Data processing method, system, device and readable storage medium

Abstract

This application provides a data processing method, system, device, and readable storage medium, relating to fields such as cloud computing, cloud security, data security, cloud storage, and maps. Application scenarios include, but are not limited to, disk encryption or decryption scenarios. The method includes: a terminal generating a first data packet and sending it to a server; the server authenticating the terminal based on the first data packet; if the terminal's authentication is successful, the server responds to an encryption or decryption request from the terminal for the disk and determines the disk's partition identifier; the server sending the disk's partition identifier to the terminal; the terminal generating a data key based on the disk's partition identifier; the server receiving the data key sent by the terminal and storing the data key in memory encrypted using secure encryption virtualization technology; and the server retrieving the data key from memory to encrypt or decrypt the disk.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a data processing method, system, device, and readable storage medium. Background Technology

[0002] With the rapid development of cloud computing, users are increasingly hosting their business and data in the cloud, inevitably bringing some potential data security risks. For most users, data is core, making encrypted protection of cloud data crucial. Most existing data encryption schemes are provided by cloud providers, requiring users to trust them. In cloud service scenarios, users encrypt or decrypt disks in the cloud service using keys, thus encrypting or decrypting the data on the disk. However, some third-party data encryption schemes do not include cloud providers in their threat models or employ necessary security measures to prevent cloud providers from stealing keys. If a provider steals the keys, they can also steal user data, resulting in low security for disk encryption or decryption. Summary of the Invention

[0003] This application addresses the shortcomings of existing methods by proposing a data processing method, system, device, computer-readable storage medium, and computer program product to solve the problem of how to improve the security of encrypting or decrypting disks.

[0004] In a first aspect, this application provides a data processing method, including:

[0005] The terminal generates the first data packet and sends it to the server;

[0006] The server authenticates the terminal based on the first data packet. If the terminal's authentication is successful, the server responds to the encryption or decryption request from the terminal for the disk and determines the disk's partition identifier.

[0007] The server sends the disk partition identifier to the terminal;

[0008] The terminal generates a data key based on the disk partition identifier;

[0009] The server receives the data key sent by the terminal and stores the data key in memory that is encrypted using secure encryption virtualization technology;

[0010] The server retrieves the data key from memory to encrypt or decrypt the disk.

[0011] In one embodiment, the server authenticates the terminal based on a first data packet, including:

[0012] The server obtains the public key corresponding to the terminal's private key;

[0013] The server receives a first data packet sent by the terminal; the first data packet includes the content of the first data packet, a digest corresponding to the content of the first data packet, and a digital signature corresponding to the digest.

[0014] Based on the content, digest, digital signature, and public key of the first data packet, the server authenticates the identity of the terminal. After the terminal's identity is successfully authenticated, the server executes the step of determining the disk partition identifier in response to the encryption or decryption request from the terminal for the disk.

[0015] In one embodiment, the content of the first data packet includes a request content, a sending time, and a validity period. The terminal generates the first data packet, which includes:

[0016] The terminal merges the binary values ​​of the request content, the sending time, and the validity period to obtain the merged data.

[0017] The terminal will merge and process the data, calculate the hash value using a hash function, and set the hash value in the digest.

[0018] The terminal encrypts the digest using its private key to obtain the encrypted digest.

[0019] The encrypted digest is stored in the digital signature;

[0020] The terminal generates the first data packet based on the content, digest, and digital signature of the first data packet.

[0021] In one embodiment, the first data packet content includes a request content, a sending time, and a validity period. Based on the first data packet content, a digest, a digital signature, and a public key, the server authenticates the terminal's identity, including:

[0022] The server decrypts the digital signature using the public key. If the server cannot decrypt the digital signature, it returns an authentication error to the terminal.

[0023] If the server successfully decrypts the digital signature, it compares the decrypted result with the digest. If the decrypted result and the digest are not equal, the server returns an authentication error to the terminal.

[0024] The server merges the binary values ​​of the request content, the sending time, and the validity period to obtain merged data. The server then calculates a hash value using a hash function and compares the hash value with the digest. If the hash value and the digest are not equal, the server returns an authentication error to the terminal.

[0025] The server compares the validity period with the sending time. If the sending time has exceeded the validity period, the server returns a request expired error to the terminal.

[0026] In one embodiment, in response to an encryption or decryption request from a terminal for the disk, the server determines the disk partition identifier, including:

[0027] The server receives a fourth data packet sent by the terminal. The fourth data packet includes the content of the fourth data packet, a digest corresponding to the content of the fourth data packet, and a digital signature corresponding to the digest. The content of the fourth data packet includes a request, which includes an encryption request or a decryption request for the disk.

[0028] Based on the request content and the disk's partition structure, the server determines the disk's partition identifier.

[0029] In one embodiment, the server sends the disk partition identifier to the terminal, including:

[0030] The server sends a fifth data packet to the terminal; the fifth data packet includes the content of the fifth data packet, the digest corresponding to the content of the fifth data packet, and the digital signature corresponding to the digest. The content of the fifth data packet includes the return content, the sending time, and the validity period. The return content includes the disk partition identifier.

[0031] In one embodiment, the terminal generates a data key based on the disk partition identifier, including:

[0032] The terminal obtains the terminal's private key;

[0033] The terminal generates a data key based on the terminal's private key and the disk partition identifier.

[0034] In one embodiment, based on the private key and the disk partition identifier, the terminal generates a data key, including:

[0035] The terminal concatenates the private key with preset constant characters to obtain the concatenated data;

[0036] The terminal uses a hash algorithm to obtain the first key from the data after connection processing;

[0037] Based on the first key and the disk partition identifier, the terminal generates a data key using a key hashing algorithm.

[0038] In one embodiment, the server receives a data key sent by the terminal, including:

[0039] The terminal sends a second data packet carrying a data key to the server; the second data packet includes the content of the second data packet, a digest corresponding to the content of the second data packet, and a digital signature corresponding to the digest, and the content of the second data packet includes the data key;

[0040] The server receives the second data packet and obtains the data key from the content of the second data packet.

[0041] In one embodiment, storing the data key in memory encrypted using secure encryption virtualization technology includes:

[0042] The server builds an in-memory file system;

[0043] The server uses a memory file system and preset directories to store data keys in memory that is encrypted using secure encryption virtualization technology.

[0044] In one embodiment, the server stores the data key in memory encrypted using secure virtualization technology, based on a memory file system and a preset directory, including:

[0045] The server mounts the memory file system to a preset directory; the memory file system corresponds to the memory encrypted using secure encryption virtualization technology, and the directory corresponds to the memory address.

[0046] The server stores the data keys in a directory, and there is a mapping relationship between the directory and the memory file system.

[0047] In one embodiment, retrieving a data key from memory to encrypt or decrypt the disk includes:

[0048] The server reads the data key from the memory file system corresponding to the memory through a preset partition encryption system; and encrypts or decrypts the disk using the data key.

[0049] Secondly, this application provides a data processing system, including a server and a terminal;

[0050] In this process, the terminal generates the first data packet and sends it to the server;

[0051] The server authenticates the terminal based on the first data packet. If the terminal's authentication is successful, the server responds to the encryption or decryption request from the terminal for the disk and determines the disk's partition identifier.

[0052] The server sends the disk partition identifier to the terminal;

[0053] The terminal generates a data key based on the disk partition identifier;

[0054] The server receives the data key sent by the terminal and stores the data key in memory that is encrypted using secure encryption virtualization technology;

[0055] The server retrieves the data key from memory to encrypt or decrypt the disk.

[0056] Thirdly, this application provides an electronic device, including: a processor, a memory, and a bus;

[0057] A bus is used to connect the processor and memory;

[0058] Memory, used to store operation instructions;

[0059] A processor is used to execute the data processing method of the first aspect of this application by invoking operation instructions.

[0060] Fourthly, this application provides a computer-readable storage medium storing a computer program that is used to perform the data processing method of the first aspect of this application.

[0061] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the data processing method in the first aspect of this application.

