A transparent encryption and decryption method

Abstract

A transparent encryption and decryption method, the method comprising the steps of: configuring a management layer; setting a transparent encryption and decryption layer; obtaining a confidential file; and transparently encrypting and decrypting the confidential file using the transparent encryption and decryption layer. The transparent encryption and decryption method provided by the present application fills the problem of relying on a specific file system for transparent encryption and decryption. The kernel object file generated in the solution process is reusable and supports secondary development under the Linux platform.

Description

Technical Field

[0001] The invention belongs to the technical field of information security, and in particular relates to a transparent encryption and decryption method. Background Art

[0002] With the rapid development of information technology, in order to pursue the security and reliability of information and prevent the leakage of confidential information, various technical means such as closed control, interception, and encryption have been adopted. These means are certainly effective and reliable, but since users are required to perform encryption and decryption operations each time they are used, the user experience and work efficiency are greatly affected.

[0003] In order to improve efficiency, many encrypted file systems have emerged at this stage, providing users with a good experience of encryption and decryption, but limiting the user's freedom to store file information, which can only be stored in the current file system directory.

[0004] In order to get rid of these restrictions and realize free, safe and reliable information storage, "transparent encryption and decryption" came into being. Simply put, transparent encryption and decryption means that the encryption and decryption process will not be noticed by the user. When the user opens or edits a protected file, the system will automatically encrypt the unencrypted file and decrypt the encrypted file. The file is stored in ciphertext on the hard disk and in plaintext in the memory. Once the use environment is changed, it cannot be opened because the automatic decryption service cannot be obtained, thereby achieving the purpose of protecting the file content.

[0005] Most of the transparent encryption and decryption solutions in the prior art are based on wrapfs, which are implemented by mounting the wrapfs file system on a specific file system. During initialization, the wrapfs file system is mounted on a specific file system, and then a decryption unit is added to the read function of the wrapfs layer and an encryption unit is added to the write function, thereby realizing transparent encryption and decryption of files.

[0006] Although the existing technology can realize transparent encryption and decryption of data, it is only some wrapfs-based solutions, which require an underlying file system directory that has been mounted through other file systems, and then this existing, mounted directory must be mounted to the / mnt / wrapfs directory before it can be used. Summary of the invention

[0007] To solve the above problems, the present invention provides a transparent encryption and decryption method, which comprises the following steps:

[0008] Configuration management layer;

[0009] Set up a transparent encryption and decryption layer;

[0010] Access to confidential documents;

[0011] The transparent encryption and decryption layer is used to transparently encrypt and decrypt the confidential file.

[0012] Preferably, the configuration management layer comprises the steps of:

[0013] Install configuration management software;

[0014] Use the configuration management software to open the confidential file;

[0015] Get the current process in the VFS layer;

[0016] Determine whether the current process is a configuration management process;

[0017] If so, determine whether the confidential document needs to be treated as confidential;

[0018] If not, return to the step of installing the configuration management software;

[0019] If so, the confidential documents shall be treated as confidential;

[0020] If not, continue to open the confidential file.

[0021] Preferably, the confidentiality processing of the confidentiality file comprises the steps of:

[0022] Initialize a hash list node;

[0023] Get the file structure of the confidential file;

[0024] Calculate the key value of the hash list node according to the structure;

[0025] Inserting the structure and the node information of the hash list node into the hash list;

[0026] Filling confidentiality level information in the hash chain table;

[0027] The hash chain list is written into the header of the confidential file.

[0028] Preferably, the setting of the transparent encryption and decryption layer comprises the steps of:

[0029] Open any file;

[0030] Read the header confidentiality field of the open file;

[0031] Determine whether the header confidentiality field has a confidentiality level field;

[0032] If yes, encrypt the opened file;

[0033] If not, continue opening the open file.

[0034] Preferably, the encryption process of the open file comprises the steps of:

[0035] Initialize a hash list node;

[0036] Get the structure of the open file;

[0037] Calculate the key value of the hash list node according to the structure;

[0038] Insert the file structure and the hash list node into the hash list;

[0039] Generate the key value required for encryption and decryption through the file structure.

[0040] Preferably, the transparent encryption and decryption of the confidential file by using the transparent encryption and decryption layer comprises the following steps:

[0041] Performing a write confidentiality operation on the confidentiality file;

[0042] Performing a read confidentiality operation on the confidentiality file;

[0043] A closing operation is performed on the confidential file.

[0044] The transparent encryption and decryption method provided by the present application fills the problem of relying on a specific file system for transparent encryption and decryption. The kernel object file generated in the solution process is reusable and supports secondary development under the Linux platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0046] Figure 1 It is a schematic diagram of a transparent encryption and decryption method provided by the present invention;

[0047] Figure 2 It is a schematic diagram of a transparent encryption and decryption method provided by the present invention;

[0048] Figure 3 It is a schematic diagram of a transparent encryption and decryption method provided by the present invention;

[0049] Figure 4 It is a schematic diagram of a transparent encryption and decryption method provided by the present invention;

[0050] Figure 5It is a schematic diagram of a transparent encryption and decryption method provided by the present invention;

[0051] Figure 6 It is a schematic diagram of a transparent encryption and decryption method provided by the present invention. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concept of the present invention.

