Method and apparatus for fast generation of large files on encrypted file systems

Abstract

The application discloses a method and device for quickly generating a large file on an encrypted file system (ecryptfs). The method comprises the following steps: a large file is created on a common file system by using a 'hole file' technology; a file size is updated to determine a file size after decryption by the encrypted file system (ecryptfs); a mounting scheme of the encrypted file system (ecryptfs) is formulated; control data is configured according to the mounting scheme of the encrypted file system (ecryptfs), wherein the control data comprises an encryption algorithm, a salt value of a key and a digest of the key; the large file is placed in a specified file directory, and the encrypted file system (ecryptfs) is installed in the file directory according to the mounting scheme. It can be seen that the application can flexibly generate a large file on the encrypted file system (ecryptfs) according to different keys, different file sizes and different encryption algorithms, thereby greatly improving the efficiency.

Description

Technical Field

[0001] This invention relates to the field of computers, and in particular to a method and apparatus for rapidly generating large files on the ecryptfs encrypted file system. Background Technology

[0002] The rapid development of the internet age has accelerated the informatization process of enterprises, resulting in a large amount of confidential data existing in the form of electronic documents, which are disseminated in various ways. Protecting confidential data from leakage is a security issue facing enterprises today.

[0003] ecryptfs (Enterprise Cryptographic File System) is an enterprise cryptographic file system for the Linux platform, featuring advanced key management. When ecryptfs is installed / mounted to a directory on a Linux system, the contents of the original directory are overwritten by the ecryptfs layer. Data read from or written to files in the directory will be processed by the ecryptfs layer (encryption or decryption; writing data is encryption, reading data is decryption).

[0004] As an encrypted file system, creating large files on ecryptfs is very time-consuming because each byte must be encrypted using an encryption algorithm to obtain ciphertext before being stored on the disk medium. If every byte of a large file is valid data and truly needs to be stored encrypted, then the time spent on this encryption process cannot be omitted. However, in application scenarios involving large files where not all bytes are valid, existing methods for generating large files on the ecryptfs encrypted file system are very inefficient.

[0005] Large files, not all of which are valid, will initially occupy storage space, with valid data gradually being filled in during software operation. The most typical example of such large files is a file system image file. A file system image is created by first creating the large file and then formatting it according to a specific file system format. When using a file system image, it needs to be mounted to a specific directory. Subsequent operations on that directory, including writing and reading files, will be reflected in the file system image. If the file image is unmounted from that directory, the directory will contain the content before the image was mounted; at this point, the directory and the image are no longer related. Data manipulated after mounting the directory is persistently stored in the file image. Such file system image files have many applications, such as disk emulation for virtual machines and firmware images for embedded systems.

[0006] The purposes of creating large files are varied, such as creating virtual machine disks or file system images. Large files can be created using existing command-line tools or through code. Regardless of the method, current technology for creating large files on the ecryptfs encrypted file system involves byte-by-byte encryption, resulting in significant time consumption. Creating large files on ordinary, unencrypted files can improve efficiency using the "hollow file" method—leaving numerous gaps in the file without writing any data—which can also quickly create large files. However, due to the control data limitations of the ecryptfs encrypted file system, existing methods for creating large files using "hollow files" are not suitable for ecryptfs.

[0007] Improving the efficiency of generating large files on the ecryptfs encrypted file system in scenarios involving large files where not all bytes are valid has become an urgent problem to be solved. Summary of the Invention

[0008] In view of the above problems, the present invention is proposed to provide a method and apparatus for rapidly generating large files on the encrypted file system ecryptfs to overcome or at least partially solve the above problems.

[0009] One embodiment of the present invention provides a method for quickly generating large files on the ecryptfs encrypted file system, comprising:

[0010] Create large files in a regular file system using the "hollow file" technique;

[0011] Update file size to determine the file size after decryption via the ecryptfs encrypted file system;

[0012] Develop a mounting scheme for the ecryptfs encrypted file system;

[0013] Configure control data according to the mounting scheme of the encrypted file system ecryptfs, the control data including the encryption algorithm, the salt value of the key and the digest of the key;

[0014] Place the large file in the specified file directory, and install the encrypted file system ecryptfs in the file directory according to the mounting scheme.