[0062] The technical solution provided in this application has at least the following beneficial effects:

[0063] The terminal generates a first data packet and sends it to the server. The server authenticates the terminal based on this first data packet. If authentication is successful, the server responds to the terminal's encryption or decryption request for the disk and determines the disk's partition identifier. The server sends the disk's partition identifier to the terminal. The terminal generates a data key based on the disk's partition identifier. The server receives the data key from the terminal and stores it in memory encrypted using secure encryption virtualization technology. The server retrieves the data key from memory to encrypt or decrypt the disk. By storing the determined data key in memory encrypted with secure encryption virtualization technology, the data key is protected, ensuring its security and thus improving the security of disk encryption or decryption. This ensures that user data is not stolen under a semi-honest security model. Attached Figure Description

[0064] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below.

[0065] Figure 1 This is a schematic diagram of the architecture of Solution 1 in a cloud scenario;

[0066] Figure 2 This is a schematic diagram of the architecture of Solution 2 in a cloud scenario;

[0067] Figure 3 This is a schematic diagram of the architecture of Solution 3 in a cloud scenario;

[0068] Figure 4 This is a schematic diagram of the architecture of the data processing system provided in the embodiments of this application;

[0069] Figure 5 A flowchart illustrating a data processing method provided in an embodiment of this application;

[0070] Figure 6 A flowchart illustrating a data processing method provided in an embodiment of this application;

[0071] Figure 7 This is a schematic diagram of the data packet structure provided in an embodiment of this application;

[0072] Figure 8 A flowchart illustrating a data processing method provided in an embodiment of this application;

[0073] Figure 9 A schematic diagram of data processing provided for embodiments of this application;

[0074] Figure 10 A flowchart illustrating a data processing method provided in an embodiment of this application;

[0075] Figure 11 A flowchart illustrating a data processing method provided in an embodiment of this application;

[0076] Figure 12 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application;

[0077] Figure 13 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application;

[0078] Figure 14 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0079] The embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the embodiments described below with reference to the accompanying drawings are exemplary descriptions for explaining the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions of the embodiments of this application.

[0080] Those skilled in the art will understand that, unless otherwise stated, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the terms “comprising” and “including” as used in embodiments of this application mean that the corresponding feature can be implemented as the presented feature, information, data, step, operation, element, and / or component, but do not exclude implementation as other features, information, data, step, operation, element, component, and / or combinations thereof supported by the art. It should be understood that when we say that an element is “connected” or “coupled” to another element, the one element can be directly connected or coupled to the other element, or it can mean that the one element and the other element establish a connection relationship through an intermediate element. Furthermore, “connected” or “coupled” as used herein can include wireless connection or wireless coupling. The term “and / or” as used herein indicates at least one of the items defined by the term; for example, “A and / or B” indicates implementation as “A,” or implementation as “B,” or implementation as “A and B.”

[0081] It is understood that in the specific embodiments of this application, data related to data processing is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0082] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0083] Related technical research has found that data encryption schemes can include Scheme 1, Scheme 2, and Scheme 3, among which:

[0084] Option 1 is transparent storage encryption provided by the cloud provider, such as CBS transparent encryption. This option is implemented by the cloud provider, and all encryption and decryption operations are transparent to the user. The key is maintained by the cloud provider, and the data written to the disk by the user is automatically encrypted, and the data read from the disk is automatically decrypted.

[0085] Option 2 involves cloud tenants installing and configuring their own data encryption software, such as LUKS disk encryption for Linux or BitLocker for Windows. This option is implemented by the tenants themselves, who install the disk encryption software in the cloud virtual machine environment to achieve automatic encryption of disk read and write operations. The key is maintained by the tenants themselves and needs to be read when performing encryption and decryption operations.

[0086] Option 3 is disk encryption based on hardware encryption devices, such as encryption cards or encryption machines. This option is jointly implemented by the cloud provider and the tenant. The cloud provider needs to provide encryption devices, such as encryption cards that support SR-IOV (Single Root I / O Virtualization) technology or encryption machines that use security isolation technology. The tenant needs to install the corresponding disk encryption software. The tenant can choose to generate encryption keys themselves and write them into the hardware encryption device through key encapsulation, or choose to have the key management service provided by the cloud provider generate and maintain the keys.

[0087] In a cloud environment, none of the three solutions (Solution 1, Solution 2, and Solution 3) can exclude the cloud provider from the trust zone. Solution 1, for example... Figure 1 As shown, the transparent encrypted storage service provided by the cloud provider achieves automatic encryption and decryption of user storage operations by adding a transparent encryption proxy on top of cloud storage. The keys for this solution are maintained by the cloud provider, requiring complete trust in the provider. Furthermore, the encryption and decryption operations cannot be verified, making it impossible for tenants to prove that their data is indeed stored encrypted. Solution 2 is as follows... Figure 2 As shown in the diagram, this is an architecture diagram of commonly used data encryption software on the tenant side. Tenants install data encryption software to add cryptographic operations to user read and write requests, thereby protecting user data. This scheme requires the key to be stored on the current machine. For cloud providers, they can obtain the tenant key and decrypt tenant files by reading the key file or memory through technical means. Scheme 3 is as follows... Figure 3 As shown, the disk encryption system based on hardware encryption devices uses FUSE (Filesystem in Userspace) on the tenant side to handle user disk requests. On the cloud provider side, the key is encrypted by the user in the form of a key encapsulation and sent to the encryption card. SR-IOV technology is used to isolate and virtualize the encryption card, thereby securely handling user encryption and decryption requests. This solution effectively protects the security of encryption keys and stored data. However, due to the design of the FUSE interface, the data written by the user is still sent to FUSE in plaintext. Therefore, the cloud provider can obtain the file content written or read by the user by monitoring memory.

[0088] This application provides a data processing method for a data processing system, which relates to fields such as cloud computing, cloud storage, and mapping. For example, disk encryption or decryption involved in this application embodiment can be performed via cloud computing.

[0089] Artificial intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0090] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, as well as machine learning / deep learning, autonomous driving, and intelligent transportation.

[0091] To better understand and explain the solutions of the embodiments of this application, some technical terms involved in the embodiments of this application will be briefly explained below.

[0092] AMD SEV: AMD SEV is a confidential computing technology, also known as secure encrypted virtualization technology. AMD's SEV (secure encrypted virtualization) technology uses a unique key to transparently encrypt the memory of each VM (Virtual Machine) and can protect Linux KVM virtual machines. SEV can also calculate a signature of the memory content, which can be sent to the VM owner as proof that the firmware has correctly encrypted the memory.

[0093] Semi-honest security model: Participants will always execute the cryptographic protocol correctly, but will attempt to extract private data from the intermediate results generated during the execution of the cryptographic protocol.

[0094] LUKS: LUKS (Linux Unified Key Setup) is the standard for Linux hard drive encryption. By providing a standard disk format, LUKS not only promotes compatibility between distributions but also provides secure management of passwords for multiple users. LUKS stores all necessary settings information in the partition header, enabling users to seamlessly transfer or migrate their data. LUKS allows the use of keys to encrypt disks, so that each time the disk is read or written, it is automatically encrypted and decrypted.

[0095] tmpfs: tmpfs is a memory-based file system on Linux / Unix systems; tmpfs can use memory or swap partitions to store files; tmpfs mainly stores temporary files.

[0096] Hypervisor: Also known as VMM (virtual machine monitor), a hypervisor is a process used to create and run virtual machines (VMs). A hypervisor is an intermediate software layer that runs between the underlying physical server and the operating system, allowing multiple operating systems and applications to share hardware. By allowing the hypervisor to share its resources (such as memory and processing resources) in a virtualized manner, a single host computer can support multiple guest virtual machines.

[0097] Cloud virtual machines: Cloud virtual machines are IaaS services purchased on the cloud and deployed on the cloud, which users can remotely log in to operate.

[0098] Tenant local: generally refers to the user's personal computer or local network environment.

[0099] HMAC_SHA256: A key hashing algorithm. HMAC_SHA256 is constructed from the SHA-256 hash function and used as a hash-based message verification code for HMAC. The HMAC process mixes the key with the message data, hashes the result with the hash function, mixes the hash value with the key again, and then applies the hash function again. The output hash is 256 bits long.

