A sector encryption method, decryption method and device based on secure storage

Abstract

The present invention discloses a sector encryption method based on secure storage, comprising the following steps: in response to a data write request, obtaining a sector encryption volume key created based on a password card; determining the sector number according to the length of the data to be written; encrypting each sector number by calling the password card through the sector number key to obtain a sector number ciphertext; performing a finite field multiplication operation on the sector number ciphertext; performing a bitwise XOR operation on the operation result and the corresponding data to be written in the sector to be written to obtain plaintext XOR data; using a data key to call the password card to encrypt the plaintext XOR data to obtain encrypted data; performing a bitwise XOR operation on the encrypted data and the corresponding operation result to obtain ciphertext data. The present invention also discloses a sector decryption method based on secure storage, which is similar to the encryption method. The present invention improves the security of data encryption and improves the security of data encryption in a dual-control storage management system. The present invention also discloses a device for implementing the above method.

Description

Technical Field

[0001] The present invention relates to the technical field of sector encryption and decryption, and in particular to a sector encryption method, decryption method and device based on secure storage. Background Art

[0002] With the gradual improvement of enterprise information application technology, the accumulation and wide circulation of large amounts of information, various channels for the leakage of commercial secrets and technical secrets are everywhere, and there is an urgent need for simple, convenient and fast information security protection products.

[0003] In the prior art, in sector encryption technology, when data is written to a disk, the encryption algorithm will first encrypt the data and then place it in the corresponding sector of the disk. On the contrary, when the data needs to be read, the system will automatically decrypt the data in the sector to make it readable in plain text. This encryption method occurs in the low-level interaction between the operating system and the storage device, and is usually transparent to the upper-level applications and users, that is, the user will not feel the encryption and decryption process when accessing the file. This encryption method is generally a software encryption method. If the encryption algorithm has loopholes or is cracked, or the key management is poor, then the encrypted sector data may face the risk of leakage, and the security is poor; software encryption of sector block data usually requires writing complex code to implement, which increases the difficulty and cost of development and maintenance. At the same time, for dual-control storage management systems, data needs to be synchronized, and the encrypted data of the two is the same, which means that if the data of one party in the system is cracked, the data of the other party is also cracked, and the security is poor. Summary of the invention

[0004] In order to solve the above problems existing in the prior art, the present invention provides a sector encryption method, decryption method and device, electronic device and storage medium based on secure storage. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0005] A first aspect of an embodiment of the present invention provides a sector encryption method based on secure storage, comprising the following steps:

[0006] In response to a data write request, a sector encryption volume key created based on a password card is obtained from a database; wherein the sector encryption volume key includes: a sector number key and a data key;

[0007] Determining a sector number of at least one sector to be written according to the length of the data to be written;

[0008] Encrypt each sector number by calling the password card through the sector number key to obtain the sector number ciphertext of each sector number;

[0009] Performing a finite field multiplication operation on the sector number ciphertext to obtain an operation result;

[0010] Performing a bitwise XOR operation on the operation result and the corresponding data to be written in the sector to be written to obtain plaintext XOR data;

[0011] Using the data key to call the password card to encrypt the plaintext XOR data to obtain encrypted data;

[0012] Perform a bitwise XOR operation on the encrypted data and the corresponding operation result to obtain ciphertext data.

[0013] In one embodiment of the present invention, the method further comprises:

[0014] Create a sector encrypted volume and call the password card to generate the sector encrypted volume key;

[0015] The sector encrypted volume key is encrypted by using a system protection key, and the obtained encrypted volume key ciphertext is stored in a database.

[0016] In one embodiment of the present invention, the step of encrypting each sector number by calling the password card through the sector number key to obtain the sector number ciphertext of each sector number includes:

[0017] Each sector number is encrypted by calling the symmetric encryption algorithm of the password card through the sector number key to obtain the sector number ciphertext of each sector number; wherein the sector number ciphertext is 16 bytes.

[0018] In one embodiment of the present invention, performing a finite field multiplication operation on the sector number ciphertext to obtain an operation result includes:

[0019] Performing a finite field multiplication operation on the sector number ciphertext and 2j to obtain a 512-byte operation result;

[0020] Among them, j represents the grouping number in the sector. Each sector is evenly grouped with 16 bytes. The value range of j is 1-32.