[0053] like Figure 1 In an embodiment of the present application, the present invention provides a transparent encryption and decryption method, the method comprising the steps of:

[0054] S1: Configuration management layer;

[0055] In the embodiment of the present application, the configuration management layer includes the steps of:

[0056] Install configuration management software;

[0057] Use the configuration management software to open the confidential file;

[0058] Get the current process in the VFS layer;

[0059] Determine whether the current process is a configuration management process;

[0060] If so, determine whether the confidential document needs to be treated as confidential;

[0061] If not, return to the step of installing the configuration management software;

[0062] If so, the confidential documents shall be treated as confidential;

[0063] If not, continue to open the confidential file.

[0064] like Figure 2 and 3 In the embodiment of the present application, the configuration and creation of confidentiality files under the Linux platform includes multiple detailed steps, and the specific process is as follows:

[0065] When creating a new secret file:

[0066] (1) Open the "User Configuration Management" software;

[0067] (2) "User Configuration Management" software opens a new confidentiality file; choose whether to create a confidentiality file;

[0068] (3) Step (2) enters the VFS layer through a system call, and determines in the do_sys_open function of the VFS layer whether the current process is a "user configuration management" process. If so, determines whether to perform confidentiality processing on the file. If so, proceeds to step (4); if not, proceeds to step (5);

[0069] (4) Confidentiality treatment:

[0070] (5) Execute the subsequent actions of open;

[0071] Finish.

[0072] In an embodiment of the present application, the confidentiality processing of the confidentiality file includes the steps of:

[0073] Initialize a hash list node;

[0074] Get the file structure of the confidential file;

[0075] Calculate the key value of the hash list node according to the structure;

[0076] Inserting the structure and the node information of the hash list node into the hash list;

[0077] Filling confidentiality level information in the hash chain table;

[0078] The hash chain list is written into the header of the confidential file.

[0079] In the embodiment of the present application, the specific steps of performing confidentiality processing on the confidentiality file are as follows:

[0080] a. Initialize a hash list node;

[0081] b. Calculate the hash key value by opening the address of the file structure of the file;

[0082] c. Insert the file structure and initialized node information into the hash list;

[0083] d. Fill in the corresponding confidentiality level information and write it into the file header.

[0084] S2: Set up transparent encryption and decryption layer;

[0085] In an embodiment of the present application, the setting of the transparent encryption and decryption layer includes the steps of:

[0086] Open any file;

[0087] Read the header confidentiality field of the open file;

[0088] Determine whether the header confidentiality field has a confidentiality level field;

[0089] If yes, encrypt the opened file;

[0090] If not, continue opening the open file.

[0091] In the embodiment of the present application, the specific steps of setting the transparent encryption and decryption layer are as follows:

[0092] When opening an existing file:

[0093] (1) The user opens an existing file using any file reading software;

[0094] (2) Step (1) enters the VFS layer through a system call, reads the confidentiality field of the file header in the do_sys_open function of the VFS layer, and determines whether the field has a confidentiality level field. If it is a confidential file, it proceeds to step (3); if it is a non-confidential file, it proceeds to step (4);

[0095] (3) When it is determined that the file is confidential, encrypting the opened file;

[0096] (4) Execute the subsequent actions of open.

[0097] In an embodiment of the present application, the encryption processing of the open file includes the steps of:

[0098] Initialize a hash list node;

[0099] Get the structure of the open file;

[0100] Calculate the key value of the hash list node according to the structure;

[0101] Insert the file structure and the hash list node into the hash list;

[0102] Generate the key value required for encryption and decryption through the file structure.

[0103] In the embodiment of the present application, encrypting the open file specifically includes the following steps:

[0104] a. Initialize a hash list node;

[0105] b. Calculate the hash key value by opening the address of the file structure of the file;

[0106] c. Insert the file structure and the initialized buffer into the hash list;

[0107] d. Generate the key value required for encryption and decryption.

[0108] S3: Access to confidential documents;

[0109] S4: Utilize the transparent encryption and decryption layer to transparently encrypt and decrypt the confidential file.

[0110] In an embodiment of the present application, the transparent encryption and decryption of the confidential file using the transparent encryption and decryption layer includes the following steps:

[0111] Performing a write confidentiality operation on the confidentiality file;

[0112] Performing a read confidentiality operation on the confidentiality file;

[0113] A closing operation is performed on the confidential file.

