A universal file transparent encryption and decryption method, system, device and medium
By replacing the file operation interface and using the encryption and decryption algorithm program, the encryption and decryption of the whole disk file and data cache security are achieved, and the problem of failure to achieve full disk encryption and decryption and data leakage in the existing technology is solved, the scope of system calls is expanded and data is ensured. Safety.
Patent Information
- Application Number
- CN202411379138.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-30
- Publication Date
- 2024-12-13
- Estimated Expiration
- 2044-09-30
AI Technical Summary
In the prior art, stacked file systems cannot implement encryption and decryption of full disk files, the application scope of system call HOOK technology is limited, and there is a risk of data leakage in the redirection scheme.
By obtaining the absolute path of the file system, replacing the file operation interface as a custom interface, using the kernel layer driver module and the encryption and decryption algorithm program to encrypt and decrypt file contents, and storing data in the ring data cache to ensure that the data is not powered Automatically delete to avoid leakage.
It realizes the encryption and decryption of the entire disk file, expands the scope of system calls, and avoids the risk of data leakage through the automatic clearing function of ring data cache.
Smart Images
Figure CN118916898B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of live broadcast auxiliary application technology, and in particular to a universal file transparent encryption and decryption method, system, device and medium. Background Art
[0002] In Linux systems, there are multiple technologies for transparent encryption and decryption of files: 1. Stacked file system, a special file system that uses the characteristics of Linux itself, which implements the file decryption function through stacking. This file system can automatically perform encryption and decryption operations when the file is accessed to protect the security of the data. 2. The kernel system calls HOOK. Through the HOOK system call table and in the corresponding read and write interface, encryption and decryption logic can be inserted so that the file is automatically decrypted during the reading and writing process. 3. Redirection technology, using certain means to intercept the file opening action, and when opening, encrypt and decrypt the full text, and let the process operate the decrypted file.
[0003] However, the above technical solutions have their own shortcomings. 1. The stacked file system must be mounted when in use, so it can only encrypt and decrypt files under the mount point, but cannot encrypt and decrypt all disk files. This makes the stacked file system unusable in some scenarios that require full disk encryption. 2. System call HOOK. Currently, some newer kernel versions and hardware architectures protect the system call table, making the traditional HOOK method no longer usable, thereby limiting the application scope of the system call HOOK technology. 3. Although the redirection solution can realize file encryption and decryption operations, it will leave plaintext files on the disk. Once the disk is illegally accessed, the plaintext file may be leaked, which brings the risk of data leakage. Summary of the invention
[0004] In view of the above-mentioned deficiencies in the prior art, the present application provides a universal file transparent encryption and decryption system, method and medium to solve the problems that the existing stacked file system cannot realize encryption and decryption of all disk files, the application scope of the system call HOOK technology is small, and the redirection scheme has data leakage.
[0005] In a first aspect, the present application provides a general file transparent encryption and decryption method, the method comprising:
[0006] Obtain the search requirements, determine the file system and operation interface corresponding to the search requirements; search for several types of file systems corresponding to the search requirements through the service module of the application layer, search for the absolute path of any file in each type of file system, and send the absolute path to the driver module of the kernel layer; the driver module of the kernel layer obtains the file operation interface set corresponding to several types of file systems based on the absolute path; replaces the operation interface corresponding to the search requirements in the file operation interface set with a preset custom interface, and saves a pointer copy of the original operation interface corresponding to the search requirements; when any file processing application initiates file processing information to the file system corresponding to the search requirements and the file and operation IO request involved in the file processing information exist in the file system and operation interface corresponding to the search requirements, the operation IO request involved in the file processing information reaches the preset custom interface, and then calls the file operation module; through the file The file operation module searches for the file content involved in the file processing information in the circular data cache; when the file content does not exist in the circular data cache, the file content not in the circular data cache is read from the disk through the pointer copy of the original operation interface corresponding to the operation IO request, so as to obtain all the file contents corresponding to the file processing information; based on the number of bytes of the total file content, determine to send the file content that meets the alignment requirement to the encryption and decryption algorithm program through the file operation module; execute the encryption operation or decryption operation corresponding to the file processing information through the encryption and decryption algorithm program, obtain the output content of the file involved in the file processing information, and return the output content to the preset custom interface; at the same time, put the preset last preset byte data block of the disk data that has been read the most recently into the circular data cache; return the output content to the file processing application through the preset custom interface.
