Data encryption method, data decryption method, device and equipment

Abstract

Embodiments of the present application relate to the technical field of communication, and disclose a data encryption method, a data decryption method, a device, equipment and a computer storage medium. The data encryption method comprises: receiving to-be-stored data and an encryption parameter of the to-be-stored data; segmenting the to-be-stored data to obtain at least two to-be-stored data segments; and sending the at least two to-be-stored data segments to a plurality of first cache units according to sizes, wherein the sizes of the plurality of first cache units are determined according to the performance of a CPU, and the to-be-stored data segments in the plurality of first cache units are encrypted according to the encryption parameter of the to-be-stored data to obtain encrypted to-be-stored data. In the foregoing manner, the embodiments of the present application can improve the encryption speed of encrypted volume data and improve the read-write speed and efficiency of the encrypted volume.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of encryption technology, specifically to a data encryption method, a data decryption method, an apparatus, a device, and a computer storage medium. Background Technology

[0002] Cloud disks provide persistent block storage devices for cloud servers. They can be used as independent, scalable hard drives for cloud servers, solving the performance scalability issues of business storage. To improve data security, not only is it necessary to encrypt the cloud disk itself, but also the data written to it.

[0003] Currently, encryption of cloud disk data can be achieved through either a front-end virtualization layer (Qemu) or back-end storage. However, because the front-end virtualization layer (Qemu) offers advantages over back-end storage in terms of interface compatibility, scenario versatility, and implementation feasibility, it is generally chosen to encrypt cloud disk data at the front-end virtualization layer (Qemu).

[0004] In the process of implementing the embodiments of the present invention, the inventors discovered that: currently, after encrypting cloud disk data through the front-end virtualization layer (Qemu), the data read and write performance in the cloud disk is very poor. Summary of the Invention

[0005] In view of the above problems, embodiments of the present invention provide a data encryption method, a data decryption method, an apparatus, a device, and a computer storage medium. These are used to solve the problem in the prior art where, after encrypting data on a cloud hard drive through a front-end virtualization layer (Qemu), the data read and write performance on the cloud hard drive is very poor.

[0006] According to one aspect of the present invention, a data encryption method is provided, the method comprising:

[0007] Receive the data to be stored and the encryption parameters of the data to be stored;

[0008] The data to be stored is divided into at least two data fragments to be stored;

[0009] The at least two pieces of data to be stored are sent to multiple first cache units according to their size, wherein the size of the multiple first cache units is determined according to the performance of the CPU;

[0010] The data to be stored in the plurality of first buffers is encrypted according to the encryption parameters of the data to be stored, so as to obtain the encrypted data to be stored.

[0011] In one optional approach, the step of encrypting the data fragments to be stored in the plurality of first buffers according to the encryption parameters of the data to be stored to obtain encrypted data to be stored further includes:

[0012] The encryption algorithm and encryption instructions corresponding to the encryption parameters in the preset encryption library are invoked to encrypt the data to be stored in the multiple first buffer areas, so as to obtain the encrypted data to be stored.

[0013] In one optional approach, the step of encrypting the data to be stored in the plurality of first buffers according to the encryption parameters of the data to be stored to obtain encrypted data to be stored further includes:

[0014] The plurality of first cache areas, the encryption instructions and encryption algorithms corresponding to the encryption parameters in the preset encryption library are sent to the hardware acceleration card, so that the hardware acceleration card can encrypt the data fragments to be stored according to the encryption parameters of the data to be stored, and through the encryption instructions and encryption algorithms, to obtain a plurality of encrypted data fragments to be stored.

[0015] The system receives the multiple encrypted data fragments to be stored and concatenates them to obtain the encrypted data to be stored.

[0016] According to another aspect of the present invention, a data decryption method is provided, the method comprising:

[0017] Receive data output requests;

[0018] Obtain the data to be output and decryption parameters corresponding to the data output request;

[0019] The data to be output is segmented to obtain at least two data fragments to be output;

[0020] The at least two data items to be output are sent to multiple second buffers according to their size; wherein the size of the multiple first buffers is determined based on the CPU performance.

[0021] The data to be output in the plurality of second buffers is decrypted according to the decryption parameters to obtain the decrypted data to be output.

[0022] In one optional approach, the step of decrypting the data to be output in the plurality of second buffers according to the decryption parameters to obtain the decrypted data to be output further includes:

[0023] The decryption instructions and algorithms corresponding to the decryption parameters in the preset encryption library are invoked to decrypt the data to be output in the multiple second buffers, thereby obtaining the decrypted data to be output.

[0024] In one optional approach, the step of decrypting the data to be output in the plurality of second buffers according to the decryption parameters to obtain the decrypted data to be output further includes:

[0025] The multiple second buffers, the decryption algorithms and decryption instructions corresponding to the decryption parameters in the preset encryption library are sent to the hardware acceleration card, so that the hardware acceleration card can decrypt the data fragments to be stored according to the decryption parameters of the data to be stored, and through the decryption instructions and decryption algorithms, to obtain multiple decrypted data fragments to be output.

[0026] The system receives the multiple decrypted data fragments to be output and concatenates them to obtain the decrypted data to be output.

[0027] According to another aspect of the present invention, a data encryption device is provided, the data encryption device comprising:

[0028] The first receiving module is used to receive the data to be stored and the encryption parameters of the data to be stored.