[0015] Optionally, the mounting scheme for the ecryptfs encrypted file system includes:

[0016] Develop encryption algorithms;

[0017] Set the salt values ​​for the password and key, place the key generated using the salt values ​​of the password and key as factors in the kernel, and obtain the key digest.

[0018] Optionally, placing the key generated using the salt values ​​of the password and the key as factors in the kernel includes:

[0019] Disassemble the mount command program mount.ecryptfs and extract the code in mount.ecryptfs that inserts the key into the kernel;

[0020] The code generates a key that is factored by the salt value of the password and the key and places it in the kernel.

[0021] Optionally, the configuration control data according to the mounting scheme of the ecryptfs encrypted file system includes:

[0022] Write the salt value of the encryption algorithm and key into the first data packet tag 3;

[0023] Write the digest of the key into the second data packet tag 11.

[0024] Another embodiment of the present invention provides an apparatus for rapidly generating large files on an ecryptfs encrypted file system, the apparatus comprising:

[0025] The large file creation unit is used to create large files in a regular file system using the "hollow file" technique;

[0026] The file size determination unit is used to update the file size and determine the file size after decryption by the encrypted file system ecryptfs.

[0027] Mount scheme formulation unit, used to formulate the mount scheme of the encrypted file system ecryptfs;

[0028] A control data configuration unit is used to configure control data according to the mounting scheme of the encrypted file system ecryptfs. The control data includes an encryption algorithm, a salt value of the key, and a digest of the key.

[0029] An encrypted file system mounting unit is used to place the large file into a specified file directory and install the encrypted file system ecryptfs in the file directory according to the mounting scheme.

[0030] Optionally, the mounting scheme formulation unit includes:

[0031] The encryption algorithm specification module is used to specify encryption algorithms.

[0032] The key setting module is used to set the salt value of the password and the key, place the key generated with the salt value of the password and the key as a factor in the kernel, and obtain the key digest.

[0033] Optionally, the key setting module is further configured to:

[0034] Disassemble the mount command program mount.ecryptfs and extract the code in mount.ecryptfs that inserts the key into the kernel;

[0035] The code generates a key that is factored by the salt value of the password and the key and places it in the kernel.

[0036] Optionally, the control data configuration unit is further configured to:

[0037] Write the salt value of the encryption algorithm and key into the first data packet tag 3;

[0038] Write the digest of the key into the second data packet tag 11.

[0039] Another embodiment of the present invention provides an electronic device, wherein the electronic device includes:

[0040] Processor; and,

[0041] The memory is configured to store computer-executable instructions, which, when executed, cause the processor to perform the aforementioned method for rapidly generating large files on the ecryptfs encrypted file system.

[0042] Another embodiment of the present invention provides a computer-readable storage medium storing one or more programs that, when executed by a processor, implement the above-described method for rapidly generating large files on the ecryptfs encrypted file system.

[0043] The beneficial effects of this invention are that after installing the ecryptfs encrypted file system in the file directory according to the established mounting scheme, large files in the file directory can be used directly, and their file size is the pre-set file size. Subsequent operations include formatting the file system and appending valid data. This invention can flexibly and quickly create large files on the ecryptfs encrypted file system based on different keys, file sizes, and encryption algorithms, greatly improving efficiency. Attached Figure Description

[0044] Figure 1 This is a flowchart illustrating a method for rapidly generating large files on an ecryptfs encrypted file system according to an embodiment of the present invention.

[0045] Figure 2 This is a schematic diagram of the ecryptfs encrypted file system according to an embodiment of the present invention;

[0046] Figure 3 This is a schematic diagram of a device for rapidly generating large files on an ecryptfs encrypted file system according to an embodiment of the present invention;

[0047] Figure 4 A schematic diagram of the structure of an electronic device according to an embodiment of the present invention is shown;

[0048] Figure 5 A schematic diagram of the structure of a computer-readable storage medium according to an embodiment of the present invention is shown. Detailed Implementation

[0049] To improve the efficiency of generating large files, the existing method for generating large files with incomplete bytes on the ecryptfs encrypted file system can be optimized. This optimization process is the improvement point of this invention.

