A file security storage method, system, terminal and storage medium

Abstract

The present invention discloses a file security storage method, system, terminal, and storage medium. The method is applied to a confidential computing coprocessor, which has a persistent data security storage function. The method includes: establishing a virtual block device in the confidential computing coprocessor and a storage file in a host, generating a symmetric key, and backing up the symmetric key in the flash memory of the confidential computing coprocessor; receiving a data storage request, and encrypting the data to be stored using a security algorithm SM4 to obtain ciphertext data, and storing the ciphertext data on a disk of the host; after sending a data read request to the host, obtaining the ciphertext data, and decrypting and verifying the ciphertext data using the symmetric key to obtain plaintext data. The confidential computing coprocessor of the present invention can ensure that all data stored on the host is encrypted data, effectively preventing malicious users from stealing or tampering with data stored on the host, and ensuring data security.

Description

Technical Field

[0001] The present invention relates to the field of trusted computing technology, and in particular to a file security storage method, system, terminal and storage medium. Background Art

[0002] A TEE (Trusted Execution Environment), also known as a trusted execution environment, is a secure area isolated from the host system, running as an independent environment in parallel with the host operating system. TEE technology uses hardware and software to protect data and code, ensuring the confidentiality and integrity of code and data loaded in the secure area, achieving stronger security than traditional REE (Rich Execution Environment) environments. Trusted applications running in the TEE have access to the full functionality of the platform's main processor and memory, while hardware isolation protects these components from user-installed applications running in the main operating system.

[0003] In the fields of information security and computer architecture, TEE technology has been widely used to enhance the security and flexibility of computing platforms. Traditional security solutions often rely on software-level isolation and security policies, which can be vulnerable to physical-level attacks such as system call sniffing and CPU cache attacks. Furthermore, with the development of cloud computing and big data technologies, data security and privacy protection are becoming increasingly important, especially during data transmission and storage.

[0004] While technologies like SEV (Secure Encrypted Virtualization) exist to protect VM memory from host access, these technologies often fall short of providing a complete isolation environment, particularly when defending against system-level side-channel attacks. Furthermore, existing hardware encryption solutions, such as TPM (Trusted Platform Module) or HSM (Hardware Security Module), while offering improved security, often involve complex deployment and management and can suffer from performance deficiencies. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a file security storage method, system, terminal and storage medium in response to the above-mentioned defects of the existing technology, aiming to solve the problems of data transmission and storage, data security and so on in the existing technology.

[0006] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows:

[0007] In a first aspect, the present invention provides a method for secure file storage, wherein the method is applied to a confidential computing coprocessor having a persistent data secure storage function, and the method comprises:

[0008] Establishing a virtual block device in the confidential computing coprocessor and a storage file in the host, generating a symmetric key, and backing up the symmetric key in the flash of the confidential computing coprocessor;

[0009] Receive a data storage request, encrypt the data to be stored using the security algorithm SM4 to obtain ciphertext data, and store the ciphertext data on the host's disk;

[0010] After sending a data read request to the host, the ciphertext data is obtained, and the ciphertext data is decrypted and verified using the symmetric key to obtain the plaintext data.

[0011] In one implementation, establishing a virtual block device in the confidential computing coprocessor and establishing a storage file in the host includes:

[0012] Obtaining SPU startup parameters and determining whether the SPU startup parameters contain legal parameters;

[0013] If the legal parameters are included, the internal driver of the confidential computing coprocessor establishes the virtual block device based on the legal parameters;

[0014] Use a dedicated data channel and a file mapping protocol to inform the host to create the storage file.

[0015] In one implementation, generating a symmetric key and backing up the symmetric key in a flash memory of a confidential computing coprocessor includes:

[0016] After successfully establishing the pseudo-block device and the storage file, the flash of the confidential computing coprocessor generates a symmetric key;

[0017] The symmetric key is bound to a trusted application and backed up in the flash of the confidential computing coprocessor.