[0007] Furthermore, the search requirements are obtained, and the file system and operation interface corresponding to the search requirements are determined, including:
[0008] Obtain the file system name and operation interface name corresponding to the search requirement through the preset search requirement filling interface.
[0009] Furthermore, the driver module of the kernel layer obtains a set of file operation interfaces corresponding to several types of file systems based on the absolute path, specifically including:
[0010] The driver module uses the kern_path function to parse the absolute path and obtain the directory entry structure of the file.
[0011] Access the file's inode structure through the d_inode member of the directory entry in the directory entry structure; the inode structure contains a pointer to the file system operation interface set;
[0012] Get a subset of the file operation interface of the file system through the pointer in the inode;
[0013] Then, file operation interface subsets corresponding to various file systems are obtained, and the file operation interface subsets are merged into a file operation interface set.
[0014] Further, based on the number of bytes of all file contents, determining to send the file contents satisfying the alignment requirement to the encryption and decryption algorithm program through the file operation module; performing the encryption operation or decryption operation corresponding to the file processing information through the encryption and decryption algorithm program to obtain the output contents of the file involved in the file processing information, specifically including:
[0015] Obtain the number of bytes of all file contents. When the number of bytes is less than the number of bytes required for alignment by the encryption and decryption algorithm program, obtain padding data from the circular data cache and add it to all file contents, thereby making all file contents meet the number of bytes required for alignment; wherein, there is a preset initial default padding byte data in the initial circular data cache;
[0016] The file content that meets the alignment requirement is sent to the encryption and decryption algorithm program through the file operation module;
[0017] Execute an encryption operation or a decryption operation corresponding to the file processing information to obtain initial output content;
[0018] When there is padding data, the output content corresponding to the padding data is removed from the initial output content to obtain the final output content;
[0019] When there is no padding data, the initial output content is determined to be the final output content.
[0020] In a second aspect, the present application provides a universal file transparent encryption and decryption system, the system comprising:
[0021] A determination module is used to obtain retrieval requirements and determine the file system and operation interface corresponding to the retrieval requirements; a service module of the application layer is used to find several types of file systems corresponding to the retrieval requirements, find the absolute path of any file in each type of file system, and send the absolute path to the driver module of the kernel layer; the driver module of the kernel layer is used to obtain a set of file operation interfaces corresponding to several types of file systems based on the absolute path; replace the operation interface corresponding to the retrieval requirements in the file operation interface set with a preset custom interface, and save a pointer copy of the original operation interface corresponding to the retrieval requirements; when any file processing application initiates file processing information to the file system corresponding to the retrieval requirements and the file and operation IO request involved in the file processing information exist in the file system and operation interface corresponding to the retrieval requirements, the operation IO request involved in the file processing information reaches the preset custom interface, and then calls the file operation module; the file operation An operation module is used to find out whether there is file content involved in the file processing information in the circular data cache; when there is file content that does not exist in the circular data cache, the file content that does not exist in the circular data cache is read from the disk through the pointer copy of the original operation interface corresponding to the operation IO request, so as to obtain all the file contents corresponding to the file processing information; based on the number of bytes of all the file contents, it is determined to send the file content that meets the alignment requirement to the encryption and decryption algorithm module through the file operation module; the encryption and decryption algorithm module is used to perform the encryption operation or decryption operation corresponding to the file processing information, obtain the output content of the file involved in the file processing information, and return the output content to the preset custom interface; the cache processing module is used to put the preset last preset byte data block of the disk data that has been read most recently into the circular data cache; the preset custom interface is used to return the output content to the file processing application.
[0022] Furthermore, the determination module includes an acquisition unit, which is used to acquire a file system name and an operation interface name corresponding to the search requirement through a preset search requirement filling interface.
[0023] Furthermore, the driver module is also used to use the kern_path function to parse the absolute path and obtain the directory entry structure of the file.