[0021] A second aspect of an embodiment of the present invention provides a sector decryption method based on secure storage, comprising the following steps:

[0022] In response to a data read request, a sector encryption volume key created based on a password card is obtained from a database; wherein the sector encryption volume key includes: a sector number key and a data key;

[0023] Determine the sector number of the sector to be read according to the length of the data to be read;

[0024] Encrypt each sector number by calling the password card through the sector number key to obtain the sector number ciphertext of each sector number;

[0025] Performing a finite field multiplication operation on the sector number ciphertext to obtain an operation result;

[0026] Performing a bitwise XOR operation on the operation result and the corresponding ciphertext data of the sector to be read to obtain ciphertext XOR data;

[0027] Using the data key to call the password card to decrypt the ciphertext XOR data to obtain decrypted data;

[0028] The decrypted data is subjected to a bitwise XOR operation with the corresponding operation result to obtain plaintext data.

[0029] In one embodiment of the present invention, the step of obtaining the encryption volume key in response to the data read request includes:

[0030] In response to a data read request, the encrypted volume key ciphertext is obtained from a database, and is decrypted using the system protection key to obtain the encrypted volume key.

[0031] In one embodiment of the present invention, the step of using the data key to call the password card to decrypt the ciphertext XOR data to obtain the decrypted data includes:

[0032] The data key is used to call the symmetric decryption algorithm in the password card to decrypt the ciphertext XOR data to obtain decrypted data.

[0033] In one embodiment of the present invention, the step of performing a finite field multiplication operation on the sector number ciphertext to obtain an operation result includes:

[0034] Performing a finite field multiplication operation on the sector number ciphertext and 2j to obtain a 512-byte operation result;

[0035] Among them, j represents the grouping number in the sector. Each sector is evenly grouped with 16 bytes. The value range of j is 1-32.

[0036] A third aspect of an embodiment of the present invention provides a sector encryption device based on secure storage, comprising:

[0037] An acquisition module, used for acquiring, in response to a write data request, a sector encryption volume key created based on a password card from a database; wherein the sector encryption volume key includes: a sector number key and a data key;

[0038] A determination module, used to determine the sector number of at least one sector to be written according to the length of the data to be written;

[0039] The sector number encryption module is used to encrypt each sector number by calling the password card through the sector number key to obtain the sector number ciphertext of each sector number;

[0040] A first operation module, used for performing a finite field multiplication operation on the sector number ciphertext to obtain an operation result;

[0041] A second operation module is used to perform a bitwise XOR operation on the operation result and the corresponding data to be written in the sector to be written to obtain plaintext XOR data;

[0042] An encryption module, used to use the data key to call the password card to encrypt the plaintext XOR data to obtain encrypted data;

[0043] The encryption operation module is used to perform a bitwise XOR operation on the encrypted data and the corresponding operation result to obtain ciphertext data.

[0044] A fourth aspect of an embodiment of the present invention provides a sector decryption device based on secure storage, comprising:

[0045] An acquisition module, used for acquiring, in response to a data read request, a sector encryption volume key created based on a password card from a database; wherein the sector encryption volume key includes: a sector number key and a data key;

[0046] A determination module, used for determining the sector number of the sector to be read according to the length of the data to be read;

[0047] The sector number encryption module is used to encrypt each sector number by calling the password card through the sector number key to obtain the sector number ciphertext of each sector number;

[0048] A first operation module, used for performing a finite field multiplication operation on the sector number ciphertext to obtain an operation result;

[0049] A second operation module, used for performing a bitwise XOR operation on the operation result and the corresponding ciphertext data of the to-be-read sector to obtain ciphertext XOR data;

[0050] A decryption module, used to use the data key to call the password card to decrypt the ciphertext XOR data to obtain decrypted data;

[0051] The decryption operation module is used to perform a bitwise XOR operation on the decrypted data and the corresponding operation result to obtain plaintext data.