[0018] In one implementation, the data storage request is a page storage request, and receiving the data storage request, encrypting the data to be stored using the security algorithm SM4 to obtain ciphertext data, and storing the ciphertext data on a disk of the host includes:

[0019] When the internal file system in the confidential computing coprocessor initiates a write operation, the internal driver of the confidential computing coprocessor receives the page storage request;

[0020] The internal driver of the confidential computing coprocessor packages the data to be stored and sends it to the FPGA. In the FPGA, the data to be stored is encrypted using the security algorithm SM4 to obtain ciphertext data.

[0021] The FPGA sends the IV and TAG corresponding to the ciphertext data to the internal driver of the confidential computing coprocessor, and sends the ciphertext data to the host to store the ciphertext data on the host's disk.

[0022] In one implementation, the data read request is a page read request. After sending the data read request to the host, the ciphertext data is obtained, and the ciphertext data is decrypted and verified using the symmetric key to obtain the plaintext data, including:

[0023] When the internal file system in the confidential computing coprocessor initiates a read operation, the internal driver of the confidential computing coprocessor receives the page read request;

[0024] The internal driver of the confidential computing coprocessor sends the page read request to the host through the FPGA;

[0025] The host driver reads the ciphertext data and returns it to the FPGA. The FPGA decrypts the ciphertext data and verifies the IV and TAG. The obtained plaintext data is packaged and sent to the internal driver in the confidential computing coprocessor.

[0026] The driver of the confidential computing coprocessor receives the plaintext data and returns it to the upper-level application.

[0027] In one implementation, the method further includes:

[0028] When an exit request is received, all resources used by the confidential computing coprocessor are cleared.

[0029] In one implementation, the method further includes:

[0030] Obtaining a change record of the file to be backed up, and determining the changed data based on the change record;

[0031] An incremental backup is performed based on the changed data to obtain a backup file, and a backup index and directory of the backup file are generated.

[0032] In a second aspect, an embodiment of the present invention further provides a file security storage system, wherein the system is applied to a confidential computing coprocessor, the confidential computing coprocessor having a persistent data security storage function, and the system includes:

[0033] A device creation module, configured to create a virtual block device in the confidential computing coprocessor and a storage file in the host, generate a symmetric key, and back up the symmetric key in the flash memory of the confidential computing coprocessor;

[0034] An encryption processing module is used to receive a data storage request, encrypt the data to be stored using the security algorithm SM4, obtain ciphertext data, and store the ciphertext data on the host's disk;

[0035] The data decryption module is used to obtain the ciphertext data after sending a data read request to the host, and use the symmetric key to decrypt and verify the ciphertext data to obtain plaintext data.

[0036] In a third aspect, an embodiment of the present invention further provides a terminal, wherein the terminal includes a memory, a processor, and a file security storage program stored in the memory and runnable on the processor; when the processor executes the file security storage program, the steps of the file security storage method of any one of the above-mentioned schemes are implemented.

[0037] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein a file security storage program is stored on the computer-readable storage medium, and when the file security storage program is executed by a processor, the steps of the file security storage method described in any one of the above schemes are implemented.

[0038] Beneficial effect: Compared with the prior art, the present invention provides a method for secure file storage. The present invention first establishes a virtual block device in the confidential computing coprocessor and a storage file in the host, generates a symmetric key, and backs up the symmetric key in the flash of the confidential computing coprocessor. Then, a data storage request is received, and the data to be stored is encrypted by the security algorithm SM4 to obtain ciphertext data, and the ciphertext data is stored on the disk of the host. Then, after a data read request is sent to the host, the ciphertext data is obtained, and the symmetric key is used to decrypt and verify the ciphertext data to obtain plaintext data. The confidential computing coprocessor of the present invention can ensure that all data stored on the host are encrypted data, effectively preventing malicious users from stealing and tampering with data stored on the host, and ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A framework diagram of the data security storage function of the confidential computing coprocessor provided by an embodiment of the present invention.

[0040] Figure 2 The present invention provides a flowchart of a preferred embodiment of the method for secure file storage.

[0041] Figure 3 The present invention provides a flowchart of creating a virtual block device and storing files in a file security storage method provided by an embodiment of the present invention.

