A data encryption storage and transmission protection method

Abstract

The present invention discloses a data encryption storage and transmission protection method, which relates to the technical field of data transmission. The method specifically comprises performing bilateral disk configuration of a cloud storage disk based on data to be encrypted; performing encrypted storage of the entire disk; and performing encryption and decryption during data transmission based on a user key in a first-level secure storage management and a mapping in an encrypted volume in a second-level secure storage management by the cloud storage disk. The present invention solves the risk of data leakage and tampering caused by illegal access during data storage, transmission and sharing. At the same time, the storage data is segmented in the present application to ensure full utilization of non-segmented data storage space, improve storage efficiency and security of non-segmented storage of encrypted data of storage type, and access control based on a public-private key pair password and a USB key security key not only ensures the security of user access, but also ensures the security of storage data space.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a data encryption storage and transmission protection method. Background Art

[0002] Encryption technology is an important means to achieve secure data storage. When encrypting data, different encryption algorithms are selected according to the sensitivity of the data and the security of the network environment. In the existing data forensics platform, computing resources are allocated to users through virtualization technology in the cloud, resulting in the elimination of the physical boundaries of different users' data. The existing data encryption storage structure is usually composed of multiple layers. Deletion in one layer usually cannot completely eliminate the data because data leakage may be observed in other layers. Different users share a variety of computing resources including memory, disk, network, etc. During the data transmission and sharing process, the risk of data leakage and tampering due to illegal access is increased, resulting in a variety of security risks including data confidentiality and personal privacy. In addition, cloud storage is more vulnerable to online attacks than traditional storage. Attackers use the network to monitor and collect confidential data in the cloud at all times to carry out attacks. Therefore, it is necessary to design a data encryption storage and transmission protection method that improves the security of data encryption storage and reduces transmission risks. Summary of the invention

[0003] The purpose of the present invention is to provide a data encryption storage and transmission protection method to solve the problems raised in the above background technology.

[0004] In order to solve the above technical problems, the present invention provides the following technical solutions: a data encryption storage and transmission protection method, comprising the following steps:

[0005] Bilateral disk configuration of cloud storage disks based on the data to be encrypted;

[0006] Perform full disk encrypted storage;

[0007] The cloud storage disk performs encryption and decryption during data transmission based on the user key in the first-level secure storage management and the mapping in the encrypted volume in the second-level secure storage management.

[0008] According to the above technical solution, the bilateral disk configuration of the cloud storage disk includes:

[0009] The platform uses TLS / SSL protocol in the cloud storage environment to encrypt all data entering and leaving the cloud. The cloud storage disk obtains data encryption instructions and classifies the data that needs to be encrypted into storage types.

[0010] The classification of the storage type includes: encrypted data non-segmented storage and encrypted data segmented storage, wherein the encrypted data non-segmented storage is to place the encrypted data on the full disk of the cloud storage, and the encrypted data segmented storage is to place the encrypted data in a segmented offset area set in the cloud storage disk, and the segmented offset area is a storage area divided by the cloud storage disk according to the storage offset of the encrypted data;

[0011] The storage offset is calculated based on the distance between the starting position of the encrypted data stored on the cloud storage disk and the starting position of the cloud storage disk, and different split offset areas are further divided by setting different storage offsets. The split offset areas each store different encrypted data split storage category data.

[0012] According to the above technical solution, the bilateral disk configuration of the cloud storage disk also includes:

[0013] Classified data whose data storage type is encrypted data non-split storage is prevented from being placed on the entire cloud storage disk, and classified data whose data storage type is encrypted data split storage is prevented from being placed in the split offset area set in the cloud storage disk. The cloud storage disk includes the split offset area and the remaining disk area. The two areas divide the entire disk into a hidden bilateral disk, that is, there is an encrypted storage boundary of data split encryption and non-split encryption. The encrypted data placed in the non-split storage on the entire disk has a placement order, and the encrypted data placed in the split offset area is placed randomly.

[0014] According to the above technical solution, the encrypted storage of the entire disk includes:

[0015] Perform first-level secure storage management of the entire disk through the security key configured to the user;

[0016] The key management terminal generates and backs up the user's public and private key pairs, imports the public and private key pairs into the selected password, and uses the USB key security key to store the user's private key and digital certificate;

[0017] Users with public-private key pair passwords can access the full disk data storage space through the corresponding passwords. Users with public-private key pair passwords and USB key security keys can access the data storage space with encrypted data non-segmented storage through the corresponding passwords and security keys.