[0052] Beneficial effects of the present invention:

[0053] The encryption card of the present invention can generate a random number that cannot be predicted or copied as a key, and the encryption card is used to encrypt sector block data at the physical level. The key management and encryption operation are both performed in the encryption card, which makes it more difficult to be attacked and cracked from the outside. Moreover, the encryption operation is not affected by operating system vulnerabilities, viruses or malicious software, so it is safer and more reliable. Moreover, the data is double-encrypted by the sector number key and the data key, which improves the security of data encryption. At the same time, for the dual-control storage management system, the same data is written into different sectors. Since the sector numbers are different, the encrypted data are different, which improves the security of data encryption in the dual-control storage management system.

[0054] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0055] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0057] Figure 1 A schematic diagram of a flow chart of a sector encryption method based on secure storage provided by an embodiment of the present invention;

[0058] Figure 2 A schematic flow chart of a sector decryption method based on secure storage provided by an embodiment of the present invention;

[0059] Figure 3 A schematic block diagram of a sector encryption device based on secure storage provided by an embodiment of the present invention;

[0060] Figure 4 A schematic block diagram of a sector decryption device based on secure storage provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0061] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0062] like Figure 1 As shown, a first aspect of an embodiment of the present invention provides a sector encryption method based on secure storage, comprising the following steps:

[0063] Step 11, in response to a request to write data, obtain a sector encryption volume key created based on the password card from a database.

[0064] The sector encryption volume key includes: a sector number key and a data key.

[0065] Step 12: Determine the sector number of at least one sector to be written according to the length of the data to be written.

[0066] Step 13, encrypt each sector number by calling the password card through the sector number key to obtain the sector number ciphertext of each sector number.

[0067] Step 14, perform finite field multiplication operation on the sector number ciphertext to obtain the operation result.

[0068] Step 15, performing a bitwise XOR operation on the operation result and the corresponding data to be written in the sector to be written, to obtain plaintext XOR data.

[0069] Step 16, using the data key to call the password card to encrypt the plaintext XOR data to obtain encrypted data.

[0070] Step 17, perform a bitwise XOR operation on the encrypted data and the corresponding operation result to obtain the ciphertext data.

[0071] In this embodiment, the encryption card can generate a random number that cannot be predicted or copied as a key, and the encryption card is used to encrypt the sector block data at the physical level. The key management and encryption operations are all performed in the encryption card, which makes it more difficult to be attacked and cracked from the outside. Moreover, the encryption operation is not affected by operating system vulnerabilities, viruses or malicious software, so it is safer and more reliable. Moreover, the data is double-encrypted by the sector number key and the data key, which improves the security of data encryption. At the same time, for the dual-control storage management system, the same data is written to different sectors. Since the sector numbers are different, the encrypted data is different, which improves the security of data encryption in the dual-control storage management system.

[0072] A second aspect of an embodiment of the present invention provides a sector encryption method based on secure storage, comprising the following steps:

[0073] Step 21, in response to a data write request, obtaining a sector encryption volume key created based on a password card from a database.

[0074] The sector encryption volume key includes: a sector number key and a data key.

[0075] Here, on the one hand, before step 11, the sector encryption volume key can be created in advance and stored in the database, and the sector encryption volume key can be read from the database when writing data. On the other hand, the sector encryption volume key can also be created when data needs to be written, and stored in the database after creation, and can be read when needed.

[0076] In a feasible implementation, the specific steps of creating an encrypted volume key include: Step A1-Step A2:

[0077] Step A1, create a sector encrypted volume, and call the password card to generate a sector encrypted volume key. The sector encrypted volume key includes: a sector number key and a data key.

[0078] In this step, the password card can generate a random number, and the random number generated by the password card can be used as a sector number key and a data key.

[0079] In a feasible implementation, each sector number may correspond to a sector number key, and the sector number key may be composed of a random number generated by a password card and a corresponding sector number, or the sector number key may be composed of a random number generated by a password card after being encrypted and a corresponding sector number, or the sector number key may be composed of a random number generated by a password card and a corresponding encrypted sector number, or the sector number key may be composed of a random number generated by a password card after being encrypted and a corresponding encrypted sector number. Here, the data key is a random number generated by a password card.