[0042] Figure 4 A process node diagram for creating a virtual block device and storing files in the file security storage method provided by an embodiment of the present invention.

[0043] Figure 5 A process node diagram for storing and reading data in the file security storage method provided by an embodiment of the present invention.

[0044] Figure 6 A resource clearing node diagram for a file security storage method provided by an embodiment of the present invention.

[0045] Figure 7 A schematic diagram of the architecture of a secure file storage system provided by an embodiment of the present invention.

[0046] Figure 8 This is a functional block diagram of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and effect of the present invention clearer and more specific, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0048] This embodiment can be applied to a confidential computing coprocessor. The confidential computing coprocessor (SPU) has a persistent data secure storage function (SPU Secure Storage, referred to as SS-Storage). The framework of the data secure storage function is as follows: Figure 1 As shown in , through the drivers at both ends of the confidential computing coprocessor and the host (HOST), a block device is virtualized in the confidential computing coprocessor to obtain a virtual block device. The virtual block device actually exists on the host's memory and is only allowed to be used by feasible applications specified in the SPU. Specifically, this embodiment can first establish a virtual block device in the confidential computing coprocessor and a storage file in the host, generate a symmetric key, and back up the symmetric key in the flash of the confidential computing coprocessor. Then, a data storage request is received, and the data to be stored is encrypted through the security algorithm SM4 to obtain ciphertext data, and the ciphertext data is stored on the host's disk. Then, when a data read request is sent to the host, the ciphertext data is obtained, and the symmetric key is used to decrypt and verify the ciphertext data to obtain plaintext data. The confidential computing coprocessor of this embodiment can ensure that all data stored on the host are encrypted data, effectively preventing malicious users from stealing and tampering with data stored on the host, and ensuring data security.

[0049] Specifically, if Figure 2 As shown in , the file security storage method of this embodiment includes the following steps:

[0050] Step S100: Create a virtual block device in the confidential computing coprocessor and a storage file in the host, generate a symmetric key, and back up the symmetric key in the flash of the confidential computing coprocessor.

[0051] Specifically, when creating a virtual block device and a storage device, the embodiment Figure 3 and Figure 4 As shown, first, after receiving the SPU startup parameters, the internal application layer of the confidential computing coprocessor (SPU) determines whether the SPU startup parameters contain legal parameters, which are SS-Storage parameters. If the legal parameters are contained, the internal driver of the confidential computing coprocessor establishes the virtual block device based on the legal parameters. After the virtual block device is created, initialization is started. Then, a dedicated data channel is used, and a file mapping protocol (driver and FPGA communication protocol) is used to inform the host (HOST) to establish a storage file. After the virtual block device and the storage file are successfully established, the flash of the confidential computing coprocessor generates a symmetric key, binds the symmetric key to a trusted application, and then backs up the symmetric key in the flash of the confidential computing coprocessor. When the virtual block device and the storage file are not successfully created, an error message is fed back and error handling is performed. The SS-Storage of this embodiment can resist system call attacks. Since the system runs in the SPU and is naturally physically isolated from the host machine, all file system-related calls occur inside the SPU, and attackers cannot spy on the call information.

[0052] Step S200: Receive a data storage request, encrypt the data to be stored using the security algorithm SM4 to obtain ciphertext data, and store the ciphertext data on a disk of the host.

[0053] like Figure 5As shown, when the internal file system in the confidential computing coprocessor (SPU) initiates a write operation, the internal driver of the confidential computing coprocessor receives the page storage request, which is a data storage request. Next, the internal driver of the confidential computing coprocessor packages the data to be stored and sends it to the FPGA. In the FPGA, the data to be stored is encrypted using the security algorithm SM4 to obtain ciphertext data. Then, the FPGA sends the IV and TAG corresponding to the ciphertext data to the internal driver of the confidential computing coprocessor, and sends the ciphertext data to the host (HOST) to store the ciphertext data on the host's disk. The IV and TAG corresponding to the ciphertext data are the tag information of the ciphertext data, which are used to identify and verify the ciphertext data. It can be seen that the SPU ensures that all data stored on the HOST is encrypted data, and the SPU internally stores the encrypted IV and TAG to prevent malicious users from stealing or tampering with the data stored on the HOST, ensuring data security.