[0029] The first segmentation module is used to segment the data to be stored to obtain at least two data fragments to be stored;

[0030] The first cache module is used to send the at least two pieces of data to be stored to a plurality of first cache units according to their size, wherein the size of the plurality of first cache units is determined according to the performance of the CPU;

[0031] An encryption module is used to encrypt data fragments in the plurality of first buffers according to the encryption parameters of the data to be stored, so as to obtain encrypted data to be stored.

[0032] According to another aspect of the present invention, a data decryption apparatus is provided, the data decryption apparatus comprising:

[0033] The second receiving module is used to receive data output requests.

[0034] The acquisition module is used to acquire the data to be output and the decryption parameters corresponding to the data output request;

[0035] The second segmentation module is used to segment the data to be output to obtain at least two data fragments to be output.

[0036] The second cache module is used to send the at least two data to be output to multiple second cache areas according to their size; wherein the size of the multiple first cache areas is determined according to the CPU performance;

[0037] The decryption module is used to decrypt the data to be output in the plurality of second buffers according to the decryption parameters, so as to obtain the decrypted data to be output.

[0038] According to another aspect of the present invention, a computing device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, wherein the executable instruction causes the processor to perform an operation corresponding to the aforementioned data encryption method or data decryption method.

[0039] According to another aspect of the present invention, a computer storage medium is provided, the storage medium storing at least one executable instruction, the executable instruction causing the processor to perform the operation corresponding to the above-described data encryption method or data decryption method.

[0040] This invention, in its embodiments, receives data to be stored and its encryption parameters, segments the data to be stored into at least two data fragments, and sends these fragments, according to their size, to multiple first cache units. The size of each first cache unit is determined based on CPU performance. The data fragments in the multiple first cache units are then encrypted according to the encryption parameters to obtain encrypted data to be stored. This improves the encryption speed of the data to be stored and increases the read / write speed of the encrypted volume.

[0041] The above description is merely an overview of the technical solutions of the embodiments of the present invention. In order to better understand the technical means of the embodiments of the present invention and to implement them in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the embodiments of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0042] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0043] Figure 1 The graph shows the encrypted volume data read / write performance test results;

[0044] Figure 2 A flowchart of a data encryption method provided by an embodiment of the present invention is shown;

[0045] Figure 3 An architecture diagram of a data encryption method provided by an embodiment of the present invention is shown;

[0046] Figure 4 The diagram illustrates the interaction between QEMU and the hardware acceleration card in an embodiment of the present invention.

[0047] Figure 5 A flowchart of a data decryption method provided by an embodiment of the present invention is shown;

[0048] Figure 6 Another graph showing the data read / write performance of an encrypted volume is provided.

[0049] Figure 7 A schematic diagram of the structure of a data encryption device provided in an embodiment of the present invention is shown;

[0050] Figure 8 This diagram illustrates the structure of a data decryption device provided in an embodiment of the present invention.

[0051] Figure 9 A schematic diagram of the structure of a computing device provided in an embodiment of the present invention is shown. Detailed Implementation

[0052] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0053] Before describing the embodiments of the present invention, the prior art and its problems will be explained:

[0054] To ensure the security of cloud disk data, the cloud disk is not only encrypted to create an encrypted volume, but an encryption algorithm is then used, employing a data key, to encrypt the data written to the encrypted volume.

[0055] When data is written to an encrypted volume, a special key is created specifically for encrypting the data on that volume. When data is transferred from a cloud server to the encrypted volume, it is automatically encrypted using the created key, and when the data is read, it is automatically decrypted.

[0056] Encrypting data within an encrypted volume can be achieved through a front-end virtualization layer (Qemu) or back-end storage. Using a front-end virtualization layer to encrypt data within an encrypted volume offers the following advantages over using back-end storage:

[0057] (1) Interface compatibility: The front-end virtualization layer is more compatible with the OpenStack interface than the back-end storage, and has better security.

[0058] (2) Diverse scenarios: Qemu-based LUKS encryption can be applied to both IP-SAN devices and CephRBD devices.

[0059] (3) Feasibility: By implementing RBD volume encryption through Qemu's Block layer encryption, the problem that network devices such as Ceph RBD block devices cannot use LUKS technology based on device mappers is avoided. Therefore, it is usually chosen to perform data encryption operations in the encrypted volume at the front-end virtualization layer.

[0060] However, after testing the data read / write capabilities of block devices, RBD block devices, and Qemu+RBD in three scenarios, the test results are as follows: Figure 1 As shown, Figure 1 The test results for data read / write capabilities in three scenarios are shown: block device, RBD block device, and Qemu+RBD. The performance difference between encrypted and unencrypted Qemu+RBD is significant.

[0061] Therefore, when using the Qemu front-end encryption technology to encrypt data on cloud disks, there is a problem with very poor data read and write bandwidth of the encrypted volume, which seriously affects the read and write performance of the disk.

[0062] In view of this, embodiments of the present invention propose a data storage method, such as... Figure 2 A flowchart of a data storage method provided in an embodiment of the present invention is shown. This method is executed by a front-end virtual layer, and more specifically, by the block device driver layer of the front-end virtual QEMU. Figure 2 As shown, the method includes the following steps:

[0063] Step 101: Receive the data to be stored and the encryption parameters of the data to be stored.