[0050] The solution to the problems mentioned above is to create a large file image in advance, that is, to create a large file image before using the encrypted file system ecryptfs. Since the content of large files does not need to be encrypted in a non-ecryptfs environment, and the "hollow file" method can be combined (that is, the content of the large file created has holes in the middle, that is, there is no data), large files can be created quickly.

[0051] However, such large files are no different from ordinary files in the ecryptfs encrypted file system. They are all treated as pass-through files (ecryptfs has an optional pass-through function, which means that files in the original directory that were not encrypted through the ecryptfs layer will be "passed through" without any encryption or decryption operations; if the pass-through function of ecryptfs is turned off, then all files are treated as ciphertext files. However, ordinary files do not have key digest information, so it is impossible to know how to process ordinary files. As a result, when such files are accessed through the ecryptfs layer, they will get an inaccessible error), thus losing the encryption function or getting an inaccessible file error.

[0052] Files encrypted using the ecryptfs encrypted file system store not only the ciphertext data obtained by the encryption algorithm from the original plaintext data, but also some additional control data. This control data includes the digest of the key used for encryption and decryption, the encryption and decryption algorithms used, the hashing algorithm used, and the file size information. Control data can be placed in the file's extended attributes or at the beginning of the file. Placing it at the beginning is more universal and offers better system portability, since some file system formats do not support extended attributes.

[0053] To improve efficiency, if creating large files on ecryptfs doesn't utilize the method of this invention, a workaround is to create the large files on ecryptfs beforehand, as follows:

[0054] First, a key is created in the system kernel. Then, the key digest is used to mount ecryptfs. Finally, a large file is actually created on the mounted ecryptfs (a "hole file" technique can be used during this process, but it is not effective, as the "hole" is treated as a byte with zero content for encryption). This process takes a long time (on an eMMC 4.0 storage medium, with a CPU and 1.5G of memory and 6 cores, creating a 30G file takes 15 to 30 minutes).

[0055] After the file creation is complete, the ecryptfs file system is unmounted, and the large file in the directory is now encrypted with ecryptfs.

[0056] Save this large file, and copy it directly to each application scenario requiring this functionality. After mounting ecryptfs, it can be used directly without additional encryption. This method does not significantly improve efficiency and cannot change the file size, encryption key, or encryption algorithm.

[0057] The purpose of this invention is to improve efficiency by creating large file images in advance, and to enable the mounted encrypted file system ecryptfs to recognize the large file images without limiting the key digest.

[0058] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0059] Figure 1 This is a flowchart illustrating a method for quickly generating large files on the ecryptfs encrypted file system, according to an embodiment of the present invention. Figure 1 As shown, the method of this embodiment of the invention includes:

[0060] S11: Create large files in a normal file system using the "hollow file" technique;

[0061] Compared to existing technologies that create large files on ecryptfs and require each byte to be encrypted before being stored on disk, this invention significantly improves efficiency by using "hollow file" technology to create large files on a regular file system.

[0062] S12: Update file size, determine the file size after decryption via the encrypted file system ecryptfs;

[0063] In practical applications, the file size occupies four bytes and adopts big-endian byte order. This file size specifies the file size after being decrypted by ecryptfs.

[0064] S13: Develop a mounting scheme for the ecryptfs encrypted file system;

[0065] S14: Configure control data according to the mounting scheme of the encrypted file system ecryptfs, wherein the control data includes the encryption algorithm, the salt value of the key, and the digest of the key;

[0066] Encrypted files created using ecryptfs include not only ciphertext data (obtained from the original plaintext data) but also file control information, such as file size, encryption key, and encryption algorithm. ecryptfs identifies encrypted files based on this control information. Once successfully identified, ecryptfs can function normally on the ciphertext file, performing read / decryption and write encryption. The core technical concept of this invention is to pre-configure ecryptfs control data for large files from the user's perspective, based on the standard specifications for ecryptfs file control information.