[0018] The digital certificate built into the USB key memory is used to authenticate the user's access to the data storage space whose data type is encrypted data segmentation storage.

[0019] According to the above technical solution, the access verification includes:

[0020] When a user needs to access the required data storage space, the user's access operation authority will be verified; if the verification is passed, the user is allowed to access the required data storage space normally; otherwise, the user's data access operation request is rejected.

[0021] According to the above technical solution, the encrypted storage of the whole disk further includes:

[0022] The entire storage cloud storage disk is virtualized into a data block resource pool, and the second-level secure storage management is established. The data blocks storing the two data types are converted into encrypted volume groups respectively, and two logical volumes are created in the encrypted volume group. The two logical volumes are mapped to non-partitioned data storage space and partitioned data storage space respectively. Both the non-partitioned data storage space and the partitioned data storage space can only be called by one logical volume;

[0023] Convert the split data storage space into an encrypted logical pool, create multiple encrypted volumes and physical logical blocks on the encrypted logical pool, and when a physical logical block in the encrypted logical pool is allocated to an encrypted volume, mark the physical logical block as used in the data storage space and no longer be allocated to other encrypted volumes;

[0024] The encrypted volume is further mapped to a virtual volume of encrypted storage. After the virtual volume of encrypted storage is created, data storage resources are allocated only when data is stored in the virtual volume. The capacity allocated when creating the virtual volume of encrypted storage is virtual capacity and does not represent the actual data storage capacity of the volume.

[0025] During initialization, the size of each encrypted storage virtual volume is set to the entire storage device space, and data security is enhanced by performing encrypted data segmentation storage in the encrypted storage virtual volume mode. For applications at the data call layer, the calling rules of the logical volume containing the encrypted storage virtual volume mode are the same as those of another logical volume.

[0026] According to the above technical solution, mapping the logical volume includes:

[0027] The cloud storage disk dynamically blocks the storage data mapped to the non-partitioned data storage space by the logical volume. When the stored data is less than the set threshold, the data is not divided into multiple blocks for parallel distributed storage according to the available cloud storage disk space in the system. The storage data is dynamically divided and processed by a set of block factors according to the size of the stored data and the load of the non-partitioned data storage space.

[0028] When the size of the stored data is lower than the set policy selection threshold or the load of the non-partitioned data storage space is lower than the set load threshold, the extracted byte blocking strategy is used to perform unequal storage space partitioning on the stored data; when the size of the stored data is greater than or equal to the set policy selection threshold or the load of the non-partitioned data storage space is greater than or equal to the set load threshold, the equal blocking reorganization strategy is used to perform storage space equal partitioning on the stored data.

[0029] According to the above technical solution, the encryption and decryption in the data transmission process includes: the cloud storage disk determines the logical volume corresponding to the storage space based on the data storage type in the disk space, and provides feedback on the encryption status of the stored data based on the logical volume. When the feedback storage data is encrypted or being encrypted, the encryption operation will be ended. When the feedback storage data is unencrypted, it will trigger the shutdown of the data service currently running on the disk, and initialize the data information encryption for the storage block of the unencrypted data.

[0030] According to the above technical solution, the data information encryption initialization includes: using the set encryption mapping to create a virtual encrypted storage block and mapping it to the real storage space block, encrypting the corresponding sector on the real storage space block each time the virtual storage space block is written, and synchronously decrypting the corresponding sector on the real storage space block each time the sector is read from the virtual storage space block. After the encryption mapping is created, the cloud storage disk mounts a temporary data storage block, creates a path for mounting the data storage space block through the temporary data storage block and triggers the encryption start behavior, and marks the data encryption completion when the data storage space block encryption is completed.

[0031] According to the above technical solution, the encryption and decryption during data transmission also includes: two different usage states including standard mode and hidden mode based on user key mapping in the first-level secure storage management;

[0032] The standard mode is for users to call and encrypt and decrypt data in the non-divided data storage space by using a password configured with a public-private key pair, and the hidden mode is for users to access the mode by using a password configured with a public-private key pair and combining it with a USB key security key;

[0033] When the user inputs the password configured with the public-private key pair, the cloud storage disk starts to decrypt the data of the mounted logical volume and enters the standard mode. The user uses the standard mode to call and transfer data in the storage space of the corresponding data type, and generates more virtual data in this logical volume to cover the encrypted data segmentation storage type data. When the user needs to enter the hidden mode, it is done through the password entered in the standard mode and the USB key security key.