[0080] In a feasible implementation, there may be only one sector number key, where the password card generates two sets of random numbers as the sector number key and the data key, or the password card generates two sets of random numbers and encrypts them as the sector number key and the data key. The sector number key may also be composed of a random number generated by the password card and a randomly selected sector number, or a random number generated by the password card and encrypted and a randomly selected sector number, or a randomly selected sector number and encrypted and a random number generated by the password card, or a randomly selected sector number and encrypted and a random number generated by the password card, or a randomly selected sector number and encrypted and a random number generated by the password card.

[0081] Step A2: encrypt the sector encrypted volume key using the system protection key, and store the obtained encrypted volume key ciphertext in the database.

[0082] Here, the specific steps of step 11 are: in response to a data write request, reading the encrypted volume key ciphertext from the database, and decrypting the encrypted volume key ciphertext using the system protection key to obtain the sector encrypted volume key.

[0083] Step 22: Determine the sector number of at least one sector to be written according to the length of the data to be written.

[0084] In this step, the size of each sector is 512 bytes. The number of sectors to be written and the sector number of each sector to be written can be calculated according to the starting sector number and the length of the data to be written.

[0085] Step 23, encrypt each sector number by calling the password card through the sector number key to obtain the sector number ciphertext of each sector number.

[0086] Specifically, each sector number is encrypted by calling the symmetric encryption algorithm of the password card through the sector number key to obtain the sector number ciphertext of each sector number.

[0087] The ciphertext of the sector number is 16 bytes.

[0088] In a feasible implementation, if a sector number corresponds to a sector number key, each sector number is encrypted by calling the password card symmetric encryption algorithm through the corresponding sector number key to obtain the corresponding sector number ciphertext.

[0089] Step 24, perform finite field multiplication operation on the sector number ciphertext to obtain the operation result.

[0090] Specifically, a finite field multiplication operation is performed on the sector number ciphertext and 2j to obtain a 512-byte operation result.

[0091] Among them, j represents the grouping number in the sector. Each sector is evenly grouped with 16 bytes. The value range of j is 1-32.

[0092] In this step, the sector number ciphertext is multiplied by 2j in GF(2128) to obtain a 512-byte sector number ciphertext finite field multiplication result.

[0093] Step 25, performing a bitwise XOR operation on the operation result and the corresponding data to be written in the sector to be written, to obtain plaintext XOR data.

[0094] In this step, the operation result of the sector is bitwise XORed with the corresponding data to be written (plaintext data) of the sector to obtain the plaintext XOR data. All the plaintext data to be written are processed by the operation of this step.

[0095] Step 26, using the data key to call the password card to encrypt the plaintext XOR data to obtain encrypted data. Specifically, using the data key to call the symmetric encryption algorithm in the password card to encrypt the plaintext XOR data to obtain encrypted data.

[0096] In this step, the plaintext XOR data is encrypted by the symmetric encryption algorithm of the password card to obtain the password card encrypted data.

[0097] Step 27, perform a bitwise XOR operation on the encrypted data and the corresponding operation result to obtain ciphertext data. Specifically, perform a bitwise XOR operation on the encrypted data of each sector and the operation result of the finite field multiplication operation of the corresponding sector number ciphertext to obtain the ciphertext data. After the encrypted data of all the data to be written are calculated, all the ciphertext data are written to the disk.

[0098] In this embodiment, data is doubly encrypted using a sector number key and a data key, thereby improving the security of data encryption. At the same time, for a dual-control storage management system, the same data is written to different sectors. Due to different sector numbers, the encrypted data is different, thereby improving the security of the data in the dual-control storage management system and improving the reliability of the system.

[0099] In this embodiment, the encryption of sector data uses the sector size as the encryption granularity, complies with the XTS encryption mode standard, adopts the SM1 and SM4 symmetric encryption algorithms of the approved password card, and complies with the "GB / T 17964 Information Security Technology Block Cipher Algorithm Working Mode". The user enters the corresponding parameters to select the algorithm when creating an encrypted volume.