[0064] The data to be stored refers to the data to be written to the encrypted disk of the virtual machine. The encryption parameters of the data to be stored refer to one or more of the following: the name of the encryption algorithm, key length, encryption mode, and encryption key. These encryption parameters determine the encryption algorithm that the data to be stored needs to be encrypted with. These encryption parameters can be LUKS parameters.

[0065] Step 102: Divide the data to be stored into at least two data fragments.

[0066] In an embodiment of the present invention, after receiving the encryption parameters of the data to be stored, a corresponding encryption algorithm is matched according to the encryption parameters. The data to be stored is then segmented according to the requirements of the encryption algorithm, resulting in data fragmentation.

[0067] In step 102, when the encryption algorithm is AES and the encryption mode is XTS, the data to be stored is divided into multiple sectors, and each sector is further divided into multiple data fragments (XTS blocks). For example, each sector is 512 bytes, and each data fragment (XTS block) is 16 bytes.

[0068] Step 103: Send the at least two pieces of data to be stored to multiple first cache units according to their size.

[0069] It should be noted that the size of the multiple first cache units is determined based on the CPU's performance. The first cache unit functions similarly to a general-purpose register in the CPU; QEMU can only read data from one first cache unit at a time. By adjusting the size of the first cache units according to the CPU's performance, resources can be fully utilized, improving the read / write speed of the encrypted volume and thus enhancing its overall performance. CPU performance can refer to the CPU's processing power, such as the data bandwidth of a single instruction execution. For example, if the CPU's data bandwidth is 64 bits, then the first cache unit is set to 64 bits, or 8 bytes. When encrypting a 16-byte data fragment, it only needs to be sent to two first cache units and encrypted twice to complete the encryption. Compared to the existing technology where the first cache unit size is fixed at 1 byte, encrypting a 16-byte data fragment requires sending it to 16 first cache units and performing 16 encryption operations, thus improving the data encryption speed and enhancing the read / write performance of the encrypted volume.

[0070] Step 104: Encrypt the data to be stored in the plurality of first cache units according to the encryption parameters of the data to be stored, and obtain the encrypted data to be stored.

[0071] Specifically, the data to be stored in the plurality of first cache units is encrypted according to the encryption algorithm corresponding to the encryption parameters of the data to be stored, so as to obtain the encrypted data to be stored.

[0072] In embodiments of the present invention, a pre-allocated memory pool can be used to encrypt the data to be stored in the plurality of first cache units according to the encryption algorithm corresponding to the encryption parameters of the data to be stored, thereby obtaining the encrypted data to be stored. The pre-allocated memory pool can be used to store some intermediate data generated during the encryption process. Furthermore, this pre-allocated memory pool can be created before step 104, when QEMU sends a memory request to the host machine, allowing the host machine to allocate memory for QEMU. Alternatively, the host machine can proactively pre-allocate memory to the QEMU memory pool. This eliminates the need for the virtual machine to generate its own memory; QEMU simulates hardware to provide memory for the virtual machine, eliminating the system overhead of dynamic memory allocation during QEMU encryption and decryption operations, and thus preventing memory from being swapped to the hard disk. This improves encryption and decryption efficiency.

[0073] It is understood that after encrypting the data to be stored in the plurality of first cache units according to the encryption algorithm corresponding to the encryption parameters of the data to be stored, a plurality of encrypted data to be stored are obtained. The plurality of encrypted data to be stored are then concatenated to obtain the encrypted data to be stored.

[0074] It should be noted that after obtaining the encrypted data to be stored, it is also necessary to write the encrypted data to be stored into the encrypted volume.

[0075] Before writing the encrypted data to be stored into the encrypted volume, the encrypted volume needs to be decrypted, and then the encrypted data to be stored is written into the encrypted volume. Furthermore, before writing the encrypted data to be stored into the encrypted volume, the decrypted encrypted volume needs to be encrypted again. The encryption and decryption operations for the encrypted volume are the same as in existing technologies and will not be described in detail here.

[0076] This invention adjusts the size of the first cache unit according to the CPU's performance. This reduces the number of encryption operations, increases the encryption speed of the data to be stored, and improves the read / write speed of the encrypted volume.

[0077] Step 104 described above can be implemented in various ways. In another embodiment of the present invention, step 104 can be:

[0078] Step 114: Call the encryption algorithm and encryption instructions corresponding to the encryption parameters in the preset encryption library to encrypt the data to be stored in the multiple first buffers to obtain the encrypted data to be stored.

[0079] It should be noted that, as Figure 3As shown, QEMU comes with the cipher-builtin encryption library, which uses a standard XOR algorithm. This standard XOR algorithm takes increasingly longer to execute as the data size increases. Therefore, encrypting or decrypting data in the encrypted volume using the standard XOR algorithm is time-consuming, resulting in poor read / write performance for the encrypted volume.

[0080] In this embodiment of the invention, the preset encryption library refers to an external encryption library to QEMU, which can be the libgcrypto encryption library. The libgcrypto encryption library is one of the encryption libraries within the IPP encryption library. IPP (Integrated Performance Primitives) is a high-performance multimedia function library that includes various encryption libraries and corresponding encryption instructions, such as the libgcrypto encryption library. Before calling the encryption instructions and the encryption algorithm corresponding to the encryption parameters in the preset encryption library, QEMU needs to establish a connection with the IPP encryption library on the host machine to be able to call the encryption instructions and encryption algorithms of the libgcrypto encryption library within the IPP encryption library.