[0024] Access the file's inode structure through the d_inode member of the directory entry in the directory entry structure; the inode structure contains a pointer to the file system operation interface set;
[0025] Get a subset of the file operation interface of the file system through the pointer in the inode;
[0026] Then, file operation interface subsets corresponding to various file systems are obtained, and the file operation interface subsets are merged into a file operation interface set.
[0027] Furthermore, the file operation module includes an alignment unit,
[0028] Used to obtain the number of bytes of all file contents. When the number of bytes is less than the number of bytes required for alignment by the encryption and decryption algorithm module, the padding data is obtained from the circular data cache and added to the entire file content, so that the entire file content meets the number of bytes required for alignment; wherein, there is a preset initial default padding byte data in the initial circular data cache; the file content that meets the number of bytes required for alignment is sent to the encryption and decryption algorithm module through the file operation module;
[0029] The encryption and decryption algorithm module is also used to execute encryption operations or decryption operations corresponding to file processing information to obtain initial output content; when there is padding data, the output content corresponding to the padding data is removed from the initial output content to obtain the final output content; when there is no padding data, the initial output content is determined to be the final output content.
[0030] In a third aspect, the present application provides a universal file transparent encryption and decryption device, the device comprising: a processor; and a memory on which executable code is stored, and when the executable code is executed, the processor executes a universal file transparent encryption and decryption method such as any one of the above.
[0031] In a fourth aspect, the present application provides a non-volatile computer storage medium on which computer instructions are stored. When the computer instructions are executed, a general file transparent encryption and decryption method such as any of the above items is implemented.
[0032] Those skilled in the art can understand that the present application has at least the following beneficial effects:
[0033] This application determines the file system and operation interface corresponding to the search requirements through the search requirements. The specific scope of the file system here can be customized according to the search requirements, and can be customized to the entire disk file, so as to realize the subsequent encryption and decryption of the entire disk file. By replacing the operation interface corresponding to the centralized search requirements of the file operation interface with the preset custom interface, the system call scope is expanded to all operation interfaces corresponding to the search requirements. In addition, the encryption and decryption data involved in this application are cached in the ring data cache, and the data in the ring data cache is automatically deleted when the power is turned off, avoiding the problem of data leakage. BRIEF DESCRIPTION OF THE DRAWINGS
[0034] Some embodiments of the present disclosure are described below with reference to the accompanying drawings, in which:
[0035] Figure 1 It is a flow chart of a general file transparent encryption and decryption method provided in an embodiment of the present application.
[0036] Figure 2It is a schematic diagram of the internal structure of a universal file transparent encryption and decryption system provided in an embodiment of the present application.
[0037] Figure 3 It is a schematic diagram of the internal structure of a universal file transparent encryption and decryption device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0038] It should be understood by those skilled in the art that the embodiments described below are only preferred embodiments of the present disclosure, and do not mean that the present disclosure can only be implemented through the preferred embodiments. The preferred embodiments are only used to explain the technical principles of the present disclosure, and are not used to limit the protection scope of the present disclosure. Based on the preferred embodiments provided by the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work should still fall within the protection scope of the present disclosure.
[0039] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.
[0040] The technical solution proposed in the embodiments of the present application is described in detail below with reference to the accompanying drawings.
[0041] The present application embodiment provides a general file transparent encryption and decryption method, such as Figure 1 As shown, the method provided in the embodiment of the present application mainly includes the following steps:
[0042] Step 110: Obtain search requirements and determine the file system and operation interface corresponding to the search requirements.
[0043] It should be noted that obtaining the search requirements and determining the file system and operation interface corresponding to the search requirements specifically include:
[0044] Obtain the file system name and operation interface name corresponding to the search requirement through the preset search requirement filling interface.
[0045] As an example, the file system corresponding to the search requirement may be a file in a preset format, and the operation interface may be file_read, file_write, and the like.
[0046] Step 120: Search for several types of file systems corresponding to the search requirements through the service module of the application layer, search for the absolute path of any file in each type of file system, and send the absolute path to the driver module of the kernel layer.