[0100] Accordingly, if Figure 2 As shown, a third aspect of an embodiment of the present invention provides a sector decryption method based on secure storage, comprising the following steps:

[0101] Step 31, in response to a data read request, obtain the sector encrypted volume key created based on the password card from the database. In this step, based on the encryption method of the second aspect of the embodiment of the present invention, the sector encrypted volume key has been created during encryption, and in response to the data read request, the encrypted volume key ciphertext is read from the database, and the encrypted volume key ciphertext is decrypted by the system protection key to obtain the sector encrypted volume key.

[0102] The sector encryption volume key includes: a sector number key and a data key.

[0103] Step 32, determining the sector number of the sector to be read according to the length of the data to be read. This step is the same as the method of calculating the sector and the sector number in step 22, and will not be repeated here.

[0104] Step 33, encrypt each sector number by calling the password card through the sector number key to obtain the sector number ciphertext of each sector number. This step is the same as step 23 and will not be repeated here.

[0105] Step 34, perform finite field multiplication operation on the ciphertext of the sector number to obtain the operation result. This step is the same as step 24 and will not be repeated here.

[0106] Step 35, perform bitwise XOR operation on the operation result and the corresponding ciphertext data of the sector to be read to obtain ciphertext XOR data. In this step, perform bitwise XOR operation on the operation result of the sector and the corresponding ciphertext data of the sector to obtain ciphertext XOR data. Perform the operation processing of this step on all ciphertext data to be read.

[0107] Step 36, using the data key to call the password card to decrypt the ciphertext XOR data to obtain decrypted data. Specifically, using the data key to call the symmetric decryption algorithm in the password card to decrypt the ciphertext XOR data to obtain decrypted data.

[0108] In this step, the ciphertext XOR data is decrypted by the symmetric decryption algorithm of the password card to obtain the password card decrypted data.

[0109] Step 37, perform a bitwise XOR operation on the decrypted data and the corresponding operation result to obtain the plaintext data. Specifically, perform a bitwise XOR operation on the decrypted data of each sector and the operation result of the finite field multiplication operation of the corresponding sector number ciphertext to obtain the plaintext data. After the decrypted data of all the ciphertext data to be read are calculated, all the plaintext data are output to the client.

[0110] The decryption method in this embodiment can improve the security of data decryption, and at the same time, improve the security of data in the dual-control storage management system and improve the reliability of the system.

[0111] like Figure 3 As shown, a fourth aspect of an embodiment of the present invention provides a sector encryption device based on secure storage, comprising:

[0112] The acquisition module 41 is used to obtain the sector encryption volume key created based on the password card from the database in response to the write data request; wherein the sector encryption volume key includes: a sector number key and a data key;

[0113] A determination module 42, configured to determine a sector number of at least one sector to be written according to the length of the data to be written;

[0114] The sector number encryption module 43 is used to encrypt each sector number by calling the password card through the sector number key to obtain the sector number ciphertext of each sector number;

[0115] A first operation module 44 is used to perform a finite field multiplication operation on the sector number ciphertext to obtain an operation result;

[0116] The second operation module 45 is used to perform a bitwise XOR operation on the operation result and the data to be written in the corresponding sector to be written to obtain plaintext XOR data;

[0117] The encryption module 46 is used to use the data key to call the password card to encrypt the plaintext XOR data to obtain encrypted data;

[0118] The encryption operation module 47 is used to perform a bitwise XOR operation on the encrypted data and the corresponding operation result to obtain ciphertext data.

[0119] In one embodiment of the present invention, a sector encryption device based on secure storage further includes:

[0120] Create a module to create a sector encrypted volume and call the password card to generate a sector encrypted volume key;

[0121] The storage module is used to encrypt the sector encrypted volume key by using the system protection key, and store the obtained encrypted volume key ciphertext in the database.

[0122] In one embodiment of the present invention, each sector number is encrypted by calling a password card with a sector number key to obtain a sector number ciphertext of each sector number, including:

[0123] Each sector number is encrypted by calling the symmetric encryption algorithm of the password card through the sector number key to obtain the sector number ciphertext of each sector number; wherein the sector number ciphertext is 16 bytes.