[0100] SHA256: SHA256 is a hash function, also known as a hash algorithm, which is a method to create a small digital "fingerprint" from any kind of data.

[0101] GPT (GUID Partition Table) refers to a globally unique disk partition table format; GPT is part of the Extensible Firmware Interface (EFI) standard.

[0102] MBR: MBR disk partitioning is the most widely used partitioning structure. MBR is also known as the DOS partitioning structure. However, MBR is not only used on the Windows system platform, but also on Linux, x86-based UNIX and other system platforms.

[0103] The solutions provided in this application relate to cloud computing. The technical solutions of this application will be described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0104] To better understand the solution provided in the embodiments of this application, the solution will be described below in conjunction with a specific application scenario.

[0105] In one embodiment, Figure 4 The diagram shows an architecture of a data processing system applicable to embodiments of this application. It is understood that the data processing methods provided in these embodiments can be applied to, but are not limited to, applications such as... Figure 4 In the application scenarios shown.

[0106] In this example, as Figure 4 As shown, the architecture of the data processing system in this example can include, but is not limited to, a terminal (tenant's local machine), a server (cloud virtual machine), a cloud provider environment, and a network. The terminal (tenant's local machine) contains a unique private key (the terminal's private key) and the client tool c3pcli. The server (cloud virtual machine) contains the server-side tool c3pctrld, the tenant application, and encrypted storage (encrypted storage via the LUKS system). The cloud provider environment refers to the underlying service environment within the cloud platform. The cloud provider environment contains cloud storage services and underlying physical disks; the cloud storage service is an abstraction of the underlying physical disk.

[0107] A data processing system, comprising a server and a terminal;

[0108] In this process, the terminal generates the first data packet and sends it to the server;

[0109] The server authenticates the terminal based on the first data packet. If the terminal's authentication is successful, the server responds to the encryption or decryption request from the terminal for the disk and determines the disk's partition identifier.

[0110] The server sends the disk partition identifier to the terminal;

[0111] The terminal generates a data key based on the disk partition identifier;

[0112] The server receives the data key sent by the terminal and stores the data key in memory that is encrypted using secure encryption virtualization technology;

[0113] The server retrieves the data key from memory to encrypt or decrypt the disk.

[0114] Specifically, the terminal and server can interact via a network, and the server and cloud provider environment can also interact via a network. The server authenticates the terminal based on the first data packet. If the terminal's authentication is successful, the server responds to the terminal's encryption or decryption request for the disk and determines the disk's partition identifier. The server sends the disk's partition identifier to the terminal. The terminal generates a data key based on the disk's partition identifier. The server receives the data key sent by the terminal and stores it in memory encrypted using secure encryption virtualization technology. The server retrieves the data key from memory to encrypt or decrypt the disk. The disk can reside within the cloud provider's environment.

[0115] It is understood that the above is only one example, and this embodiment is not limited here.

[0116] The terminal can be a smartphone (such as an Android phone, an iOS phone, etc.), a mobile phone emulator, a tablet computer, a laptop computer, a digital broadcast receiver, a MID (Mobile Internet Device), a PDA (Personal Digital Assistant), etc. The server can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server or server cluster that provides basic cloud computing services such as cloud services, cloud databases, cloud security, data security, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0117] Cloud computing is a computing model that distributes computing tasks across a large pool of computers, enabling various application systems to access computing power, storage space, and information services as needed. The network providing these resources is called the "cloud." From the user's perspective, resources in the "cloud" appear infinitely scalable, readily available, on-demand, and expandable, with payment based on usage.

[0118] As a provider of fundamental cloud computing capabilities, a cloud resource pool (referred to as a cloud platform, generally called an IaaS (Infrastructure as a Service) platform) is established. Various types of virtual resources are deployed in the resource pool for external customers to choose from. The cloud resource pool mainly includes: computing devices (virtualized machines containing operating systems), storage devices, and network devices.

[0119] Based on logical function, a PaaS (Platform as a Service) layer can be deployed on top of the IaaS (Infrastructure as a Service) layer, and a SaaS (Software as a Service) layer can be deployed on top of the PaaS layer. Alternatively, SaaS can be deployed directly on top of IaaS. PaaS is a platform for running software, such as databases and web containers. SaaS refers to various types of business software, such as web portals and bulk SMS senders. Generally speaking, SaaS and PaaS are upper layers compared to IaaS.

[0120] Artificial intelligence cloud services are generally also known as AIaaS (AI as a Service). This is currently a mainstream service model for artificial intelligence platforms. Specifically, AIaaS platforms break down several common AI services and provide them as independent or packaged services in the cloud. This service model is similar to opening an AI-themed marketplace: all developers can access and use one or more AI services provided by the platform through API interfaces. Some experienced developers can also use the AI ​​framework and AI infrastructure provided by the platform to deploy and maintain their own dedicated cloud AI services.

[0121] Cloud storage is a new concept that extends and develops from the concept of cloud computing. A distributed cloud storage system (hereinafter referred to as a storage system) refers to a storage system that uses cluster applications, grid technology, and distributed storage file systems to bring together a large number of storage devices of various types (storage devices are also called storage nodes) in the network to work together through application software or application interfaces to provide data storage and business access functions to the outside world.

[0122] Currently, the storage method of storage systems is as follows: Logical volumes are created. During the creation of a logical volume, physical storage space is allocated to each logical volume. This physical storage space may consist of a single storage device or the disks of several storage devices. Clients store data on a logical volume, which means storing the data on the file system. The file system divides the data into many parts, each part being an object. Each object contains not only the data but also additional information such as a data identifier (ID, ID entity). The file system writes each object to the physical storage space of that logical volume and records the storage location information of each object. Therefore, when a client requests access to data, the file system can allow the client to access the data based on the storage location information of each object.

[0123] The process by which a storage system allocates physical storage space to a logical volume is as follows: the physical storage space is pre-divided into strips according to the capacity estimate of the objects stored in the logical volume (this estimate often has a large margin relative to the actual capacity of the objects to be stored) and the grouping of Redundant Array of Independent Disks (RAID). A logical volume can be understood as a strip, thus allocating physical storage space to the logical volume.

[0124] The aforementioned networks may include, but are not limited to, wired networks and wireless networks. Wired networks include local area networks (LANs), metropolitan area networks (MANs), and wide area networks (WANs). Wireless networks include Bluetooth, Wi-Fi, and other networks that enable wireless communication. Specific details can be determined based on actual application scenario requirements and are not limited here.

[0125] See Figure 5 , Figure 5 This application provides a schematic flowchart of a data processing method according to an embodiment of the present application. Figure 5 As shown, the data processing method provided in this application includes the following steps:

[0126] S101, the terminal generates the first data packet and sends the first data packet to the server.

[0127] In one embodiment, the content of the first data packet includes a request content, a sending time, and a validity period. The terminal generates the first data packet, which includes:

[0128] The terminal merges the binary values ​​of the request content, the sending time, and the validity period to obtain the merged data.

[0129] The terminal will merge and process the data, calculate the hash value using a hash function, and set the hash value in the digest.

[0130] The terminal encrypts the digest using its private key to obtain the encrypted digest.

[0131] The encrypted digest is stored in the digital signature;

[0132] The terminal generates the first data packet based on the content, digest, and digital signature of the first data packet.

[0133] S102, the server authenticates the terminal based on the first data packet. If the terminal's authentication is successful, the server responds to the encryption or decryption request from the terminal for the disk and determines the disk partition identifier.

[0134] In one embodiment, the server authenticates the terminal based on a first data packet, including:

[0135] The server obtains the public key corresponding to the terminal's private key;

[0136] The server receives a first data packet sent by the terminal; the first data packet includes the content of the first data packet, a digest corresponding to the content of the first data packet, and a digital signature corresponding to the digest.

[0137] Based on the content, digest, digital signature, and public key of the first data packet, the server authenticates the identity of the terminal. After the terminal's identity is successfully authenticated, the server executes the step of determining the disk partition identifier in response to the encryption or decryption request from the terminal for the disk.