[0047] It should be noted that searching for the absolute path of any file in various file systems can be achieved by existing technologies, and this application does not limit this.
[0048] Step 130, the driver module of the kernel layer obtains the file operation interface sets corresponding to several types of file systems based on the absolute path; replaces the operation interface corresponding to the retrieval requirement in the file operation interface set with a preset custom interface, and saves a pointer copy of the original operation interface corresponding to the retrieval requirement.
[0049] The driver module of the kernel layer obtains the file operation interface set corresponding to several types of file systems based on the absolute path, which can be specifically:
[0050] The driver module uses the kern_path function to parse the absolute path and obtain the directory entry structure of the file.
[0051] Access the file's inode structure through the d_inode member of the directory entry in the directory entry structure; the inode structure contains a pointer to the file system operation interface set;
[0052] Get a subset of the file operation interface of the file system through the pointer in the inode;
[0053] Then, file operation interface subsets corresponding to various file systems are obtained, and the file operation interface subsets are merged into a file operation interface set.
[0054] Step 140: When any file processing application initiates file processing information to the file system corresponding to the retrieval requirement and the file and operation IO request involved in the file processing information exist in the file system and operation interface corresponding to the retrieval requirement, the operation IO request involved in the file processing information reaches the preset custom interface, and then calls the file operation module.
[0055] It should be noted that the file processing application may be a WPS program. The operation IO request may be file_read, file_write, etc., which exist in the operation interface of the search requirement. The file involved in the file processing information exists in the file system of the search requirement.
[0056] Step 150, searching through the file operation module whether there is file content related to the file processing information in the circular data cache; when there is file content that does not exist in the circular data cache, reading the file content that does not exist in the circular data cache from the disk through the pointer copy of the original operation interface corresponding to the operation IO request, and then obtaining all the file content corresponding to the file processing information; based on the number of bytes of all the file content, determining to send the file content that meets the alignment requirement to the encryption and decryption algorithm program through the file operation module.
[0057] It should be noted that the number of bytes required for alignment can be 128 bytes.
[0058] Wherein, based on the number of bytes of the entire file content, it is determined that the file content that meets the alignment requirement number of bytes is sent to the encryption and decryption algorithm program through the file operation module, which may be specifically:
[0059] Obtain the number of bytes of all file contents. When the number of bytes is less than the number of bytes required for alignment by the encryption and decryption algorithm program, obtain padding data from the circular data cache and add it to all file contents, so that all file contents meet the number of bytes required for alignment. The initial circular data cache contains preset initial default padding byte data. The file contents meeting the number of bytes required for alignment are sent to the encryption and decryption algorithm program through the file operation module.
[0060] Step 160, execute the encryption operation or decryption operation corresponding to the file processing information through the encryption and decryption algorithm program, obtain the output content of the file involved in the file processing information, and return the output content to the preset custom interface; at the same time, put the preset last preset byte data block of the latest read disk data into the ring data cache.
[0061] It should be noted that the preset byte data block may be 8 bytes.
[0062] The encryption operation or decryption operation corresponding to the file processing information is executed by the encryption and decryption algorithm program to obtain the output content of the file involved in the file processing information, which may be specifically:
[0063] Execute an encryption operation or a decryption operation corresponding to the file processing information to obtain initial output content; when there is padding data, remove the output content corresponding to the padding data from the initial output content to obtain the final output content; when there is no padding data, determine the initial output content as the final output content.
[0064] Step 170: Return the output content to the file processing application through a preset custom interface.
[0065] besides, Figure 2 A general file transparent encryption and decryption system is provided in the embodiment of the present application. Figure 2As shown, the system provided in the embodiment of the present application mainly includes:
[0066] The determination module 210 is used to obtain the search requirement and determine the file system and operation interface corresponding to the search requirement.
[0067] The determination module 210 includes an acquisition unit, which is used to acquire the file system name and the operation interface name corresponding to the search requirement through a preset search requirement filling interface.
[0068] The service module 220 of the application layer is used to search for several types of file systems corresponding to the search requirements, search for the absolute path of any file in each type of file system, and send the absolute path to the driver module 230 of the kernel layer.