[0114] like Figure 4 In the embodiment of the present application, the specific steps of performing a write confidentiality operation on the confidentiality file are as follows:

[0115] (1) The user performs a write operation on an open file;

[0116] (2) Step (1) enters the VFS layer through a system call, calculates a hash value through the file structure address in the vfs_write function of the VFS layer, and searches the hash linked table for the corresponding confidential node information based on the hash value. If the node exists, proceed to step (3); if the confidential node information is not found, proceed to step (4);

[0117] (3) Encrypt confidential files:

[0118] a: Determine whether the length of the written data is less than the length of the buffer; if the written length is less than the length of the buffer, proceed to step (b); if the written length is greater than the length of the buffer, proceed to step (c);

[0119] b: Put the data into the buffer. When the user executes the close action or when the buffer is full, go to step c;

[0120] c: where the data is encrypted;

[0121] (4) Execute the subsequent actions of write;

[0122] Finish.

[0123] like Figure 5 In the embodiment of the present application, the specific steps of performing the read confidentiality operation on the confidentiality file are as follows:

[0124] (1) The user performs a read operation on an open file;

[0125] (2) Step (1) enters the VFS layer through a system call, calculates a hash value through the file structure address in the vfs_read function of the VFS layer, and searches the hash linked table for the corresponding confidential node information based on the hash value. If the node exists, proceed to step (3); if the confidential node information is not found, proceed to step (4);

[0126] (3) Perform read operations on confidential files:

[0127] a: Check whether there is data in the buffer; when there is no data in the buffer, go to step (d); when there is data in the buffer, go to step (b);

[0128] b: Check whether the data in the buffer satisfies the length of the data to be read; if it satisfies the length to be read, proceed to step (c); if it does not satisfy the length to be read, proceed to step (d);

[0129] c: Get the data in the buffer and go to step (f);

[0130] d: read out the buffer data;

[0131] e: Read data from the specific file system, put it into the buffer, call the decryption unit, and decrypt the buffer data;

[0132] f: Return the decrypted data to the user;

[0133] (4) Execute the subsequent actions of read;

[0134] (5)End.

[0135] like Figure 6 In the embodiment of the present application, the specific steps of performing the closing operation on the confidentiality file are as follows:

[0136] (1) The user closes an open file;

[0137] (2) Step (1) enters the VFS layer through a system call, calculates a hash value through the file structure address in the filp_close function of the VFS layer, and searches the hash linked list for the corresponding confidential node information based on the hash value. If the node exists, proceed to step (3);

[0138] (3) Close the confidential file:

[0139] a: Determine whether there is data in the buffer of the node. If there is data, call the encryption unit to encrypt the data; if there is no data, go to step (4);

[0140] b: Write the encrypted data into the file system;

[0141] (4) Execute the close follow-up action.

[0142] (5)End.

[0143] The transparent encryption and decryption method provided by the present application fills the problem of relying on a specific file system for transparent encryption and decryption. The kernel object file generated in the solution process is reusable and supports secondary development under the Linux platform.

[0144] It should be understood that the above specific embodiments of the present invention are only used to illustrate or explain the principles of the present invention, and do not constitute a limitation of the present invention. Therefore, any modifications, equivalent substitutions, improvements, etc. made without departing from the spirit and scope of the present invention should be included in the protection scope of the present invention. In addition, the appended claims of the present invention are intended to cover all changes and modifications that fall within the scope and boundaries of the appended claims, or the equivalent forms of such scope and boundaries.

Claims

1. A transparent encryption and decryption method, characterized in that: The method comprises the steps of: Configuration management layer; Set up a transparent encryption and decryption layer; Access to confidential documents; Using the transparent encryption and decryption layer to transparently encrypt and decrypt the confidential file; The configuration management layer comprises the steps of: Install configuration management software; Use the configuration management software to open the confidential file; Get the current process in the VFS layer; Determine whether the current process is a configuration management process; If so, determine whether the confidential document needs to be treated as confidential; If not, return to the step of installing the configuration management software; If so, the confidential documents shall be treated as confidential; If not, continue to open the confidential file; The confidentiality treatment of the confidential document comprises the steps of: Initialize a hash list node; Get the file structure of the confidential file; Calculate the key value of the hash list node according to the file structure; Insert the file structure and the node information of the hash list node into the hash list; Filling confidentiality level information in the hash chain table; Writing the hash chain table into the header of the confidential file; The setting of the transparent encryption and decryption layer comprises the steps of: Open any file; Read the header confidentiality field of the open file; Determine whether the header confidentiality field has a confidentiality level field; If yes, encrypt the opened file; If not, continue to open the open file; The encryption process of the open file comprises the steps of: Initialize a hash list node; Get the file structure of the open file; Calculate the key value of the hash list node according to the file structure; Insert the file structure and the hash list node into the hash list; Generate the key value required for encryption and decryption through the file structure.

2. The transparent encryption and decryption method according to claim 1, characterized in that: The transparent encryption and decryption of the confidential file by using the transparent encryption and decryption layer comprises the following steps: Performing a write confidentiality operation on the confidentiality file; Performing a read confidentiality operation on the confidentiality file; A closing operation is performed on the confidential file.

Images