[0138] In one embodiment, the first data packet content includes a request content, a sending time, and a validity period. Based on the first data packet content, a digest, a digital signature, and a public key, the server authenticates the terminal's identity, including:

[0139] The server decrypts the digital signature using the public key. If the server cannot decrypt the digital signature, it returns an authentication error to the terminal.

[0140] If the server successfully decrypts the digital signature, it compares the decrypted result with the digest. If the decrypted result and the digest are not equal, the server returns an authentication error to the terminal.

[0141] The server merges the binary values ​​of the request content, the sending time, and the validity period to obtain merged data. The server then calculates a hash value using a hash function and compares the hash value with the digest. If the hash value and the digest are not equal, the server returns an authentication error to the terminal.

[0142] The server compares the validity period with the sending time. If the sending time has exceeded the validity period, the server returns a request expired error to the terminal.

[0143] In one embodiment, in response to an encryption or decryption request from a terminal for the disk, the server determines the disk partition identifier, including:

[0144] The server receives a fourth data packet sent by the terminal. The fourth data packet includes the content of the fourth data packet, a digest corresponding to the content of the fourth data packet, and a digital signature corresponding to the digest. The content of the fourth data packet includes a request, which includes an encryption request or a decryption request for the disk.

[0145] Based on the request content and the disk's partition structure, the server determines the disk's partition identifier.

[0146] S103, the server sends the disk partition identifier to the terminal.

[0147] In one embodiment, the server sends the disk partition identifier to the terminal, including:

[0148] The server sends a fifth data packet to the terminal; the fifth data packet includes the content of the fifth data packet, the digest corresponding to the content of the fifth data packet, and the digital signature corresponding to the digest. The content of the fifth data packet includes the return content, the sending time, and the validity period. The return content includes the disk partition identifier.

[0149] S104, the terminal generates a data key based on the disk partition identifier.

[0150] In one embodiment, the terminal generates a data key based on the disk partition identifier, including:

[0151] The terminal obtains the terminal's private key;

[0152] The terminal generates a data key based on the terminal's private key and the disk partition identifier.

[0153] In one embodiment, based on the private key and the disk partition identifier, the terminal generates a data key, including:

[0154] The terminal concatenates the private key with preset constant characters to obtain the concatenated data;

[0155] The terminal uses a hash algorithm to obtain the first key from the data after connection processing;

[0156] Based on the first key and the disk partition identifier, the terminal generates a data key using a key hashing algorithm.

[0157] S105, the server receives the data key sent by the terminal and stores the data key in memory encrypted using secure encryption virtualization technology.

[0158] In one embodiment, the server receives a data key sent by the terminal, including:

[0159] The terminal sends a second data packet carrying a data key to the server; the second data packet includes the content of the second data packet, a digest corresponding to the content of the second data packet, and a digital signature corresponding to the digest, and the content of the second data packet includes the data key;

[0160] The server receives the second data packet and obtains the data key from the content of the second data packet.

[0161] In one embodiment, storing the data key in memory encrypted using secure encryption virtualization technology includes:

[0162] The server builds an in-memory file system;

[0163] The server uses a memory file system and preset directories to store data keys in memory that is encrypted using secure encryption virtualization technology.

[0164] In one embodiment, the server stores the data key in memory encrypted using secure virtualization technology, based on a memory file system and a preset directory, including:

[0165] The server mounts the memory file system to a preset directory; the memory file system corresponds to the memory encrypted using secure encryption virtualization technology, and the directory corresponds to the memory address.

[0166] The server stores the data keys in a directory, and there is a mapping relationship between the directory and the memory file system.

[0167] S106, the server retrieves the data key from memory to encrypt or decrypt the disk.

[0168] In one embodiment, retrieving a data key from memory to encrypt or decrypt the disk includes:

[0169] The server reads the data key from the memory file system corresponding to the memory through a preset partition encryption system; and encrypts or decrypts the disk using the data key.

[0170] In this embodiment, the terminal generates a first data packet and sends it to the server. The server authenticates the terminal based on the first data packet. If the terminal's authentication is successful, the server responds to the terminal's encryption or decryption request for the disk and determines the disk's partition identifier. The server sends the disk's partition identifier to the terminal. The terminal generates a data key based on the disk's partition identifier. The server receives the data key sent by the terminal and stores it in memory encrypted using secure encryption virtualization technology. The server retrieves the data key from memory to encrypt or decrypt the disk. Thus, storing the determined data key in memory encrypted using secure encryption virtualization technology protects the data key and ensures its security, thereby improving the security of encrypting or decrypting the disk. This ensures that user data is not stolen under a semi-honest security model.

[0171] See Figure 6 , Figure 6 This illustration shows a flowchart of a data processing method provided in an embodiment of this application. This method can be executed by any electronic device, such as a server. As an optional implementation, the method can be executed by a server. For ease of description, the following descriptions of some optional embodiments will use a server as the execution subject of the method. Figure 6 As shown, the data processing method provided in this application includes the following steps:

[0172] S201, in response to an encryption or decryption request from the terminal for the disk, determines the disk partition identifier.

[0173] Specifically, for example, such as Figure 4 As shown, the terminal (tenant's local machine) sends a data packet to the server (cloud virtual machine) via the client tool c3pcli, and the server receives the data packet via the server-side tool c3pctrld. The data packet includes the packet content, a digest corresponding to the packet content, and a digital signature corresponding to the digest. The packet content includes a request, which may be an encryption or decryption request from the terminal for a disk. The encryption request may include instructions to encrypt a specific disk, and the server determines the disk's partition identifier (PID) based on this instruction. Similarly, the decryption request may include instructions to decrypt a specific disk, and the server determines the disk's partition identifier (PID) based on this instruction. When the terminal reads data from the disk, it needs to decrypt the disk; when the terminal writes data to the disk, it needs to encrypt the disk.

[0174] S202, the disk partition identifier is sent to the terminal so that the terminal can generate a data key based on the disk partition identifier and the terminal's private key.

[0175] Specifically, for example, such as Figure 4 As shown, the server (cloud virtual machine) sends data packets to the terminal (tenant's local machine) via the server-side tool c3pctrld, and the terminal receives the data packets via the client-side tool c3pcli. The data packets include the packet content, a digest corresponding to the packet content, and a digital signature corresponding to the digest. The packet content includes return content, which includes the disk partition identifier (PID). The terminal can generate a data key, or DEK (Data Encryption Key), based on the disk partition identifier (PID) and the terminal's private key.

[0176] S203, receive the data key sent by the terminal and store the data key in memory encrypted using secure encryption virtualization technology.

[0177] Specifically, for example, such as Figure 4 As shown, the terminal (tenant's local machine) sends a data packet to the server (cloud virtual machine) via the client tool c3pcli, and the server receives the data packet via the server-side tool c3pctrld. The data packet includes the packet content, a digest of the packet content, and a digital signature corresponding to the digest. The packet content includes a request, which contains a data key. The server stores the data key in memory encrypted using AMD SEV secure virtualization technology.

[0178] S204 retrieves the data key from memory to encrypt or decrypt the disk.

[0179] Specifically, the data key is stored in encrypted memory protected by AMD SEV, a secure encrypted virtualization technology, thus protecting the data key. Cloud providers cannot steal the data key through the Hypervisor layer and use it to encrypt or decrypt the disk, ensuring the security of user data.

[0180] In this embodiment, in response to an encryption or decryption request from a terminal for a disk, the server determines the disk partition identifier; the server sends the disk partition identifier to the terminal so that the terminal can generate a data key based on the disk partition identifier and the terminal's private key; the server receives the data key sent by the terminal and stores the data key in memory encrypted using secure encryption virtualization technology; the server retrieves the data key from memory to encrypt or decrypt the disk; thus, storing the determined data key in memory encrypted using secure encryption virtualization technology protects the data key and ensures its security, thereby improving the security of encrypting or decrypting the disk; this ensures that user data is not stolen under a semi-honest security model.

[0181] In one embodiment, storing the data key in memory encrypted using secure encryption virtualization technology includes:

[0182] Build a memory file system and mount it to a preset directory; the memory file system corresponds to the memory encrypted by secure encryption virtualization technology, and the directory corresponds to the memory address;

[0183] The data key is stored in a directory, and there is a mapping relationship between the directory and the memory file system.