[0124] In one embodiment of the present invention, the finite field multiplication operation is performed on the sector number ciphertext to obtain the operation result, including:

[0125] Perform finite field multiplication on the sector number ciphertext and 2j to obtain a 512-byte operation result;

[0126] Among them, j represents the grouping number in the sector. Each sector is evenly grouped with 16 bytes. The value range of j is 1-32.

[0127] like Figure 4 As shown, a fifth aspect of an embodiment of the present invention provides a sector decryption device based on secure storage, comprising:

[0128] The acquisition module 41 is used to obtain the sector encryption volume key created based on the password card from the database in response to the data read request; wherein the sector encryption volume key includes: a sector number key and a data key;

[0129] A determination module 42, used to determine the sector number of the sector to be read according to the length of the data to be read;

[0130] The sector number encryption module 43 is used to encrypt each sector number by calling the password card through the sector number key to obtain the sector number ciphertext of each sector number;

[0131] A first operation module 44 is used to perform a finite field multiplication operation on the sector number ciphertext to obtain an operation result;

[0132] The second operation module 45 is used to perform a bitwise XOR operation on the operation result and the ciphertext data of the corresponding sector to be read to obtain the ciphertext XOR data;

[0133] Decryption module 51, used to use the data key to call the password card to decrypt the ciphertext XOR data to obtain decrypted data;

[0134] The decryption operation module 52 is used to perform a bitwise XOR operation on the decrypted data and the corresponding operation result to obtain plaintext data.

[0135] In one embodiment of the present invention, in response to a request to read data, obtaining an encryption volume key includes:

[0136] In response to a request to read data, the encrypted volume key ciphertext is obtained from the database, and is decrypted using the system protection key to obtain the encrypted volume key.

[0137] In one embodiment of the present invention, each sector number is encrypted by calling a password card with a sector number key to obtain a sector number ciphertext of each sector number, including:

[0138] Each sector number is encrypted by calling the symmetric encryption algorithm of the password card through the sector number key to obtain the sector number ciphertext of each sector number; wherein the sector number ciphertext is 16 bytes.

[0139] In one embodiment of the present invention, the finite field multiplication operation is performed on the sector number ciphertext to obtain the operation result, including:

[0140] Perform finite field multiplication on the sector number ciphertext and 2j to obtain a 512-byte operation result;

[0141] Among them, j represents the grouping number in the sector. Each sector is evenly grouped with 16 bytes. The value range of j is 1-32.

[0142] In one embodiment of the present invention, the data key is used to call the password card to decrypt the ciphertext XOR data to obtain the decrypted data, including:

[0143] Use the data key to call the symmetric decryption algorithm in the password card to decrypt the ciphertext XOR data to obtain the decrypted data.

[0144] The sixth aspect of an embodiment of the present invention provides a sector encryption and decryption system based on secure storage, including: a sector encryption device based on secure storage provided by the fourth aspect of an embodiment of the present invention and a sector decryption device based on secure storage provided by the fifth aspect of an embodiment of the present invention.

[0145] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0146] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0147] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0148] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A sector encryption method based on secure storage, characterized in that: The following steps are involved: In response to a data write request, a sector encryption volume key created based on a password card is obtained from a database; wherein the sector encryption volume key includes: a sector number key and a data key; Determining a sector number of at least one sector to be written according to the length of the data to be written; Encrypt each sector number by calling the password card through the sector number key to obtain the sector number ciphertext of each sector number; Performing a finite field multiplication operation on the sector number ciphertext to obtain an operation result; Performing a bitwise XOR operation on the operation result and the corresponding data to be written in the sector to be written to obtain plaintext XOR data; Using the data key to call the password card to encrypt the plaintext XOR data to obtain encrypted data; Perform a bitwise XOR operation on the encrypted data and the corresponding operation result to obtain ciphertext data.

2. The method according to claim 1, characterized in that The method further comprises: Create a sector encrypted volume and call the password card to generate the sector encrypted volume key; The sector encrypted volume key is encrypted by using a system protection key, and the obtained encrypted volume key ciphertext is stored in a database.