[0034] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: the present invention performs bilateral disk configuration of the cloud storage disk based on the data to be encrypted; performs encrypted storage of the entire disk; the cloud storage disk performs encryption and decryption during data transmission based on the user key in the first-level secure storage management and the mapping in the encrypted volume in the second-level secure storage management, thereby solving the data risk problem in the data storage, transmission and sharing process. Loading the cloud storage disk encrypted data under the first and second-level secure storage management can not only reduce the risk of overall leakage of the stored data, ensure the confidentiality and integrity of the cloud storage data, but also facilitate the parallel transmission of the stored data, improve the problem of storage access efficiency of the existing cloud storage disk, and by establishing the first and second-level secure storage management, it is possible to effectively avoid the risk of failure of the stored data of a single cloud storage disk on the basis of data block segmentation, reduce the user's dependence on the availability of the cloud storage disk, and enhance the reliability of the stored data. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0036] Figure 1 A schematic flowchart of the steps of a data encryption storage and transmission protection method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] Embodiment: This embodiment can be applied to scenarios of data encryption storage and transmission. The method can be performed by a data encryption storage and transmission protection method provided by this embodiment. The method specifically includes the following steps:

[0039] Bilateral disk configuration of cloud storage disks based on the data to be encrypted;

[0040] Perform full disk encrypted storage;

[0041] The cloud storage disk performs encryption and decryption during data transmission based on the user key in the first-level secure storage management and the mapping in the encrypted volume in the second-level secure storage management.

[0042] In an embodiment of the present invention, the platform uses the TLS / SSL protocol in a cloud storage environment to encrypt all data entering and leaving the cloud. The cloud storage disk obtains data encryption instructions and classifies the data to be encrypted into storage types. The classification of storage types includes: encrypted data non-segmented storage and encrypted data segmented storage, wherein the encrypted data non-segmented storage is to place the encrypted data on the full disk of the cloud storage, and the encrypted data segmented storage is to place the encrypted data in a segmented offset area set in the cloud storage disk. The segmented offset area is a storage area divided by the cloud storage disk according to the storage offset of the encrypted data, that is, the storage offset is calculated according to the distance between the starting position of the encrypted data stored on the cloud storage disk and the starting position of the cloud storage disk, and different segmented offset areas are further divided by setting different storage offsets, and each segmented offset area stores different encrypted data segmented storage category data;

[0043] For example, a basic offset is defined (for example, 1GB, i.e., 1024×1024×1024 bytes), and this offset is used as the basic unit for dividing different storage areas. The starting offset of each file is calculated. For each encrypted file, the distance between its starting position and the starting position of the cloud storage disk is calculated (in bytes). This distance is the starting offset of the file. According to the starting offset of each file, the disk is divided into multiple areas. Each area contains all files whose starting offsets fall within a certain range. The first area contains all the starting files. Files with offsets between 0 and 1GB, the second area contains files between 1GB and 2GB. For example, there are three encrypted files, and their starting storage positions (in bytes) are as follows: File A: 500MB (i.e. 500×1024×1024 bytes), File B: 1.8GB (i.e. 1800×1024×1024 bytes), File C: 3.5GB (i.e. 3500×1024×1024 bytes). According to the above division strategy, the starting offset of File A is between 0 and 1GB, so it belongs to the first storage area. The starting offset of File B is between 1GB and 2GB (in fact, it crosses the boundary between 1GB and 2GB, but according to the starting position division, it mainly belongs to the second area), so it mainly belongs to the second storage area. The starting offset of File C is between 3GB and 4GB (again, it may span multiple areas, but it mainly belongs to the third area), so it mainly belongs to the third storage area.