[0184] Specifically, the memory file system can be tmpfs. For example, such as Figure 4 As shown, after receiving the data key through the server-side tool c3pctrld, the server creates a tmpfs and mounts it to a directory; for example, in Linux, the tmpfs can be mounted to the directory / data / folder. Storing the data key in this directory means storing it in the tmpfs, which is equivalent to storing the data key in memory encrypted with AMD SEV secure virtualization technology.

[0185] In one embodiment, retrieving a data key from memory to encrypt or decrypt the disk includes:

[0186] The system reads the data key from the memory file system corresponding to the memory through a preset partition encryption system; and encrypts or decrypts the disk using the data key.

[0187] Specifically, the partition encryption system can be a LUKS system, which is a disk encryption system or tool that conforms to the Linux system's hard disk encryption standard. In a Linux environment, the LUKS system is created using the cryptsetup tool within LUKS disk encryption technology, and the disk is then encrypted or decrypted using the LUKS system. The data key is stored in the memory file system tmpfs, allowing the LUKS system to read the data key from tmpfs as a file. Simultaneously, the data key can be protected by AMD SEV-encrypted memory encryption.

[0188] In one embodiment, before determining the disk partition identifier in response to an encryption or decryption request from the terminal, steps A1-A3 are further included:

[0189] Step A1: Obtain the public key corresponding to the terminal's private key.

[0190] Specifically, for example, such as Figure 4 As shown, the terminal (local tenant) installs the client tool c3pcli in the local environment and uses the command "c3pcli genrsa" to generate the public key pub.pem (the terminal's public key) and the private key pri.pem (the terminal's private key). The local tenant logs into the server, i.e., the cloud server (cloud virtual machine), installs the server-side tool c3pctrld on the server, and uploads the public key pub.pem to the server through c3pctrld.

[0191] Step A2: Receive the first data packet sent by the terminal; the first data packet includes the content of the first data packet, a digest corresponding to the content of the first data packet, and a digital signature corresponding to the digest; the first data packet is used by the terminal to request authentication from the server.

[0192] Specifically, for example, such as Figure 7 As shown, the data packet includes packet content (data packet content), digest (the digest corresponding to the data packet content), and digital signature (the digital signature corresponding to the digest). The packet content includes request / return content (request content or return content), sending time, and validity period.

[0193] The first data packet is a data packet, which includes packet content (the content of the first data packet), digest (the digest corresponding to the content of the first data packet), and digital signature (the digital signature corresponding to the digest). The packet content includes request content, sending time, and validity period. The request content includes the terminal requesting authentication from the server.

[0194] The sending time is the current system time, which is generally expressed in Unix time. The Unix timestamp is the number of seconds that have elapsed since January 1, 1970 (midnight UTC / GMT), without considering leap seconds.

[0195] The validity period can be set to 1 minute, meaning the sent request must be processed within 1 minute; or it can be set to 10 seconds. The larger this window period (e.g., within 1 minute, 10 seconds, etc.) is set, the less secure it is. Setting a validity period is mainly to prevent replay attacks. To prevent replay attacks, for example, screenshotting previous communication data streams and then resending them to the c3pctrld tool for verification, since the timestamp is old, meaning the sending time (current system time) has exceeded the validity period, a "request expired" error will be returned.

[0196] The terminal merges the binary values ​​of the three fields (request / return content, sending time, and validity period) in the packet content to obtain the merged data. The merged data is then hashed using the SHA256 hash function to obtain a hash value, which is placed in the digest field. The terminal's private key is used to encrypt the digest field (the hash value) and store it in the digital signature field. This is the digital signature algorithm in cryptography. The private key is used to encrypt the hash value of the packet content, thus binding the packet content and making it verifiable and tamper-proof.

[0197] Step A3: Based on the content, digest, digital signature, and public key of the first data packet, authenticate the identity of the terminal. After the terminal's identity is successfully authenticated, execute the step of determining the disk partition identifier in response to the encryption or decryption request from the terminal for the disk.

[0198] Specifically, the server uses its public key to decrypt the digital signature. If it cannot decrypt the digital signature, the server returns an "authentication error" to the terminal. If the server successfully decrypts the digital signature, it compares the decrypted result with the digest. If the decrypted result and the digest are not equal, the server returns an "authentication error" to the terminal. The server merges the binary values ​​of the three fields (request / return content, sending time, and validity period) to obtain the merged data. The server uses the SHA256 hash function to obtain the hash value and compares this hash value with the digest. If the hash value and the digest are not equal, the server returns an "authentication error" to the terminal. The server reads the validity period field and compares it with the current system time (sending time). If the current system time has exceeded the validity period, the server returns a "request expired" error to the terminal.

[0199] Applying the embodiments of this application has at least the following beneficial effects:

[0200] By storing the determined data key in memory encrypted using secure encryption virtualization technology, the data key is protected, ensuring its security and thus improving the security of encrypting or decrypting the disk; this also guarantees that user data will not be stolen under the semi-honest security model.

[0201] See Figure 8 , Figure 8 This illustration shows a flowchart of a data processing method provided in an embodiment of this application. This method can be executed by any electronic device, such as a terminal. As an optional implementation, the method can be executed by a terminal. For ease of description, in the following description of some optional embodiments, a server will be used as the execution subject of the method. Figure 8 As shown, the data processing method provided in this application includes the following steps:

[0202] S601, obtain the terminal's private key and the disk partition identifier.

[0203] Specifically, obtain the disk partition identifier (PID), including any of the following:

[0204] If the user uses the GPT partition structure, the PID is determined by the GUID (Globally Unique Identifier) ​​of the GPT partition table;

[0205] If the user uses the MBR partition structure, the PID is determined by the disk ID and partition number.

[0206] S602 generates a data key based on the private key and the disk partition identifier.

[0207] Specifically, the data key can be calculated using formulas (1) and (2), which are shown below:

[0208] hmac_key<-SHA256(key||“DISK”) formula (1)

[0209] DEK<-HMAC_SHA256<hmac_key,PID> Formula (2)

[0210] Wherein, key is the private key; DISK is a preset constant character, such as a string, for example, DISK is "abc", "today", etc.; PID is the disk partition identifier; DEK is the data key; the symbol || indicates concatenation, and the symbol <- indicates assignment; SHA256 indicates the hash algorithm (hash function), and HMAC_SHA256 indicates the key hash algorithm.

[0211] As shown in formula (1), the private key key and the preset constant character DISK are concatenated to obtain the concatenated data; the concatenated data is then hashed using the SHA256 algorithm to obtain the first key hmac_key. As shown in formula (2), based on the first key hmac_key and the disk partition identifier PID, the data key DEK is obtained using the key hashing algorithm HMAC_SHA256. The data key DEK can be a 256-byte character.

[0212] S603 sends the data key to the server so that the server can store the data key in memory encrypted using secure encryption virtualization technology. The data key stored in memory is used to encrypt or decrypt the disk.

[0213] Specifically, for example, such as Figure 4 As shown, the terminal (tenant's local machine) sends a data packet to the server (cloud virtual machine) via the client tool c3pcli, and the server receives the data packet via the server-side tool c3pctrld. The data packet includes the packet content, a digest of the packet content, and a digital signature corresponding to the digest. The packet content includes a request, which contains a data key. The server stores the data key in memory encrypted using AMD SEV secure virtualization technology.

[0214] In this embodiment, the private key of the terminal and the partition identifier of the disk are obtained; a data key is generated based on the private key and the partition identifier of the disk; the data key is sent to the server so that the server stores the data key in memory encrypted with secure encryption virtualization technology, and the data key stored in memory is used to encrypt or decrypt the disk; thus, storing the determined data key in memory encrypted with secure encryption virtualization technology protects the data key and ensures its security, thereby improving the security of encrypting or decrypting the disk; it can ensure that user data is not stolen under the semi-honest security model.

[0215] In one embodiment, a data key is generated based on the private key and the disk partition identifier, including:

[0216] The private key and preset constant characters are concatenated to obtain the concatenated data;

[0217] The data after connection processing is hashed to obtain the first key;

[0218] Based on the first key and the disk partition identifier, a data key is generated using a key hashing algorithm.