[0069] The driver module 230 of the kernel layer is used to obtain the file operation interface set corresponding to several types of file systems based on the absolute path; replace the operation interface corresponding to the retrieval requirement in the file operation interface set with the preset custom interface 231, and save the pointer copy of the original operation interface corresponding to the retrieval requirement; when any file processing application initiates file processing information to the file system corresponding to the retrieval requirement and the file and operation IO request involved in the file processing information exist in the file system and operation interface corresponding to the retrieval requirement, the operation IO request involved in the file processing information reaches the preset custom interface 231, and then calls the file operation module.
[0070] The driver module 230 is also used to use the kern_path function to parse the absolute path and obtain the directory entry structure of the file.
[0071] Access the file's inode structure through the d_inode member of the directory entry in the directory entry structure; the inode structure contains a pointer to the file system operation interface set;
[0072] Get a subset of the file operation interface of the file system through the pointer in the inode;
[0073] Then, file operation interface subsets corresponding to various file systems are obtained, and the file operation interface subsets are merged into a file operation interface set.
[0074] The file operation module 240 is used to search whether there is file content related to the file processing information in the circular data cache; when there is file content that does not exist in the circular data cache, the file content that does not exist in the circular data cache is read from the disk through the pointer copy of the original operation interface corresponding to the operation IO request, and then all the file content corresponding to the file processing information is obtained; based on the number of bytes of the total file content, it is determined to send the file content that meets the alignment requirement to the encryption and decryption algorithm module 250 through the file operation module.
[0075] The file operation module 240 includes an alignment unit,
[0076] Used to obtain the number of bytes of all file contents. When the number of bytes is less than the number of bytes required for alignment by the encryption and decryption algorithm module 250, the padding data is obtained from the circular data cache and added to the entire file content, so that the entire file content meets the number of bytes required for alignment; wherein the initial circular data cache contains preset initial default padding byte data; the file content that meets the number of bytes required for alignment is sent to the encryption and decryption algorithm module 250 through the file operation module 240;
[0077] The encryption and decryption algorithm module 250 is used to execute the encryption operation or decryption operation corresponding to the file processing information, obtain the output content of the file involved in the file processing information, and return the output content to the preset custom interface 231.
[0078] The encryption and decryption algorithm module 250 is also used to execute encryption operations or decryption operations corresponding to file processing information to obtain initial output content; when there is padding data, the output content corresponding to the padding data is removed from the initial output content to obtain the final output content; when there is no padding data, the initial output content is determined to be the final output content.
[0079] The cache processing module 260 is used to put the last preset bytes of the disk data most recently read into the ring data cache.
[0080] A custom interface 231 is preset to return the output content to the file processing application.
[0081] The above is a method embodiment of the present application. Based on the same inventive concept, the present application embodiment also provides a universal file transparent encryption and decryption device. Figure 3 As shown, the device includes: a processor; and a memory, on which executable codes are stored. When the executable codes are executed, the processor executes a universal file transparent encryption and decryption method as described in the above embodiment.
[0082] Specifically, the server obtains the retrieval requirements and determines the file system and operation interface corresponding to the retrieval requirements; searches for several types of file systems corresponding to the retrieval requirements through the service module of the application layer, searches for the absolute path of any file in each type of file system, and sends the absolute path to the driver module of the kernel layer; the driver module of the kernel layer obtains the file operation interface set corresponding to several types of file systems based on the absolute path; replaces the operation interface corresponding to the retrieval requirements in the file operation interface set with a preset custom interface, and saves a pointer copy of the original operation interface corresponding to the retrieval requirements; when any file processing application initiates file processing information to the file system corresponding to the retrieval requirements and the file and operation IO request involved in the file processing information exist in the file system and operation interface corresponding to the retrieval requirements, the operation IO request involved in the file processing information reaches the preset custom interface, and then calls the file operation module. ; Use the file operation module to search whether there is file content involved in the file processing information in the circular data cache; when there is file content that does not exist in the circular data cache, read the file content that does not exist in the circular data cache from the disk through the pointer copy of the original operation interface corresponding to the operation IO request, and then obtain all the file contents corresponding to the file processing information; based on the number of bytes of all the file contents, determine to send the file content that meets the alignment requirement to the encryption and decryption algorithm program through the file operation module; perform the encryption operation or decryption operation corresponding to the file processing information through the encryption and decryption algorithm program, obtain the output content of the file involved in the file processing information, and return the output content to the preset custom interface; at the same time, put the preset last preset byte data block of the disk data that was recently read into the circular data cache; return the output content to the file processing application through the preset custom interface.