3. The method according to claim 2, characterized in that The step of encrypting each sector number by calling the password card through the sector number key to obtain the sector number ciphertext of each sector number includes: Each sector number is encrypted by calling the symmetric encryption algorithm of the password card through the sector number key to obtain the sector number ciphertext of each sector number; wherein the sector number ciphertext is 16 bytes.

4. The method according to claim 1, characterized in that The performing of a finite field multiplication operation on the sector number ciphertext to obtain an operation result includes: Performing a finite field multiplication operation on the sector number ciphertext and 2j to obtain a 512-byte operation result; Among them, j represents the grouping number in the sector. Each sector is evenly grouped with 16 bytes. The value range of j is 1-32.

5. A sector decryption method based on secure storage, characterized in that: The following steps are involved: In response to a data read request, a sector encryption volume key created based on a password card is obtained from a database; wherein the sector encryption volume key includes: a sector number key and a data key; Determine the sector number of the sector to be read according to the length of the data to be read; Encrypt each sector number by calling the password card through the sector number key to obtain the sector number ciphertext of each sector number; Performing a finite field multiplication operation on the sector number ciphertext to obtain an operation result; Performing a bitwise XOR operation on the operation result and the corresponding ciphertext data of the sector to be read to obtain ciphertext XOR data; Using the data key to call the password card to decrypt the ciphertext XOR data to obtain decrypted data; The decrypted data is subjected to a bitwise XOR operation with the corresponding operation result to obtain plaintext data.

6. The method according to claim 5, characterized in that The step of obtaining, in response to a data read request, a sector encrypted volume key created based on a password card from a database comprises: In response to a request to read data, a sector encrypted volume key ciphertext created based on a password card is obtained from a database, and is decrypted using a system protection key to obtain the encrypted volume key.

7. The method according to claim 5, characterized in that The method of using the data key to call the password card to decrypt the ciphertext XOR data to obtain decrypted data includes: The data key is used to call the symmetric decryption algorithm in the password card to decrypt the ciphertext XOR data to obtain decrypted data.

8. The method according to claim 5, characterized in that include: The performing of a finite field multiplication operation on the sector number ciphertext to obtain an operation result includes: Performing a finite field multiplication operation on the sector number ciphertext and 2j to obtain a 512-byte operation result; Among them, j represents the grouping number in the sector. Each sector is evenly grouped with 16 bytes. The value range of j is 1-32.

9. A sector encryption device based on secure storage, characterized in that: include: The acquisition module is used to obtain the sector encryption volume key created based on the password card from the database in response to the write data request; wherein the sector encryption volume key includes: a sector number key and a data key; A determination module, used to determine the sector number of at least one sector to be written according to the length of the data to be written; The sector number encryption module is used to encrypt each sector number by calling the password card through the sector number key to obtain the sector number ciphertext of each sector number; A first operation module, used for performing a finite field multiplication operation on the sector number ciphertext to obtain an operation result; A second operation module is used to perform a bitwise XOR operation on the operation result and the corresponding data to be written in the sector to be written to obtain plaintext XOR data; An encryption module, used to use the data key to call the password card to encrypt the plaintext XOR data to obtain encrypted data; The encryption operation module is used to perform a bitwise XOR operation on the encrypted data and the corresponding operation result to obtain ciphertext data.

10. A sector decryption device based on secure storage, characterized in that: include: The acquisition module is used to obtain the sector encryption volume key created based on the password card from the database in response to the data read request; wherein the sector encryption volume key includes: a sector number key and a data key; A determination module, used for determining the sector number of the sector to be read according to the length of the data to be read; The sector number encryption module is used to encrypt each sector number by calling the password card through the sector number key to obtain the sector number ciphertext of each sector number; A first operation module, used for performing a finite field multiplication operation on the sector number ciphertext to obtain an operation result; A second operation module, used for performing a bitwise XOR operation on the operation result and the corresponding ciphertext data of the to-be-read sector to obtain ciphertext XOR data; A decryption module, used to use the data key to call the password card to decrypt the ciphertext XOR data to obtain decrypted data; The decryption operation module is used to perform a bitwise XOR operation on the decrypted data and the corresponding operation result to obtain plaintext data.

Images