[0067] S15: Place the large file in the specified file directory, and install the encrypted file system ecryptfs in the file directory according to the mounting scheme.

[0068] Figure 2 This is a schematic diagram of the ecryptfs encrypted file system, an embodiment of the present invention. Figure 2 As shown, a directory in a normal file system becomes a ciphertext directory after the ecryptfs layer is mounted. When an upper-layer application accesses this directory, it only sees a plaintext directory that has been overlaid with the ecryptfs layer. Subsequent operations on this directory require conversion by the ecryptfs layer. After the ecryptfs is unmounted, the original directory contains ciphertext files encrypted by ecryptfs (files that existed before the ecryptfs was mounted can also be passed through, as described above).

[0069] The core of this invention lies in how to create large virtual disk files. The core technical concept is to create encrypted large files using the "hollow file" technology before mounting ecryptfs. During creation, it is ensured that after mounting ecryptfs, the large files can be recognized normally and used normally by upper-layer applications.

[0070] When a user application issues a read data request, the request is translated into a kernel call and passed to the ecryptfs file encryption system. The ecryptfs system then passes this call to the underlying file system and reads the data from the storage medium. The read data is returned to the ecryptfs system, where its encryption / decryption interface is called to decrypt the data, and the processed data is then returned to the user application. Once the user has finished manipulating the file directory data, the ecryptfs layer is removed, revealing the original directory contents as the encrypted data.

[0071] After installing the ecryptfs encrypted file system in the file directory according to the established mounting scheme, large files in the file directory can be used directly, with their file size being the pre-set size. Subsequent operations include formatting the file system and appending valid data. This invention can flexibly create large files quickly on the ecryptfs encrypted file system based on different keys, file sizes, and encryption algorithms, greatly improving efficiency.

[0072] In an optional embodiment of the present invention, the step of formulating the mounting scheme for the ecryptfs encrypted file system includes:

[0073] Develop encryption algorithms;

[0074] Set the salt values ​​for the password and key, place the key generated using the salt values ​​of the password and key as factors in the kernel, and obtain the key digest.

[0075] In practical applications, the key can be 740 bytes.

[0076] It should be noted that passwords and keys are different. Passwords are controlled by the user, are generally short, and are mostly a combination of printable characters, numbers, and special characters, usually between 4 and 20 characters long; while the keys used by the kernel are much longer, with a typical ecryptfs key being 740 bytes and being pure binary, which is not an intelligible character.

[0077] The role of salt can be understood as a remedial mechanism implemented by the system to prevent users from entering passwords that are too simple.

[0078] Specifically, placing the key generated using the salt value of the password and the key as factors in the kernel includes:

[0079] Disassemble the mount command program mount.ecryptfs and extract the code in mount.ecryptfs that inserts the key into the kernel;

[0080] The code generates a key that is factored by the salt value of the password and the key and places it in the kernel.

[0081] The common practice of storing the key in the kernel is as follows: the ecryptfs mount command program `mount.ecryptfs` requests a password from the user during the mounting process. The program then automatically generates a random value as the salt for the user's password. This random value, combined with the password, serves as a factor in generating the final key. After key generation, the program places the key into the kernel via the `addkey` system call. No backup is left in user space (subsequent encryption and decryption rely on this key, not the password or salt), only the key digest is retained. This digest essentially represents the key stored in the kernel. The actual mounting process occurs after the key is prepared. The key digest is used as one parameter, along with the encryption algorithm as another. These two parameters together are used to mount the ecryptfs filesystem. The `mount.ecryptfs` command loader can complete all of these steps.

[0082] In this embodiment of the invention, the usual approach described above cannot place the key in the kernel because this embodiment of the invention involves preparing a "large encrypted file" in advance. This embodiment of the invention requires adding the key to the kernel first, obtaining the key digest, and preparing the encryption algorithm to be used in advance. After all preparations are complete, the large file is set. Therefore, setting the key in the kernel cannot be done using the usual mount.ecryptfs tool. It is necessary to disassemble mount.ecryptfs and extract the code part that inserts the key into the kernel. Since mount.ecyptfs is open source code, this can be done entirely.