[0081] When the encryption algorithm is AES, the encryption instructions can be one or more from the AES-NI instruction set. The AES-NI instruction set is an Advanced Encryption Standard instruction set that allows for batch submission of multiple encryption requests and parallel asynchronous processing, improving the speed of encryption and decryption.

[0082] By calling the encryption instructions in the preset encryption library and the encryption algorithm corresponding to the encryption parameters, the data to be stored in the multiple first cache areas can be encrypted, which can further improve the encryption speed of the encrypted volume and thus improve the read and write capabilities of the encrypted volume.

[0083] Regarding step 104 above, another embodiment of the present invention provides a flowchart of the sub-steps of step 104, wherein step 104 may be:

[0084] Step 124: Send the plurality of first buffers, the encryption instructions and encryption algorithms corresponding to the encryption parameters in the preset encryption library to the hardware acceleration card, so that the hardware acceleration card can encrypt the data fragments to be stored according to the encryption parameters of the data to be stored, and use the encryption instructions and encryption algorithms to obtain a plurality of encrypted data fragments to be stored.

[0085] This involves installing a hardware acceleration card at the hardware layer, and ensuring that the host machine can load the hardware acceleration card. For example... Figure 4As shown, the hardware accelerator card can interact with QEMU via the KPI interface. Further, QEMU's block layer offloads the multiple first caches and the encryption instructions and algorithms corresponding to the encryption parameters in the preset encryption library to the hardware accelerator card through the hardware accelerator card's KPI interface. Through the hardware accelerator card's driver module, the hardware accelerator card's backend service (hardware device) uses the encryption algorithms and instructions corresponding to the encryption parameters in the preset encryption library to encrypt the data fragments to be stored in the multiple first caches, obtaining the encrypted data to be stored. This encrypted data is then sent to QEMU via the KPI interface. Encrypting the data to be stored using the hardware accelerator card reduces the CPU's processing load, allowing some computations originally performed by the CPU to be transferred to the hardware accelerator card. This reduces CPU switching overhead and waiting time, and improves the speed at which the virtual frontend encrypts data written to the encrypted volume.

[0086] Step 134: Receive the multiple encrypted data fragments to be stored, and concatenate the multiple encrypted data fragments to obtain the encrypted data to be stored.

[0087] This invention, through receiving data to be stored and its encryption parameters, segments the data to be stored into at least two data fragments. These fragments are then sent to multiple first cache units according to their size, where the size of each first cache unit is determined by the CPU's performance. The data fragments in the multiple first cache units are encrypted according to the encryption parameters to obtain encrypted data to be stored. This improves the encryption speed of the data to be stored and increases the read / write speed of the encrypted volume. Furthermore, by calling encryption instructions from a preset encryption library and using encryption algorithms corresponding to the encryption parameters, and leveraging a hardware accelerator card, the encryption algorithms and instructions from the preset encryption library are used to encrypt the data fragments in the multiple first cache units, resulting in encrypted data to be stored, further improving encryption and decryption speed and efficiency.

[0088] Another embodiment of the present invention proposes a data decryption method, such as... Figure 5 A flowchart of a data decryption method provided in an embodiment of the present invention is shown. This method is executed by a front-end virtual layer, more specifically, by the block device driver layer of the front-end virtual QEMU. Figure 5 As shown, the method includes the following steps:

[0089] Step 201: Receive data output request.

[0090] Step 202: Obtain the data to be output and decryption parameters corresponding to the data output request.

[0091] The data output request is sent by the virtual machine to QEMU. This request carries information about the data output, which allows the retrieval of the corresponding data to be output. This information can include the storage location of the data to be output or its identifier, such as the name and location of the encrypted volume containing the data.

[0092] It is understandable that the decryption parameters can be preserved by encrypting the data to be output when writing it to the encrypted volume. After obtaining the data to be output corresponding to the request, QEMU can retrieve the decryption parameters by looking up the pre-stored key and decryption algorithm for the data to be output.

[0093] It should be noted that before obtaining the output data corresponding to the request, the encrypted volume containing the output data needs to be decrypted first. The key corresponding to the encrypted volume is pre-stored in QEMU. QEMU can use the pre-stored key to decrypt the encrypted volume and then obtain the output data.

[0094] Step 203: Segment the data to be output to obtain at least two data fragments to be output.

[0095] In this embodiment of the invention, the data to be output is segmented according to the requirements of the decryption algorithm corresponding to the decryption parameters, resulting in at least two data fragments to be output. When the decryption algorithm is AES and the decryption mode is XTS mode, the data to be output is segmented into multiple sectors, and each sector is then segmented into multiple data fragments (xts blocks) to be output. For example, each sector is 512 bytes, and each data fragment (xts block) to be output is 16 bytes.

[0096] Step 204: Send the at least two data to be output to multiple second buffers according to their size.

[0097] It should be noted that the size of the plurality of first cache areas is determined based on the CPU performance. Specifically, it can be the same as step 103. Further details will not be provided here.

[0098] Step 205: Decrypt the data to be output in the plurality of second buffers according to the decryption parameters to obtain the decrypted data to be output.