[0044] Exemplarily, classified data whose data storage type is encrypted data non-split storage is prevented from being placed on the entire cloud storage disk, and classified data whose data storage type is encrypted data split storage is prevented from being placed in a split offset area set in the cloud storage disk. The cloud storage disk includes a split offset area and other disk areas. The two areas divide the entire disk into a hidden bilateral disk, that is, there is an encrypted storage boundary between data split encryption and non-split encryption. The encrypted data placed in the non-split storage on the entire disk has a placement order, and the encrypted data placed in the split offset area is placed randomly.

[0045] Exemplarily, the non-split encrypted storage area in the hidden bilateral disk is located at the beginning or designated position of the disk, and is used to sequentially store encrypted data that does not need to be split into small blocks or does not need to be specially managed by offsets. The placement order of the data is based on timestamps, file IDs, or other logical sequences. The split offset encrypted storage area occupies the rest of the disk or the designated area, and is used to randomly place data blocks encrypted by splitting and offset techniques. Each data block is split into smaller parts before storage, and these parts are randomly placed throughout the area to increase the difficulty of data recovery and parsing. By using different storage offsets, each data block or each part of a data block is placed at a different location on the disk. Since the data is randomly placed, even if an attacker has access to certain parts of the disk, the original data cannot be reconstructed. Exemplarily, when the total capacity of the disk is 1TB, it is divided into two areas:

[0046] Non-split encrypted storage area (first 200GB), this area stores 100 encrypted files in sequence, each with an average size of 2GB. The files are placed in the order in which they are encrypted and prepared for storage. The split offset encrypted storage area (the remaining 800GB) is divided into multiple smaller blocks or "slots", each slot stores a part of a data block. When there are 500 files that need to be split and encrypted, each file is split into multiple blocks (exemplarily, 10MB per block), which are randomly assigned to different slots within the 800GB area, ensuring that no two identical parts of the block are stored in adjacent locations.

[0047] In the embodiment of the present invention, the first-level secure storage management of the whole disk is performed by the security key configured to the user, the key management terminal generates and backs up the public-private key pair of the user, imports the public-private key pair into the selected password, and further uses the USB key security key to store the user's private key and digital certificate. The user with the public-private key pair password configured can access the data storage space of the whole disk through the corresponding password, and the user with the public-private key pair password and the USB key security key configured can access the data storage space of the data type of encrypted data non-segmented storage through the corresponding password and security key. The digital certificate built into the USB key memory is used to authenticate the user's access to the data storage space of the data type of encrypted data segmented storage. When the user needs to access the required data storage space, the user's access operation authority will be verified; if the verification is passed, the user is allowed to access the required data storage space normally; otherwise, the user's data access operation request is rejected. The access control based on the public-private key pair password and the USB key security key not only ensures the security of user access, but also ensures the security of the storage data space;

[0048] Exemplarily, the entire storage cloud storage disk is virtualized into a data block resource pool, a second-level secure storage management is established, and then the data blocks storing the two data types are respectively converted into an encrypted volume group, two logical volumes are created in the encrypted volume group, and the two logical volumes are respectively mapped to a non-partitioned data storage space and a partitioned data storage space, and both the non-partitioned data storage space and the partitioned data storage space can only be called by one logical volume, and then the partitioned data storage space is converted into an encrypted logical pool, and multiple encrypted volumes and physical logical blocks are created on the encrypted logical pool. When a physical logical block in the encrypted logical pool is allocated to an encrypted volume, the physical logical block is allocated to the data storage space. Marked as used, it will no longer be allocated to other encrypted volumes. The encrypted volume is further mapped to an encrypted storage virtual volume. After the encrypted storage virtual volume is created, data storage resources are allocated only when data is stored in the virtual volume. The capacity allocated when creating the encrypted storage virtual volume is represented by virtual capacity and does not represent the actual data storage capacity of the volume. During initialization, the size of each encrypted storage virtual volume is set to the entire storage device space. In the encrypted storage virtual volume mode, encrypted data is segmented and stored to enhance data security. For applications at the data call layer, the logical volume containing the encrypted storage virtual volume mode has the same calling rules as another logical volume.