[0219] Specifically, as shown in formula (1), the private key key and the preset constant character DISK are concatenated to obtain the concatenated data; the concatenated data is then hashed using the SHA256 algorithm to obtain the first key hmac_key. As shown in formula (2), based on the first key hmac_key and the disk partition identifier PID, the data key DEK is obtained using the key hashing algorithm HMAC_SHA256. The data key DEK can be a 256-byte character.

[0220] In one embodiment, sending the data key to the server includes:

[0221] Send a second data packet carrying the data key to the server; the second data packet includes the content of the second data packet, a digest corresponding to the content of the second data packet, and a digital signature corresponding to the digest, and the content of the second data packet includes the data key.

[0222] Specifically, for example, such as Figure 7 As shown, the first data packet includes packet content (data packet content), a digest (a digest corresponding to the data packet content), and a digital signature (a digital signature corresponding to the digest). The packet content includes request / return content (request content or return content), sending time, and validity period. The second data packet is also a data packet, and it includes packet content (second data packet content), a digest (a digest corresponding to the second data packet content), and a digital signature (a digital signature corresponding to the digest). The packet content includes request content, sending time, and validity period. The request content includes a data key.

[0223] Applying the embodiments of this application has at least the following beneficial effects:

[0224] By storing the determined data key in memory encrypted using secure encryption virtualization technology, the data key is protected, ensuring its security and thus improving the security of encrypting or decrypting the disk; this also guarantees that user data will not be stolen under the semi-honest security model.

[0225] To better understand the methods provided in the embodiments of this application, the solutions of the embodiments of this application will be further explained below with reference to specific application scenarios.

[0226] In a specific application scenario, such as a cloud service scenario, see [link to example]. Figure 4Users subscribe to cloud virtual machines for computation, and the cloud provider honestly executes the user's requests, but may be curious about and attempt to steal user data. The tenant's local machine is a completely trustworthy secure zone, and the tenant's private key never leaves the tenant's local machine. The cloud virtual machines are provided by the cloud provider, and they use AMD SEV encrypted memory, making it impossible for the cloud provider to obtain tenant data by monitoring memory, based on the hypervisor layer. The tenant installs the client tool c3pcli locally and generates a public key pub.pem and a private key pri.pem using the command "c3pcli genrsa". The tenant logs into the cloud virtual machine (cloud server), installs the server tool c3pctrld on the cloud virtual machine, and uploads the public key pub.pem to the cloud virtual machine. The tenant then starts the service using the command "c3pctrld serve" in the same directory. The tenant purchases cloud disk services through the cloud console and mounts them to the cloud virtual machine. The tenant connects to the server tool c3pctrld locally using the command "c3pcli login". After authentication, the tenant and the cloud virtual machine enter an interactive command state. Entering the command "lsblk" displays the disk list and status of the cloud virtual machine. The command "sec{storage device name}" converts a specified storage device into an encrypted disk. The encrypted disk is a block device, which the tenant can format as needed and mount using the command "mount" to a specified path. Mounting is the same as the "mount" operation.

[0227] In one embodiment, such as Figure 9 As shown, the tenant imports the data key into the SEV memory encryption space (AMD SEV encrypted memory), and then builds an encrypted file system (such as the LUKS system) based on the imported data key. The encrypted file system provides file system services for the tenant's applications. Here, the tenant environment can refer to the tenant's cloud environment, i.e., a cloud virtual machine. Tmpfs and the data key DEK can appear in the SEV memory encryption space.

[0228] See Figure 10 , Figure 10 This application provides a schematic flowchart of a data processing method according to an embodiment of the present application. Figure 10 As shown, the data processing method provided in this application includes the following steps:

[0229] S801, the terminal generates public and private keys.

[0230] S802, the terminal sends the first data packet to the server. The first data packet is used by the terminal to request authentication from the server.

[0231] Specifically, the first data packet is a data packet that includes packet content (the content of the first data packet), a digest (the digest corresponding to the content of the first data packet), and a digital signature (the digital signature corresponding to the digest). The packet content includes a request message, the sending time, and the validity period. The request message includes the terminal's request for authentication from the server. The server can be a cloud virtual machine, or it can be a cloud server.

[0232] S803, the server sends a third data packet to the terminal. The third data packet is used by the server to return authentication success information to the terminal.

[0233] Specifically, the third data packet is a data packet, which includes packet content (the content of the third data packet), digest (the digest corresponding to the content of the third data packet), and digital signature (the digital signature corresponding to the digest). The packet content includes the returned content, the sending time, and the validity period. The returned content includes the identity authentication success information.

[0234] S804, the terminal sends a fourth data packet to the server. The fourth data packet is used by the terminal to request disk encryption or decryption from the server.

[0235] Specifically, the fourth data packet is a data packet, which includes packet content (the content of the fourth data packet), digest (the digest corresponding to the content of the fourth data packet), and digital signature (the digital signature corresponding to the digest). The packet content includes request content, sending time, and validity period. The request content includes requesting disk encryption or decryption.

[0236] S805, the server sends the fifth data packet to the terminal. The fifth data packet is used by the server to return the disk partition identifier to the terminal.

[0237] Specifically, the fifth data packet is a data packet, which includes packet content (the content of the fifth data packet), digest (the digest corresponding to the content of the fifth data packet), and digital signature (the digital signature corresponding to the digest). The packet content includes return content, sending time, and validity period. The return content includes the disk partition identifier (PID).

[0238] S806 generates a data key based on the terminal's private key and the disk partition identifier.

[0239] Specifically, according to formulas (1) and (2), the terminal generates a data key DEK based on the terminal's private key and the disk partition identifier PID.

[0240] S807, the terminal sends a second data packet to the server. The second data packet is used by the terminal to send the data key to the server.

[0241] Specifically, the second data packet is a data packet, which includes packet content (the content of the second data packet), digest (the digest corresponding to the content of the second data packet), and digital signature (the digital signature corresponding to the digest). The packet content includes request content, sending time, and validity period. The request content includes data key DEK.

[0242] S808: The server receives the second data packet, stores the data key in memory encrypted using secure encryption virtualization technology, and retrieves the data key from memory to encrypt or decrypt the disk.

[0243] In a specific application scenario, such as disk encryption or decryption in cloud services, see [link to relevant documentation]. Figure 11 This illustrates the processing flow of a data processing method. For example... Figure 11 As shown, the data processing method provided in this application includes the following steps:

[0244] S901, the client tool c3pcli generates a key on the tenant's local machine.

[0245] Specifically, the tenant installs the client tool c3pcli locally and generates a key using the command "c3pcli genrsa". The key includes a public key pub.pem and a private key pri.pem. The tenant's local machine can be a terminal.

[0246] S902, the client tool c3pcli sends the first data packet to the server tool c3pctrld in the cloud virtual machine. The first data packet is used by the tenant to request authentication from the cloud virtual machine.

[0247] Specifically, the first data packet is a data packet that includes packet content (the content of the first data packet), a digest (the digest corresponding to the content of the first data packet), and a digital signature (the digital signature corresponding to the digest). The packet content includes a request message, the sending time, and the validity period. The request message includes the tenant's local request for authentication from the cloud virtual machine. The cloud virtual machine can be a server, or it can be a cloud server.

[0248] S903, the server tool c3pctrld sends a third data packet to the client tool c3pcli. The third data packet is used by the cloud virtual machine to return successful authentication information to the tenant's local machine, that is, to confirm the private key holder (tenant's local machine).

[0249] Specifically, the third data packet is a data packet, which includes packet content (the content of the third data packet), digest (the digest corresponding to the content of the third data packet), and digital signature (the digital signature corresponding to the digest). The packet content includes the returned content, the sending time, and the validity period. The returned content includes the identity authentication success information.

[0250] S904, the client tool c3pcli sends the fourth data packet to the server tool c3pctrld. The fourth data packet is used by the tenant to request disk encryption or decryption from the cloud virtual machine.

[0251] Specifically, the fourth data packet is a data packet, which includes packet content (the content of the fourth data packet), digest (the digest corresponding to the content of the fourth data packet), and digital signature (the digital signature corresponding to the digest). The packet content includes request content, sending time, and validity period. The request content includes requesting disk encryption or decryption.