[0099] It should be noted that after decrypting the data to be output in the multiple second buffers, multiple decrypted data fragments to be output are obtained. These multiple decrypted data fragments are then concatenated to obtain the decrypted data to be output. Finally, the decrypted data to be output is output to a specified location on the host machine.

[0100] This invention adjusts the size of the second cache unit according to the CPU's performance. This reduces the number of decryption operations, increases the encryption speed of the data to be output, and improves the read / write speed of the encrypted volume.

[0101] Step 205 described above can be implemented in various ways. In another embodiment of the present invention, step 205 can be:

[0102] Step 215: Call the decryption instructions and decryption algorithms corresponding to the decryption parameters in the preset encryption library to decrypt the data to be output in the multiple second buffers to obtain the decrypted data to be output.

[0103] The implementation of step 215 can be the same as that of step 104. The preset encryption library refers to an external encryption library to QEMU. This preset encryption library can be the libgcrypto encryption library. When the decryption algorithm is AES, the decryption instructions can be one or more from the AES-NI instruction set. The AES-NI instruction set is an Advanced Encryption Standard instruction set that allows for batch submission of multiple decryption requests and parallel asynchronous processing, improving decryption speed.

[0104] By calling the decryption instructions in the preset encryption library and the decryption algorithm corresponding to the decryption parameters, the data to be output in the multiple second buffers can be decrypted, which can further improve the decryption speed of the encrypted volume and thus improve the read and write capabilities of the encrypted volume.

[0105] In another embodiment of the present invention, step 205 described above can also be:

[0106] Step 225: Send the multiple second buffers, the decryption algorithms and decryption instructions corresponding to the decryption parameters in the preset encryption library to the hardware acceleration card, so that the hardware acceleration card can decrypt the data fragments to be stored according to the decryption parameters of the data to be stored, and use the decryption instructions and decryption algorithms to obtain multiple decrypted data fragments to be output.

[0107] Step 235: Receive the multiple decrypted data fragments to be output, and concatenate the multiple decrypted data fragments to obtain the decrypted data to be output.

[0108] Steps 225 and 235 can be the same as steps 123 and 134, and will not be repeated here. Decrypting the output data using a hardware accelerator card reduces the processing load on the CPU, allowing some calculations originally performed by the CPU to be transferred to the hardware accelerator card. This reduces CPU switching overhead and waiting time, and improves the speed at which the virtual front-end decrypts data written to the encrypted volume.

[0109] The data decryption method provided in this invention receives a data output request, obtains the data to be output and decryption parameters corresponding to the data output request, segments the data to be output to obtain at least two data fragments, and sends the at least two data fragments to multiple second buffers according to their size. The size of the multiple first buffers is determined based on the CPU performance. The data to be output in the multiple second buffers is decrypted according to the decryption parameters to obtain decrypted data to be output. Furthermore, by calling decryption instructions from a preset encryption library and a decryption algorithm corresponding to the decryption parameters, and with the aid of a hardware acceleration card, the data fragments to be output in the multiple second buffers are encrypted using the decryption algorithm and decryption instructions from the preset encryption library corresponding to the decryption parameters to obtain decrypted data to be output, further improving the encryption and decryption speed and efficiency.

[0110] The above embodiments demonstrate how to encrypt and decrypt data for reading and writing encrypted volumes, thereby improving the read and write performance of encrypted volumes. For example... Figure 6 This demonstrates the read / write performance without encrypting the data being read from or written to the encrypted volume (i.e., Figure 6 Before optimization (without encryption), and in existing technologies that only use Qemu's own cipher-builtin encryption library to encrypt the data to be stored, the read and write performance is compared (i.e., Figure 6 The read / write performance before optimization (encryption) and after encrypting the data to be stored using the above methods is compared to the performance before optimization. Figure 6 The test results (after optimization and encryption) show that the above method improves the read and write performance of data in the encrypted volume compared to existing technologies that only use Qemu's own cipher-builtin encryption library.

[0111] Figure 7 A schematic diagram of the data encryption device provided in an embodiment of the present invention is shown. Figure 7 As shown, the data encryption device 300 includes: a first receiving module 301, a first segmentation module 302, a first buffer module 303, and an encryption module 304.

[0112] The first receiving module 301 is used to receive the data to be stored and the encryption parameters of the data to be stored.

[0113] The first segmentation module 302 is used to segment the data to be stored to obtain at least two data fragments to be stored;

[0114] The first cache module 303 is used to send the at least two pieces of data to be stored to a plurality of first cache units according to their size, wherein the size of the plurality of first cache units is determined according to the performance of the CPU;

[0115] The encryption module 304 is used to encrypt the fragments of the data to be stored in the plurality of first buffers according to the encryption parameters of the data to be stored, so as to obtain the encrypted data to be stored.

[0116] The data encryption device provided in this embodiment of the invention performs an operation process that is largely the same as the aforementioned method, and will not be described again.

[0117] The data encryption device provided in this invention receives data to be stored and encryption parameters for the data to be stored, divides the data to be stored into at least two data fragments, and sends the at least two data fragments to multiple first cache units according to their size. The size of the multiple first cache units is determined based on CPU performance. The data fragments in the multiple first cache units are encrypted according to the encryption parameters of the data to be stored to obtain encrypted data to be stored. This improves the encryption speed of the data to be stored and the read / write speed of the encrypted volume. Furthermore, by calling encryption instructions from a preset encryption library and encryption algorithms corresponding to the encryption parameters, and with the aid of a hardware acceleration card, the encryption algorithms and encryption instructions in the preset encryption library corresponding to the encryption parameters are used to encrypt the data fragments in the multiple first cache units to obtain encrypted data to be stored, further improving the encryption and decryption speed and efficiency.

