file system, step S4 includes: The virtual file system transfers the request to the encrypted file system according to the operating system directory accessed by the file storage. The encrypted file system looks up the encryption and decryption algorithm from the operating system algorithm management module according to the file system mount configuration. When the algorithm lookup fails, it returns an IO error and ends the access request. When the algorithm lookup is successful, it calls the standard encryption and decryption interface corresponding to the encryption and decryption algorithm. The encrypted file system replaces the original data with the encrypted and decrypted data, and then submits it to the block device to complete the read / write operation of the file system, and ends the encryption and decryption service request initiated by the file storage when mounting the file system.

9. The method according to claim 4, characterized in that, When the encryption and decryption service request is an encryption and decryption service request initiated by an object storage when starting an object, step S4 includes: In the user mode, look up the encryption and decryption algorithm from the operating system algorithm management module according to the object encryption and decryption service start configuration. When the algorithm lookup fails, return an IO error and end the access request. When the algorithm lookup is successful, call the standard encryption and decryption interface corresponding to the encryption and decryption algorithm. Replace the original data of the object with the encrypted and decrypted data, and then call the object storage interface to complete the read / write operation of the object, and end the encryption and decryption service request initiated by the object storage when starting the object.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the unified encrypted storage method according to any one of claims 4 to 9.

Images