[0049] Exemplarily, the cloud storage disk dynamically blocks the storage data mapped as the non-partitioned data storage space by the logical volume. When the stored data is smaller than a set threshold, it is not necessary to divide the data into multiple blocks for parallel distributed storage according to the space of the available cloud storage disk in the system. The stored data is dynamically divided and processed by a group of block factors according to the size of the stored data and the load of the non-partitioned data storage space. When the size of the stored data is lower than the set policy selection threshold or the load of the non-partitioned data storage space is smaller than the set load threshold, the storage data is divided into unequal storage spaces using the extracted byte block strategy. When the size of the stored data is greater than or equal to the set policy selection threshold or the load of the non-partitioned data storage space is greater than or equal to the set load threshold, the storage data is divided into equal storage spaces using the equal block reorganization strategy. The storage data is divided and processed to ensure full utilization of the non-partitioned data storage space and improve the storage efficiency and security of the encrypted data non-partitioned storage type.

[0050] In an embodiment of the present invention, the cloud storage disk determines the logical volume corresponding to the storage space based on the data storage type in the disk space, and provides feedback on the encryption status of the stored data based on the logical volume. When the feedback storage data is in an encrypted or encrypting state, the encryption operation is terminated. When the feedback storage data is in an unencrypted state, the data service currently running on the disk is triggered to be closed, and the data information encryption of the storage block of the unencrypted data is initialized. A virtual encrypted storage block is created by using the set encryption mapping and mapped to the real storage space block. Each time the virtual storage space block is written, the corresponding sector on the real storage space block is encrypted. Each time the sector is read from the virtual storage space block, the corresponding sector on the real storage space block is synchronously decrypted. After the encryption mapping is created, the cloud storage disk mounts a temporary data storage block, creates a path for mounting the data storage space block through the temporary data storage block, and triggers the encryption start behavior. When the data storage space block encryption is completed, the data encryption is marked as completed.

[0051] Exemplarily, the user key mapping based on the first-level secure storage management includes two different usage states: standard mode and hidden mode. The standard mode is for users to call and encrypt, decrypt and transmit data in non-partitioned data storage space by using a password configured with a public-private key pair. The hidden mode is for users to access the mode by using a password configured with a public-private key pair and combining it with a USB key security key. When the user inputs the password configured with the public-private key pair, the cloud storage disk starts to decrypt the data of the mounted logical volume and enters the standard mode. The user uses the standard mode to call and transmit data in the storage space of the corresponding data type, and generates more virtual data in this logical volume to encrypt the data and cover the partitioned storage type data. When the user needs to enter the hidden mode, it is done through the password entered in the standard mode and the USB key security key.