[0083] Specifically, the configuration control data based on the mounting scheme of the ecryptfs encrypted file system includes:

[0084] Write the salt value of the encryption algorithm and key into the first data packet tag 3;

[0085] Write the digest of the key into the second data packet tag 11.

[0086] In practical applications, the standard format of control data for the file encryption system ecryptfs is as follows:

[0087]

[0088] Understandably, after updating the file size, a special flag also needs to be updated, and the special flag is actually a random value.

[0089] You don't need to worry about the other parts of the control data; just copy it from the header of any encrypted file in the actual system.

[0090] Figure 3 This is a schematic diagram of a device for rapidly generating large files on the ecryptfs encrypted file system, according to an embodiment of the present invention. Figure 3 As shown, the apparatus of this embodiment includes:

[0091] Large file creation unit 31 is used to create large files in a normal file system using the "hollow file" technique;

[0092] File size determination unit 32 is used to update the file size and determine the file size after decryption by the encrypted file system ecryptfs;

[0093] Mount scheme formulation unit 33 is used to formulate the mount scheme of the encrypted file system ecryptfs;

[0094] The control data configuration unit 34 is used to configure control data according to the mounting scheme of the encrypted file system ecryptfs. The control data includes the encryption algorithm, the salt value of the key, and the digest of the key.

[0095] The encrypted file system mounting unit 35 is used to place the large file into a specified file directory and install the encrypted file system ecryptfs in the file directory according to the mounting scheme.

[0096] In this embodiment of the invention, after installing the ecryptfs encrypted file system in the file directory according to the established mounting scheme, large files in the file directory can be used directly, with their file size being the pre-set file size. Subsequent operations include formatting the file system and appending valid data. This embodiment of the invention can flexibly create large files quickly on the ecryptfs encrypted file system based on different keys, file sizes, and encryption algorithms, greatly improving efficiency.

[0097] In an optional embodiment of the present invention, the mounting scheme formulation unit 33 includes:

[0098] The encryption algorithm specification module is used to specify encryption algorithms.

[0099] The key setting module is used to set the salt value of the password and the key, place the key generated with the salt value of the password and the key as a factor in the kernel, and obtain the key digest.

[0100] The key setting module is further used for:

[0101] Disassemble the mount command program mount.ecryptfs and extract the code in mount.ecryptfs that inserts the key into the kernel;

[0102] The code generates a key that is factored by the salt value of the password and the key and places it in the kernel.

[0103] The control data configuration unit 34 is further used for:

[0104] Write the salt value of the encryption algorithm and key into the first data packet tag 3;

[0105] Write the digest of the key into the second data packet tag 11.

[0106] In summary, after installing the ecryptfs encrypted file system in the file directory according to the established mounting scheme, large files in the file directory can be used directly, with their file size being the pre-set size. Subsequent operations include formatting the file system and appending valid data. This invention can flexibly create large files quickly on the ecryptfs encrypted file system based on different keys, file sizes, and encryption algorithms, greatly improving efficiency.

[0107] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0108] It should be noted that:

[0109] The algorithms and displays provided herein are not inherently related to any particular computer, virtual device, or other equipment. Various general-purpose devices can also be used in conjunction with the teachings herein. The required structure for constructing such devices is apparent from the above description. Furthermore, this invention is not directed to any particular programming language. It should be understood that the contents of the invention described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the invention.

[0110] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0111] Similarly, it should be understood that, in order to simplify the invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof. However, this disclosure should not be construed as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the following claims, inventive aspects lie in fewer than all features of a single foregoing disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into this detailed description, wherein each claim itself is a separate embodiment of the invention.