[0118] Figure 8 A schematic diagram of the data decryption device provided in an embodiment of the present invention is shown. Figure 8 As shown, the data decryption device 400 includes: a second receiving module 401, an acquisition module 402, a second segmentation module 403, a second buffer module 404, and a decryption module 405.

[0119] The second receiving module 401 is used to receive a data output request;

[0120] The acquisition module 402 is used to acquire the data to be output and the decryption parameters corresponding to the data output request;

[0121] The second segmentation module 403 is used to segment the data to be output to obtain at least two data fragments to be output.

[0122] The second cache module 404 is used to send the at least two data to be output to multiple second cache areas according to their size; wherein the size of the multiple first cache areas is determined according to the performance of the CPU;

[0123] The decryption module 405 is used to decrypt the data to be output in the plurality of second buffers according to the decryption parameters, so as to obtain the decrypted data to be output.

[0124] The data decryption device provided in this embodiment of the invention performs an operation process that is largely the same as the aforementioned method, and will not be described again.

[0125] The data encryption device provided in this embodiment of the invention receives a data output request, obtains the data to be output and decryption parameters corresponding to the data output request, segments the data to be output to obtain at least two data fragments, and sends the at least two data fragments to multiple second buffers according to their size. The size of the multiple first buffers is determined based on the CPU performance. The data to be output in the multiple second buffers is decrypted according to the decryption parameters to obtain decrypted data to be output. Furthermore, by calling decryption instructions from a preset encryption library and a decryption algorithm corresponding to the decryption parameters, and with the aid of a hardware acceleration card, the data fragments to be output in the multiple second buffers are encrypted using the decryption algorithm and decryption instructions from the preset encryption library corresponding to the decryption parameters to obtain encrypted data to be output, further improving the encryption and decryption speed and efficiency.

[0126] Figure 9 The diagram shows a structural schematic of a computing device provided in an embodiment of the present invention. The specific embodiments of the present invention do not limit the specific implementation of the computing device.

[0127] like Figure 9 As shown, the computing device may include: a processor 502, a communications interface 504, a memory 506, and a communications bus 508.

[0128] The processor 502, communication interface 504, and memory 506 communicate with each other via communication bus 508. Communication interface 504 is used to communicate with other network elements such as clients or other servers. The processor 502 executes program 510, specifically performing the relevant steps described above in the embodiments of the data encryption or decryption methods.

[0129] Specifically, program 510 may include program code, which includes computer-executable instructions.

[0130] Processor 502 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The computing device includes one or more processors, which may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0131] Memory 506 is used to store program 510. Memory 506 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0132] Specifically, program 510 can be called by processor 502 to cause the computing device to perform the following operations:

[0133] Receive the data to be stored and the encryption parameters of the data to be stored;

[0134] The data to be stored is divided into at least two data fragments to be stored;

[0135] The at least two pieces of data to be stored are sent to multiple first cache units according to their size, wherein the size of the multiple first cache units is determined according to the performance of the CPU;

[0136] The data to be stored in the plurality of first buffers is encrypted according to the encryption parameters of the data to be stored, so as to obtain the encrypted data to be stored.

[0137] Alternatively, program 510 may be invoked by processor 502 to cause the computing device to perform the following operations:

[0138] Receive data output requests;

[0139] Obtain the data to be output and decryption parameters corresponding to the data output request;

[0140] The data to be output is segmented to obtain at least two data fragments to be output;

[0141] The at least two data items to be output are sent to multiple second buffers according to their size; wherein the size of the multiple first buffers is determined based on the CPU performance.

[0142] The data to be output in the plurality of second buffers is decrypted according to the decryption parameters to obtain the decrypted data to be output.

[0143] The operation process performed by the computing device provided in this embodiment of the invention is largely the same as that of the aforementioned method, and will not be described again.

[0144] The computing device provided in this embodiment of the invention receives data to be stored and encryption parameters of the data to be stored, divides the data to be stored into at least two data fragments, and sends the at least two data fragments to multiple first cache units according to their size. The size of the multiple first cache units is determined based on the CPU performance. The data fragments in the multiple first cache units are encrypted according to the encryption parameters of the data to be stored to obtain encrypted data to be stored. This improves the encryption speed of the data to be stored and the read / write speed of the encrypted volume. Furthermore, by calling encryption instructions in a preset encryption library and encryption algorithms corresponding to the encryption parameters, and with the aid of a hardware acceleration card, the encryption algorithms and encryption instructions in the preset encryption library corresponding to the encryption parameters are used to encrypt the data fragments in the multiple first cache units to obtain encrypted data to be stored, further improving the encryption and decryption speed and efficiency. Alternatively, by receiving a data output request, obtaining the data to be output and decryption parameters corresponding to the data output request, segmenting the data to be output to obtain at least two data fragments, and sending the at least two data fragments to be output to multiple second buffers according to their size; wherein the size of the multiple first buffers is determined based on the CPU performance, and decrypting the data to be output in the multiple second buffers according to the decryption parameters to obtain the decrypted data to be output. Furthermore, by calling the decryption instructions in the preset encryption library and the decryption algorithm corresponding to the decryption parameters, and with the help of a hardware acceleration card, the decryption algorithm and decryption instructions in the preset encryption library corresponding to the decryption parameters are used to encrypt the data fragments to be output in the multiple second buffers to obtain the encrypted data to be output, further improving the encryption and decryption speed and efficiency.