[0252] S905, the server tool c3pctrld sends the fifth data packet to the client tool c3pcli. The fifth data packet is used by the cloud virtual machine to return the disk partition identifier (PID) to the tenant's local machine.

[0253] Specifically, c3pcli sends a request to c3pctrld to encrypt a disk, specifying the disk device or disk partition to be encrypted. After receiving the request, c3pctrld processes it as follows: if the disk device or partition specified by the user (tenant's local machine) does not exist, c3pctrld returns an error; if the user specifies a disk partition, c3pctrld calculates the PID and returns it to the user; if the user specifies a disk device, c3pctrld first performs GPT partitioning, then calculates the PID and returns it to the user.

[0254] Specifically, the fifth data packet is a data packet, which includes packet content (the content of the fifth data packet), digest (the digest corresponding to the content of the fifth data packet), and digital signature (the digital signature corresponding to the digest). The packet content includes return content, sending time, and validity period. The return content includes the disk partition identifier (PID).

[0255] S906, based on the tenant's local private key and the disk partition identifier PID, the client tool c3pcli determines the data key DEK.

[0256] Specifically, according to formulas (1) and (2), the client tool c3pcli determines the data key DEK based on the tenant's local private key and the disk partition identifier PID.

[0257] S907, the client tool c3pcli sends a second data packet to the server tool c3pctrld. The second data packet is used by the tenant to send the data key DEK to the cloud virtual machine locally.

[0258] Specifically, the second data packet is a data packet, which includes packet content (the content of the second data packet), digest (the digest corresponding to the content of the second data packet), and digital signature (the digital signature corresponding to the digest). The packet content includes request content, sending time, and validity period. The request content includes data key DEK.

[0259] S908, the server tool c3pctrld receives the second data packet, stores the data key DEK in memory encrypted with secure encryption virtualization technology, and calls the data key DEK from memory to encrypt or decrypt the disk.

[0260] Specifically, after receiving the data key, the server-side tool c3pctrld creates a tmpfs and mounts it to a directory; for example, in Linux, the tmpfs can be mounted to the directory / data / folder. Storing the data key in the directory, that is, storing the data key in the tmpfs, is equivalent to storing the data key in memory encrypted with AMD SEV secure virtualization technology.

[0261] It should be noted that since reading and writing to the encrypted disk requires the participation of the data key DEK, and whether the data key DEK is stored on the disk or loaded into memory, it is at risk of being stolen. In cloud virtual machines based on AMD SEV, the memory is encrypted and protected, and the data key DEK is stored in the directory mounted by tmpfs. That is, the data key DEK is stored in the memory encrypted by the secure encrypted virtualization technology AMD SEV, thereby achieving protection of the data key DEK.

[0262] In one embodiment, c3pctrld uses the cryptsetup tool to convert the specified partition into a LUKS partition and uses the "--master-key-file" parameter to specify the path to the DEK, making it the master key for the LUKS encrypted partition. Once the LUKS partition is created, the user (tenant local) can format the LUKS partition and mount it for use.

[0263] S909, the server tool c3pctrld sends the sixth data packet to the client tool c3pcli. The sixth data packet is used by the cloud virtual machine to return information about whether disk encryption or decryption has been completed to the tenant's local machine.

[0264] Specifically, the sixth data packet is a data packet, which includes packet content (the content of the sixth data packet), digest (the digest corresponding to the content of the sixth data packet), and digital signature (the digital signature corresponding to the digest). The packet content includes return content, sending time, and validity period. The return content includes information about whether disk encryption or decryption has been completed.

[0265] Applying the embodiments of this application has at least the following beneficial effects:

[0266] This approach excludes cloud providers from the trusted zone and stores the designated data keys in encrypted memory (the memory of the cloud virtual machine) based on AMD SEV (AMD Secure Virtualization Virtualization) technology. This protects the data keys and ensures their security, thereby enhancing the security of disk encryption and decryption. Under this semi-honest security model, user data is protected from theft. Tenants can manage all encrypted storage by holding a unique private key, eliminating the need to maintain a separate key for each encrypted disk, greatly simplifying tenant usage. The tenant's unique key remains on their local trusted device, and all sensitive data in the cloud is stored in encrypted form, with the cloud virtual machine's memory protected by AMD SEV encryption.

[0267] This application also provides a data processing device applied to a server, and a schematic diagram of the data processing device is shown below. Figure 12 As shown, the data processing device 80 includes a first processing module 801, a second processing module 802, a third processing module 803, and a fourth processing module 804.

[0268] The first processing module 801 is used to determine the partition identifier of the disk in response to an encryption or decryption request from the terminal for the disk.

[0269] The second processing module 802 is used to send the disk partition identifier to the terminal so that the terminal can generate a data key based on the disk partition identifier and the terminal's private key.

[0270] The third processing module 803 is used to receive the data key sent by the terminal and store the data key in memory encrypted based on secure encryption virtualization technology;

[0271] The fourth processing module 804 is used to retrieve the data key from memory to encrypt or decrypt the disk.

[0272] In one embodiment, the third processing module 803 is specifically used for:

[0273] Build a memory file system and mount it to a preset directory; the memory file system corresponds to the memory encrypted by secure encryption virtualization technology, and the directory corresponds to the memory address;

[0274] The data key is stored in a directory, and there is a mapping relationship between the directory and the memory file system.

[0275] In one embodiment, the fourth processing module 804 is specifically used for:

[0276] The system reads the data key from the memory file system corresponding to the memory through a preset partition encryption system; and encrypts or decrypts the disk using the data key.

[0277] In one embodiment, the first processing module 801 is further configured to:

[0278] Obtain the public key corresponding to the terminal's private key;

[0279] The receiving terminal sends a first data packet; the first data packet includes the content of the first data packet, a digest corresponding to the content of the first data packet, and a digital signature corresponding to the digest; the first data packet is used by the terminal to request authentication from the server.

[0280] Based on the content, digest, digital signature, and public key of the first data packet, the terminal's identity is authenticated. After successful authentication, the steps of determining the disk partition identifier are executed in response to the encryption or decryption request from the terminal.

[0281] Applying the embodiments of this application has at least the following beneficial effects:

[0282] By storing the determined data key in memory encrypted using secure encryption virtualization technology, the data key is protected, ensuring its security and thus improving the security of encrypting or decrypting the disk; this also guarantees that user data will not be stolen under the semi-honest security model.

[0283] This application also provides a data processing device for use in a terminal, and a schematic diagram of the data processing device is shown below. Figure 13 As shown, the data processing device 90 includes a fifth processing module 901, a sixth processing module 902, and a seventh processing module 903.

[0284] The fifth processing module 901 is used to obtain the terminal's private key and the disk partition identifier;

[0285] The sixth processing module 902 is used to generate a data key based on the private key and the disk partition identifier;

[0286] The seventh processing module 903 is used to send the data key to the server so that the server can store the data key in memory encrypted based on secure encryption virtualization technology. The data key stored in memory is used to encrypt or decrypt the disk.

[0287] In one embodiment, the sixth processing module 902 is specifically used for:

[0288] The private key and preset constant characters are concatenated to obtain the concatenated data;

[0289] The data after connection processing is hashed to obtain the first key;

[0290] Based on the first key and the disk partition identifier, a data key is generated using a key hashing algorithm.

[0291] In one embodiment, the seventh processing module 903 is specifically used for:

[0292] Send a second data packet carrying the data key to the server; the second data packet includes the content of the second data packet, a digest corresponding to the content of the second data packet, and a digital signature corresponding to the digest, and the content of the second data packet includes the data key.

[0293] Applying the embodiments of this application has at least the following beneficial effects:

[0294] By storing the determined data key in memory encrypted using secure encryption virtualization technology, the data key is protected, ensuring its security and thus improving the security of encrypting or decrypting the disk; this also guarantees that user data will not be stolen under the semi-honest security model.