[0112] Those skilled in the art will understand that modules in the device of the embodiments can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiments can be combined into a single module, unit, or component, and further, they can be divided into multiple sub-modules, sub-units, or sub-components. Except where at least some of such features and / or processes or units are mutually exclusive, any combination can be used to combine all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or device so disclosed. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0113] Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features but not others included in other embodiments, combinations of features from different embodiments are intended to be within the scope of the invention and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.

[0114] The various component embodiments of the present invention can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the device for detecting the wearing status of an electronic device according to embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such programs implementing the present invention can be stored on a computer-readable medium or can take the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0115] For example, Figure 4 A schematic diagram of an electronic device according to an embodiment of the present invention is shown. The electronic device conventionally includes a processor 41 and a memory 42 arranged to store computer-executable instructions (program code). The memory 42 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, hard disk, or ROM. Figure 1 Storage space 43 for program code 44 of any method steps shown and in any of the embodiments. For example, storage space 43 for storing program code may include various program codes 44 for implementing the various steps in the methods above. This program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, CDs, memory cards, or floppy disks. Such computer program products are typically, for example, Figure 5 The aforementioned computer-readable storage medium. This computer-readable storage medium may have the same characteristics as... Figure 4 The memory 42 in the electronic device is similarly arranged as a storage segment, storage space, etc. The program code can be compressed, for example, in a suitable form. Typically, the storage space stores program code 51 for performing the steps of the method according to the invention, that is, program code that can be read by a processor 41, which, when run by the electronic device, causes the electronic device to perform the various steps of the method described above.

[0116] The above description is merely a specific embodiment of the present invention. Under the teachings of the present invention, those skilled in the art can make other improvements or modifications based on the above embodiments. Those skilled in the art should understand that the above specific description is only to better explain the purpose of the present invention, and the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for quickly generating large files on the ecryptfs encrypted file system, characterized in that, include: Create large files in a regular file system using the "hollow file" technique; Update file size to determine the file size after decryption via the ecryptfs encrypted file system; Develop a mounting scheme for the encrypted file system ecryptfs, including: developing an encryption algorithm; setting the salt values ​​for the password and key; extracting the code from the mount command program that inserts the key into the kernel; placing the key generated using the salt values ​​of the password and key as factors in the kernel through the code; and obtaining the key digest. Configure control data according to the mounting scheme of the encrypted file system ecryptfs, the control data including the encryption algorithm, the salt value of the key and the digest of the key; Place the large file in the specified file directory, and install the encrypted file system ecryptfs in the file directory according to the mounting scheme.

2. The method according to claim 1, characterized in that, The configuration control data based on the mounting scheme of the ecryptfs encrypted file system includes: Write the salt value of the encryption algorithm and key into the first data packet tag 3; Write the digest of the key into the second data packet tag 11.

3. An apparatus for rapidly generating large files on the ecryptfs encrypted file system, characterized in that, include: The large file creation unit is used to create large files in a regular file system using the "hollow file" technique; The file size determination unit is used to update the file size and determine the file size after decryption by the encrypted file system ecryptfs. The mounting scheme formulation unit is used to formulate the mounting scheme of the encrypted file system ecryptfs, including: an encryption algorithm formulation module for formulating encryption algorithms; a key setting module for setting the salt value of the password and key, extracting the code of the mounting command program to insert the key into the kernel; and placing the key generated by the code with the salt value of the password and key as a factor in the kernel and obtaining the key digest. A control data configuration unit is used to configure control data according to the mounting scheme of the encrypted file system ecryptfs. The control data includes an encryption algorithm, a salt value of the key, and a digest of the key. An encrypted file system mounting unit is used to place the large file into a specified file directory and install the encrypted file system ecryptfs in the file directory according to the mounting scheme.

4. The apparatus according to claim 3, characterized in that, The control data configuration unit is further used for: Write the salt value of the encryption algorithm and key into the first data packet tag 3; Write the digest of the key into the second data packet tag 11.

5. An electronic device, characterized in that, The electronic device includes: Processor; and, A memory configured to store computer-executable instructions, which, when executed, cause the processor to perform the method according to any one of claims 1 to 2.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs that, when executed by a processor, implement the method of any one of claims 1 to 2.

Images