[0145] This invention provides a computer storage medium storing at least one executable instruction. When executed on a computing device, the executable instruction causes the computing device to perform either the data encryption method described in any of the above method embodiments, or the data decryption method described in any of the above method embodiments.

[0146] Executable instructions can be used to cause a computing device to perform the following operations:

[0147] Receive the data to be stored and the encryption parameters of the data to be stored;

[0148] The data to be stored is divided into at least two data fragments to be stored;

[0149] The at least two pieces of data to be stored are sent to multiple first cache units according to their size, wherein the size of the multiple first cache units is determined according to the performance of the CPU;

[0150] The data to be stored in the plurality of first buffers is encrypted according to the encryption parameters of the data to be stored, so as to obtain the encrypted data to be stored.

[0151] Or, the executable instructions can be specifically used to cause the computing device to perform the following operations:

[0152] Receive data output requests;

[0153] Obtain the data to be output and decryption parameters corresponding to the data output request;

[0154] The data to be output is segmented to obtain at least two data fragments to be output;

[0155] The at least two data items to be output are sent to multiple second buffers according to their size; wherein the size of the multiple first buffers is determined based on the CPU performance.

[0156] The data to be output in the plurality of second buffers is decrypted according to the decryption parameters to obtain the decrypted data to be output.

[0157] The executable instructions stored in the computer storage medium provided in this embodiment of the invention are used to perform operations that are largely the same as those described above, and will not be repeated here.

[0158] The computer storage medium provided in this invention receives data to be stored and encryption parameters of the data to be stored, divides the data to be stored into at least two data fragments, and sends the at least two data fragments to multiple first cache units according to their size. The size of the multiple first cache units is determined based on the CPU performance. The data fragments in the multiple first cache units are encrypted according to the encryption parameters of the data to be stored to obtain encrypted data to be stored. This improves the encryption speed of the data to be stored and increases the read / write speed of the encrypted volume. Furthermore, by calling encryption instructions in a preset encryption library and encryption algorithms corresponding to the encryption parameters, and with the aid of a hardware acceleration card, the encryption algorithms and encryption instructions in the preset encryption library corresponding to the encryption parameters are used to encrypt the data fragments in the multiple first cache units to obtain encrypted data to be stored, further improving the encryption and decryption speed and efficiency. Alternatively, by receiving a data output request, the system obtains the data to be output and decryption parameters corresponding to the data output request. The data to be output is then segmented into at least two data fragments, which are sent to multiple second buffers according to their size. The size of the multiple first buffers is determined based on the CPU's performance. The data to be output in the multiple second buffers is decrypted according to the decryption parameters to obtain the decrypted data to be output. Furthermore, by calling decryption instructions from a preset encryption library and using a decryption algorithm corresponding to the decryption parameters, a hardware accelerator card is used to encrypt the data fragments in the multiple second buffers, obtaining the encrypted data to be output, further improving the encryption and decryption speed and efficiency.

[0159] This invention provides a computer program that can be invoked by a processor to cause a computing device to execute the data encryption method or the data decryption method in any of the above method embodiments.

[0160] This invention provides a computer program product, which includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions, which, when executed on a computer, cause the computer to perform the data encryption method or data decryption method described in any of the above method embodiments.

[0161] The algorithms or displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, the embodiments of the present invention are not directed to any particular programming language. It should be understood that the content of the invention described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the invention.

[0162] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0163] Similarly, it should be understood that, in order to simplify the invention and aid in understanding one or more of the various inventive aspects, features of the embodiments of the invention are sometimes grouped together in a single embodiment, figure, or description thereof in the above description of exemplary embodiments of the invention. However, this disclosure should not be construed as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the following claims, inventive aspects lie in fewer than all features of a single foregoing disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into this detailed description, wherein each claim itself is a separate embodiment of the invention.

[0164] Those skilled in the art will understand that modules in the device of the embodiments can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiments can be combined into a single module, unit, or component, and further, they can be divided into multiple sub-modules, sub-units, or sub-components. Except where at least some of such features and / or processes or units are mutually exclusive, any combination can be used to combine all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or device so disclosed. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0165] Furthermore, those skilled in the art will understand that although some embodiments herein include certain features included in other embodiments but not others, combinations of features from different embodiments are intended to be within the scope of the invention and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.

[0166] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be construed as limiting the order of execution.

Claims

1. A data encryption method, characterized in that, The method is executed at the block device driver layer of the front-end virtual qemu, and the method includes: Receive the data to be stored and the encryption parameters of the data to be stored; The data to be stored is divided according to the requirements of the encryption algorithm corresponding to the encryption parameters to obtain at least two data fragments to be stored; wherein, when the encryption algorithm is AES algorithm and the encryption mode is XTS mode, the data to be stored is divided into multiple sectors, and each sector is further divided into multiple data fragments to be stored. The at least two data fragments to be stored are sent to multiple first caches according to their size, wherein the size of the multiple first caches is determined based on the CPU performance; the CPU performance refers to the data bandwidth of the CPU processor executing instructions once. The data to be stored in the plurality of first buffers is encrypted according to the encryption parameters of the data to be stored, so as to obtain the encrypted data to be stored.