[0083] In addition, an embodiment of the present application further provides a non-volatile computer storage medium on which executable instructions are stored. When the executable instructions are executed, a general file transparent encryption and decryption method as described above is implemented.
[0084] So far, the technical solutions of the present disclosure have been described in combination with the above multiple embodiments, but it is easy for those skilled in the art to understand that the protection scope of the present disclosure is not limited to these specific embodiments. Without departing from the technical principles of the present disclosure, those skilled in the art can split and combine the technical solutions in the above-mentioned various embodiments, and can also make equivalent changes or replacements to the relevant technical features. Any changes, equivalent replacements, improvements, etc. made within the technical concept and / or technical principle of the present disclosure will fall within the protection scope of the present disclosure.
Claims
1. A universal file transparent encryption and decryption method, characterized in that: The method comprises: Obtain search requirements and determine the file system and operation interface corresponding to the search requirements; The service module of the application layer searches for several types of file systems corresponding to the search requirements, searches for the absolute path of any file in each type of file system, and sends the absolute path to the driver module of the kernel layer; The driver module of the kernel layer obtains the file operation interface set corresponding to several types of file systems based on the absolute path; replaces the operation interface corresponding to the retrieval requirement in the file operation interface set with the preset custom interface, and saves the pointer copy of the original operation interface corresponding to the retrieval requirement; When any file processing application initiates file processing information to the file system corresponding to the search demand and the file and operation IO request involved in the file processing information exist in the file system and operation interface corresponding to the search demand, the operation IO request involved in the file processing information reaches the preset custom interface, and then calls the file operation module; Search through the file operation module whether there is file content involved in the file processing information in the circular data cache; when there is file content that does not exist in the circular data cache, read the file content that does not exist in the circular data cache from the disk through the pointer copy of the original operation interface corresponding to the operation IO request, and then obtain all the file contents corresponding to the file processing information; based on the number of bytes of all the file contents, determine to send the file content that meets the alignment requirement bytes to the encryption and decryption algorithm program through the file operation module; Execute the encryption operation or decryption operation corresponding to the file processing information through the encryption and decryption algorithm program, obtain the output content of the file involved in the file processing information, and return the output content to the preset custom interface; at the same time, put the preset last preset byte data block of the latest read disk data into the ring data cache; The output is returned to the file processing application through a preset custom interface.
2. The universal file transparent encryption and decryption method according to claim 1 is characterized in that: Obtain the search requirements and determine the file system and operation interface corresponding to the search requirements, including: Obtain the file system name and operation interface name corresponding to the search requirement through the preset search requirement filling interface.
3. The universal file transparent encryption and decryption method according to claim 1, characterized in that: The driver module of the kernel layer obtains the file operation interface set corresponding to several types of file systems based on the absolute path, including: The driver module uses the kern_path function to parse the absolute path and obtain the directory entry structure of the file; Access the file's inode structure through the d_inode member of the directory entry in the directory entry structure; the inode structure contains a pointer to the file system operation interface set; Get a subset of the file operation interface of the file system through the pointer in the inode; Then, file operation interface subsets corresponding to various file systems are obtained, and the file operation interface subsets are merged into a file operation interface set.