[0052] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0053] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data encryption storage and transmission protection method, characterized in that: The method comprises the following steps: Bilateral disk configuration of cloud storage disks based on the data to be encrypted; Perform full disk encrypted storage; The cloud storage disk performs encryption and decryption during data transmission based on the user key in the first-level secure storage management and the mapping in the encrypted volume in the second-level secure storage management; The bilateral disk configuration of the cloud storage disk includes: The platform uses TLS / SSL protocol in the cloud storage environment to encrypt all data entering and leaving the cloud. The cloud storage disk obtains data encryption instructions and classifies the data that needs to be encrypted into storage types. The classification of the storage type includes: encrypted data non-segmented storage and encrypted data segmented storage, wherein the encrypted data non-segmented storage is to place the encrypted data on the full disk of the cloud storage, and the encrypted data segmented storage is to place the encrypted data in a segmented offset area set in the cloud storage disk, and the segmented offset area is a storage area divided by the cloud storage disk according to the storage offset of the encrypted data; The storage offset is calculated according to the distance between the starting position of the encrypted data stored on the cloud storage disk and the starting position of the cloud storage disk, and different split offset areas are further divided by setting different storage offsets, each split offset area stores data of a different encrypted data split storage category; The bilateral disk configuration of the cloud storage disk also includes: The classified data whose data storage type is encrypted data non-segmented storage is placed on the entire cloud storage disk, and the classified data whose data storage type is encrypted data segmented storage is placed in the segmented offset area set in the cloud storage disk. The cloud storage disk includes the segmented offset area and the remaining disk area. The two areas divide the whole disk into a hidden bilateral disk, that is, there is an encrypted storage boundary between data segmented encryption and non-segmented encryption. The encrypted data placed in the non-segmented storage on the whole disk has a placement order, and the encrypted data placed in the segmented offset area is randomly placed. The encrypted storage of the entire disk includes: Perform first-level secure storage management of the entire disk through the security key configured to the user; The key management terminal generates and backs up the user's public and private key pairs, imports the public and private key pairs into the selected password, and uses the USBKey security key to store the user's private key and digital certificate; Users with public-private key pair passwords can access the full disk data storage space through the corresponding passwords. Users with public-private key pair passwords and USB key security keys can access the data storage space with encrypted data non-segmented storage through the corresponding passwords and security keys. The digital certificate built into the USB key memory is used to authenticate the user's access to the data storage space whose data type is encrypted data segmentation storage; The access verification includes: When a user needs to access the required data storage space, the user's access operation authority will be verified; if the verification is passed, the user is allowed to access the required data storage space normally; otherwise, the user's data access operation request is rejected; The encrypted storage of the entire disk further includes: The entire storage cloud storage disk is virtualized into a data block resource pool, and the second-level secure storage management is established. The data blocks storing the two data types are converted into encrypted volume groups respectively, and two logical volumes are created in the encrypted volume group. The two logical volumes are mapped to non-partitioned data storage space and partitioned data storage space respectively. Both the non-partitioned data storage space and the partitioned data storage space can only be called by one logical volume; Convert the split data storage space into an encrypted logical pool, create multiple encrypted volumes and physical logical blocks on the encrypted logical pool, and when a physical logical block in the encrypted logical pool is allocated to an encrypted volume, mark the physical logical block as used in the data storage space and no longer be allocated to other encrypted volumes; The encrypted volume is further mapped to a virtual volume of encrypted storage. After the virtual volume of encrypted storage is created, data storage resources are allocated only when data is stored in the virtual volume. The capacity allocated when creating the virtual volume of encrypted storage is virtual capacity and does not represent the actual data storage capacity of the volume. During initialization, the size of each encrypted storage virtual volume is set to the entire storage device space, and data security is enhanced by performing encrypted data segmentation storage in the encrypted storage virtual volume mode. For applications at the data call layer, the calling rules of the logical volume containing the encrypted storage virtual volume mode are the same as those of another logical volume. The mapping for the logical volume includes: The cloud storage disk dynamically blocks the storage data mapped to the non-partitioned data storage space by the logical volume. When the stored data is less than the set threshold, the stored data is dynamically divided by a set of block factors according to the size of the stored data and the load of the non-partitioned data storage space; When the size of the stored data is lower than the set strategy selection threshold or the load of the non-split data storage space is lower than the set load threshold, the byte extraction block strategy is used to perform unequal storage space segmentation processing on the stored data; when the size of the stored data is greater than or equal to the set strategy selection threshold or the load of the non-split data storage space is greater than or equal to the set load threshold, the equal block reorganization strategy is used to perform storage space equalization processing on the stored data; The encryption and decryption in the data transmission process includes: the cloud storage disk determines the logical volume corresponding to the storage space based on the data storage type in the disk space, and provides feedback on the encryption status of the stored data based on the logical volume. When the feedback indicates that the stored data is encrypted or being encrypted, the encryption operation is terminated. When the feedback indicates that the stored data is unencrypted, the shutdown of the data service currently running on the disk is triggered, and the data information encryption is initialized for the storage block of the unencrypted data. The data information encryption initialization includes: using the set encryption mapping to create a virtual encryption storage block and mapping it to the real storage space block, encrypting the corresponding sector on the real storage space block each time the virtual storage space block is written, and synchronously decrypting the corresponding sector on the real storage space block each time the sector is read from the virtual storage space block. After the encryption mapping is created, the cloud storage disk mounts a temporary data storage block, creates a path for mounting the data storage space block through the temporary data storage block and triggers the encryption start behavior, and marks the data encryption completion when the data storage space block encryption is completed; The encryption and decryption during the data transmission process also includes: based on the user key mapping in the first-level security storage management, two different usage states including standard mode and hidden mode; The standard mode is for users to use the password configured with the public-private key pair to call and encrypt and decrypt data in the non-divided data storage space, and the hidden mode is for users to use the password configured with the public-private key pair and the USB key security key to perform mode access; When the user inputs the password configured with the public-private key pair, the cloud storage disk starts to decrypt the data of the mounted logical volume and enters the standard mode. The user uses the standard mode to call and transfer data in the storage space of the corresponding data type, and generates more virtual data in this logical volume to cover the encrypted data segmentation storage type data. When the user needs to enter the hidden mode, it is done through the password entered in the standard mode and the USB key security key.

Images