2. The method according to claim 1, characterized in that, The step of encrypting the data fragments in the plurality of first cache areas according to the encryption parameters of the data to be stored to obtain the encrypted data to be stored further includes: The encryption algorithm and encryption instructions corresponding to the encryption parameters in the preset encryption library are invoked to encrypt the data fragments to be stored in the multiple first buffer areas, so as to obtain the encrypted data to be stored.

3. The method according to claim 1, characterized in that, The step of encrypting the data fragments in the plurality of first cache areas according to the encryption parameters of the data to be stored to obtain the encrypted data to be stored further includes: The encryption instructions and encryption algorithms corresponding to the encryption parameters in the multiple first cache areas and the preset encryption library are sent to the hardware acceleration card so that the hardware acceleration card can encrypt the data fragments to be stored according to the encryption parameters of the data to be stored, and through the encryption instructions and encryption algorithms, to obtain multiple encrypted data fragments to be stored. The system receives the multiple encrypted data fragments to be stored and concatenates them to obtain the encrypted data to be stored.

4. A data decryption method, characterized in that, The method is executed at the block device driver layer of the front-end virtual qemu, and the method includes: Receive data output requests; Obtain the data to be output and decryption parameters corresponding to the data output request; The data to be output is segmented according to the requirements of the decryption algorithm corresponding to the decryption parameters to obtain at least two data fragments to be output; wherein, when the decryption algorithm is AES algorithm and the decryption mode is XTS mode, the data to be output is segmented into multiple sectors, and each sector is further segmented into multiple data fragments to be output. The at least two data fragments to be output are sent to multiple second buffers according to their size; wherein the size of the multiple second buffers is determined based on the CPU performance; the CPU performance refers to the data bandwidth of the CPU processor executing instructions once. The data to be output in the plurality of second buffers is decrypted according to the decryption parameters to obtain the decrypted data to be output.

5. The method according to claim 4, characterized in that, The step of decrypting the data fragments to be output in the plurality of second buffers according to the decryption parameters to obtain the decrypted data to be output further includes: The decryption instructions and algorithms corresponding to the decryption parameters in the preset encryption library are invoked to decrypt the data fragments to be output in the multiple second buffers, so as to obtain the decrypted data to be output.

6. The method according to claim 5, characterized in that, The step of decrypting the data fragments to be output in the plurality of second buffers according to the decryption parameters to obtain the decrypted data to be output further includes: The multiple second buffers, the decryption algorithms and decryption instructions corresponding to the decryption parameters in the preset encryption library are sent to the hardware acceleration card, so that the hardware acceleration card can decrypt the data fragments to be output according to the decryption parameters of the data to be output, and use the decryption instructions and decryption algorithms to obtain multiple decrypted data fragments to be output. The system receives the multiple decrypted data fragments to be output and concatenates them to obtain the decrypted data to be output.

7. A data encryption device, characterized in that, The device executes in the block device driver layer of the front-end virtual qemu, and the device includes: The first receiving module is used to receive the data to be stored and the encryption parameters of the data to be stored. The first segmentation module is used to segment the data to be stored according to the requirements of the encryption algorithm corresponding to the encryption parameters, and obtain at least two data fragments to be stored; wherein, when the encryption algorithm is AES algorithm and the encryption mode is XTS mode, the data to be stored is divided into multiple sectors, and each sector is further divided into multiple data fragments to be stored. The first cache module is used to send the at least two data fragments to be stored to multiple first cache areas according to their size, wherein the size of the multiple first cache areas is determined according to the performance of the CPU; the performance of the CPU refers to the data bandwidth of the CPU processor executing instructions once. An encryption module is used to encrypt data fragments in the plurality of first buffers according to the encryption parameters of the data to be stored, so as to obtain encrypted data to be stored.

8. A data decryption device, characterized in that, The device executes in the block device driver layer of the front-end virtual qemu, and the device includes: The second receiving module is used to receive data output requests; The acquisition module is used to acquire the data to be output and the decryption parameters corresponding to the data output request; The second segmentation module is used to segment the data to be output according to the requirements of the decryption algorithm corresponding to the decryption parameters, and obtain at least two data fragments to be output; wherein, when the decryption algorithm is AES algorithm and the decryption mode is XTS mode, the data to be output is divided into multiple sectors, and each sector is further divided into multiple data fragments to be output. The second cache module is used to send the at least two data fragments to be output to multiple second cache areas according to their size; wherein, the size of the multiple second cache areas is determined according to the performance of the CPU; the performance of the CPU refers to the data bandwidth of the CPU processor executing instructions once; The decryption module is used to decrypt the data fragments to be output in the plurality of second buffers according to the decryption parameters, so as to obtain the decrypted data to be output.

9. A computing device, comprising: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction that causes the processor to perform the steps of the data encryption method according to any one of claims 1-3 or the steps of the data decryption method according to any one of claims 4-6.

10. A computer storage medium storing at least one executable instruction that causes a processor to perform the steps of the data encryption method according to any one of claims 1-3 or the steps of the data decryption method according to any one of claims 4-6.

Images