[0295] This application also provides an electronic device, the structural schematic diagram of which is shown below. Figure 14 As shown, Figure 14 The illustrated electronic device 4000 includes a processor 4001 and a memory 4003. The processor 4001 and the memory 4003 are connected, for example, via a bus 4002. Optionally, the electronic device 4000 may further include a transceiver 4004, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 4004 is not limited to one type, and the structure of the electronic device 4000 does not constitute a limitation on the embodiments of this application.

[0296] Processor 4001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 4001 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0297] Bus 4002 may include a pathway for transmitting information between the aforementioned components. Bus 4002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 4002 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 14 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0298] The memory 4003 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media, other magnetic storage devices, or any other medium capable of carrying or storing computer programs and capable of being read by a computer, without limitation herein.

[0299] The memory 4003 stores computer programs that execute embodiments of this application, and its execution is controlled by the processor 4001. The processor 4001 executes the computer programs stored in the memory 4003 to implement the steps shown in the foregoing method embodiments.

[0300] Electronic devices include, but are not limited to, servers and terminals.

[0301] Applying the embodiments of this application has at least the following beneficial effects:

[0302] By storing the determined data key in memory encrypted using secure encryption virtualization technology, the data key is protected, ensuring its security and thus improving the security of encrypting or decrypting the disk.

[0303] This application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement the steps and corresponding content of the aforementioned method embodiments.

[0304] This application also provides a computer program product, including a computer program that, when executed by a processor, can implement the steps and corresponding content of the aforementioned method embodiments.

[0305] Based on the same principles as the methods provided in the embodiments of this application, the embodiments of this application also provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in any of the optional embodiments of this application described above.

[0306] It should be understood that although arrows indicate various operation steps in the flowcharts of this application's embodiments, the order in which these steps are implemented is not limited to the order indicated by the arrows. Unless explicitly stated herein, in some implementation scenarios of this application's embodiments, the implementation steps in each flowchart can be executed in other orders as required. Furthermore, some or all steps in each flowchart, based on the actual implementation scenario, may include multiple sub-steps or multiple stages. Some or all of these sub-steps or stages can be executed at the same time, and each sub-step or stage can also be executed at different times. In scenarios where execution times differ, the execution order of these sub-steps or stages can be flexibly configured according to requirements, and this application's embodiments do not limit this.

[0307] The above description is only an optional implementation method for some implementation scenarios of this application. It should be noted that for those skilled in the art, other similar implementation methods based on the technical concept of this application without departing from the technical concept of this application also fall within the protection scope of the embodiments of this application.

Claims

1. A data processing method, characterized in that, include: The terminal generates a first data packet and sends the first data packet to the server; The server authenticates the terminal based on the first data packet. If the terminal's authentication is successful, the server responds to the encryption or decryption request from the terminal for the disk and determines the partition identifier of the disk. The server sends the disk partition identifier to the terminal; The terminal generates a data key based on the partition identifier of the disk; The server receives the data key sent by the terminal and stores the data key in memory encrypted using secure encryption virtualization technology; The server retrieves the data key from the memory to encrypt or decrypt the disk.

2. The method according to claim 1, characterized in that, The server performs identity authentication on the terminal based on the first data packet, including: The server obtains the public key corresponding to the private key of the terminal; The server receives a first data packet sent by the terminal; the first data packet includes the content of the first data packet, a digest corresponding to the content of the first data packet, and a digital signature corresponding to the digest. Based on the content of the first data packet, the digest, the digital signature, and the public key, the server authenticates the identity of the terminal. After the authentication of the terminal is successful, the server executes the step of determining the partition identifier of the disk in response to the encryption or decryption request from the terminal for the disk.

3. The method according to claim 2, characterized in that, The first data packet includes a request content, a sending time, and a validity period. The terminal generates the first data packet, which includes: The terminal merges the binary value of the request content, the binary value of the sending time, and the binary value of the validity time to obtain the merged data. The terminal will merge the processed data, calculate the hash value using a hash function, and set the hash value in the digest. The terminal encrypts the digest using its private key to obtain an encrypted digest. The encrypted digest is stored in the digital signature; The terminal generates the first data packet based on the content of the first data packet, the digest, and the digital signature.

4. The method according to claim 2, characterized in that, The first data packet content includes a request content, a sending time, and a validity period. Based on the first data packet content, the digest, the digital signature, and the public key, the server authenticates the terminal's identity, including: The server decrypts the digital signature using the public key. If the server cannot decrypt the digital signature, the server returns an authentication error to the terminal. If the server successfully decrypts the digital signature, the server compares the decrypted result with the digest. If the decrypted result and the digest are not equal, the server returns an authentication error to the terminal. If the decrypted result is equal to the digest, the server merges the binary value of the request content, the binary value of the sending time, and the binary value of the validity time to obtain merged data. The server calculates a hash value using a hash function and compares the hash value with the digest. If the hash value is not equal to the digest, the server returns an authentication error to the terminal. If the hash value is equal to the digest, the server compares the validity period with the sending time. If the sending time has exceeded the validity period, the server returns a request expiration error to the terminal.

5. The method according to claim 1, characterized in that, In response to an encryption or decryption request from a terminal for the disk, the server determines the partition identifier of the disk, including: The server receives a fourth data packet sent by the terminal. The fourth data packet includes the content of the fourth data packet, a digest corresponding to the content of the fourth data packet, and a digital signature corresponding to the digest. The content of the fourth data packet includes a request, which includes an encryption request or a decryption request for the disk. Based on the request content and the disk's partition structure, the server determines the disk's partition identifier.

6. The method according to claim 1, characterized in that, The server sends the disk partition identifier to the terminal, including: The server sends a fifth data packet to the terminal; the fifth data packet includes the content of the fifth data packet, a digest corresponding to the content of the fifth data packet, and a digital signature corresponding to the digest. The content of the fifth data packet includes return content, sending time, and validity period. The return content includes the partition identifier of the disk.

7. The method according to claim 1, characterized in that, The terminal generates a data key based on the disk's partition identifier, including: The terminal obtains the private key of the terminal; The terminal generates a data key based on its private key and the disk partition identifier.

8. The method according to claim 7, characterized in that, Based on the private key and the disk partition identifier, the terminal generates a data key, including: The terminal concatenates the private key and preset constant characters to obtain concatenated data. The terminal uses a hash algorithm to obtain a first key from the data processed by the connection; Based on the first key and the partition identifier of the disk, the terminal generates a data key using a key hashing algorithm.

9. The method according to claim 1, characterized in that, The server receives the data key sent by the terminal, including: The terminal sends a second data packet carrying the data key to the server; the second data packet includes the content of the second data packet, a digest corresponding to the content of the second data packet, and a digital signature corresponding to the digest, and the content of the second data packet includes the data key; The server receives the second data packet and obtains the data key from the content of the second data packet.

10. The method according to claim 1, characterized in that, The step of storing the data key in memory encrypted using secure encryption virtualization technology includes: The server constructs a memory file system; The server stores the data key in memory encrypted using secure encryption virtualization technology, based on the memory file system and a preset directory.

11. The method according to claim 10, characterized in that, The server, based on the memory file system and a preset directory, stores the data key in memory encrypted using secure virtualization technology, including: The server mounts the memory file system to a preset directory; the memory file system corresponds to the memory encrypted using secure encryption virtualization technology, and the directory corresponds to the memory address of the memory. The server stores the data key in the directory, and there is a mapping relationship between the directory and the memory file system.

12. The method according to claim 1, characterized in that, The step of retrieving the data key from the memory to encrypt or decrypt the disk includes: The server reads the data key from the memory file system corresponding to the memory through a preset partition encryption system; and encrypts or decrypts the disk using the data key.

13. A data processing system, characterized in that, Includes servers and terminals; The terminal generates a first data packet and sends the first data packet to the server. The server authenticates the terminal based on the first data packet. If the terminal's authentication is successful, the server responds to the encryption or decryption request from the terminal for the disk and determines the partition identifier of the disk. The server sends the disk partition identifier to the terminal; The terminal generates a data key based on the partition identifier of the disk; The server receives the data key sent by the terminal and stores the data key in memory encrypted using secure encryption virtualization technology; The server retrieves the data key from the memory to encrypt or decrypt the disk.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1-12.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-12.

Images