4. The universal file transparent encryption and decryption method according to claim 1, characterized in that: Based on the number of bytes of all file contents, determine to send the file contents satisfying the number of bytes required for alignment to the encryption and decryption algorithm program through the file operation module; perform the encryption operation or decryption operation corresponding to the file processing information through the encryption and decryption algorithm program to obtain the output contents of the file involved in the file processing information, specifically including: Obtain the number of bytes of all file contents. When the number of bytes is less than the number of bytes required for alignment by the encryption and decryption algorithm program, obtain padding data from the circular data cache and add it to all file contents, thereby making all file contents meet the number of bytes required for alignment; wherein, there is a preset initial default padding byte data in the initial circular data cache; The file content that meets the alignment requirement is sent to the encryption and decryption algorithm program through the file operation module; Execute an encryption operation or a decryption operation corresponding to the file processing information to obtain initial output content; When there is padding data, the output content corresponding to the padding data is removed from the initial output content to obtain the final output content; When there is no padding data, the initial output content is determined to be the final output content.
5. A universal file transparent encryption and decryption system, characterized in that: The system comprises: A determination module is used to obtain search requirements and determine the file system and operation interface corresponding to the search requirements; The service module of the application layer is used to search for several types of file systems corresponding to the search requirements, find the absolute path of any file in each type of file system, and send the absolute path to the driver module of the kernel layer; The driver module of the kernel layer is used to obtain the file operation interface set corresponding to several types of file systems based on the absolute path; replace the operation interface corresponding to the retrieval demand in the file operation interface set with a preset custom interface, and save the pointer copy of the original operation interface corresponding to the retrieval demand; when any file processing application initiates file processing information to the file system corresponding to the retrieval demand and the file and operation IO request involved in the file processing information exist in the file system and operation interface corresponding to the retrieval demand, the operation IO request involved in the file processing information reaches the preset custom interface, and then calls the file operation module; The file operation module is used to find out whether there is file content involved in the file processing information in the circular data cache; when there is file content that does not exist in the circular data cache, read the file content that does not exist in the circular data cache from the disk through the pointer copy of the original operation interface corresponding to the operation IO request, and then obtain all the file contents corresponding to the file processing information; based on the number of bytes of all the file contents, determine to send the file content that meets the alignment requirement to the encryption and decryption algorithm module through the file operation module; The encryption and decryption algorithm module is used to perform encryption operations or decryption operations corresponding to the file processing information, obtain the output content of the file involved in the file processing information, and return the output content to the preset custom interface; A cache processing module, used for putting the last preset bytes of the disk data read most recently into the ring data cache; Preset custom interface for returning output to file processing applications.
6. The universal file transparent encryption and decryption system according to claim 5 is characterized in that: The determination module includes an acquisition unit, Used to obtain the file system name and operation interface name corresponding to the retrieval requirement through the preset retrieval requirement filling interface.
7. The universal file transparent encryption and decryption system according to claim 5 is characterized in that: The driver module is also used to use the kern_path function to parse the absolute path and obtain the directory entry structure of the file; Access the file's inode structure through the d_inode member of the directory entry in the directory entry structure; the inode structure contains a pointer to the file system operation interface set; Get a subset of the file operation interface of the file system through the pointer in the inode; Then, file operation interface subsets corresponding to various file systems are obtained, and the file operation interface subsets are merged into a file operation interface set.
8. The universal file transparent encryption and decryption system according to claim 5, characterized in that: The file operation module includes an alignment unit, Used to obtain the number of bytes of all file contents. When the number of bytes is less than the number of bytes required for alignment by the encryption and decryption algorithm module, the padding data is obtained from the circular data cache and added to the entire file content, so that the entire file content meets the number of bytes required for alignment; wherein, there is a preset initial default padding byte data in the initial circular data cache; the file content that meets the number of bytes required for alignment is sent to the encryption and decryption algorithm module through the file operation module; The encryption and decryption algorithm module is also used to execute encryption operations or decryption operations corresponding to file processing information to obtain initial output content; when there is padding data, the output content corresponding to the padding data is removed from the initial output content to obtain the final output content; when there is no padding data, the initial output content is determined to be the final output content.
9. A universal file transparent encryption and decryption device, characterized in that: The device comprises: processor; and a memory storing executable codes thereon, which, when the executable codes are executed, enable the processor to execute a universal file transparent encryption and decryption method as described in any one of claims 1 to 4.
10. A non-volatile computer storage medium, characterized in that: Computer instructions are stored thereon, and when the computer instructions are executed, a universal file transparent encryption and decryption method as described in any one of claims 1 to 4 is implemented.