[0054] When the internal file system in the confidential computing coprocessor initiates a read operation, the internal driver of the confidential computing coprocessor receives the page read request, which is a data read request. Next, the internal driver of the confidential computing coprocessor sends the page read request to the host through the FPGA. Then, the host's driver reads the ciphertext data and returns it to the FPGA. The FPGA decrypts the ciphertext data and verifies the IV and TAG at the same time, and packages the obtained plaintext data and sends it to the internal driver in the confidential computing coprocessor. Finally, the driver of the confidential computing coprocessor receives the plaintext data and returns it to the upper-level application. The SS-Storage (data security storage function) of this embodiment runs in the SPU and has a natural physical isolation from the host machine. All file system-related calls occur inside the SPU, and attackers cannot spy on the call information.

[0055] Furthermore, if Figure 6 As shown in , when the internal application layer of the confidential computing coprocessor receives an exit request, it clears all resources used by the confidential computing coprocessor. Specifically, the confidential computing coprocessor exits the data security storage function, and the internal driver, FPGA, and host driver all execute the exit operation according to the exit request and clear all resources, including: the mapping table of data bureaus, IVs, and TAGs within the SPU software; the application ID and symmetric key within the FPGA; and the storage files within the host.

[0056] Furthermore, this embodiment can also obtain change records for the files to be backed up, determine change data based on the change records, and then perform incremental backup based on the change data to obtain a backup file and generate a backup index and directory for the backup file. This embodiment adopts the principle of incremental backup, based on recording file changes, and only backs up files and data blocks that have changed since the last backup, thereby improving backup efficiency. The key to incremental backup lies in the change tracking mechanism. The system needs to be able to identify which files or data blocks have changed since the last backup, which can be achieved by comparing file timestamps, comparing file attributes, and using snapshot technology. Specifically, the time when a file was last modified is recorded to obtain a file timestamp. If the last modification time of a file is later than the time of the last backup, it is determined that the file has been changed. In addition to timestamps, changes in attributes such as file size, permissions, and owner can also be checked. If the file attributes have changed, it can be determined that the file has been changed. In addition, snapshot technology can be used to record the state of the file system at a specific point in time, thereby determining which files are new or have been changed.

[0057] When performing a backup, the files in the file system that needs to be backed up are first scanned and compared with the stored change records. The above-mentioned file timestamps, file attributes, and snapshot technology are used to determine which files have been newly created, modified, or deleted since the last backup, and the changed files are obtained. Then, the files identified as changed are backed up instead of backing up the entire file system. After the backup is completed, the backup data is stored in the backup destination, such as a tape, hard disk, network attached storage (NAS), or cloud storage service. The backup data includes: incremental data and backup metadata. Among them, incremental data is the actual changed files and data blocks. The backup metadata includes detailed information of the backup, such as backup time, backup type (full backup or incremental backup), changed file list (list of files included in each backup), etc. In order to effectively manage and restore backups, this embodiment will generate a backup index or directory to record detailed information of each backup, including: backup time, backup type, and changed file list.

[0058] When data recovery is needed, the backup system locates the data based on the backup index or directory. If the file to be recovered is in a full backup, it is restored directly from that full backup. If the file to be recovered is in an incremental backup, the system starts with the last full backup and applies subsequent incremental backups in sequence until recovery reaches the specified point in time. To improve efficiency and conserve storage space, the incremental backup process includes data compression and optimization technologies, such as data deduplication, which removes duplicate data blocks and stores only unique data. This reduces the size of the backup data, saving storage space and transmission time.

[0059] In summary, this embodiment first establishes a virtual block device in the confidential computing coprocessor and a storage file in the host, generates a symmetric key, and backs up the symmetric key in the flash of the confidential computing coprocessor. Then, a data storage request is received, and the data to be stored is encrypted through the security algorithm SM4 to obtain ciphertext data, and the ciphertext data is stored on the disk of the host. Then, when a data read request is sent to the host, the ciphertext data is obtained, and the symmetric key is used to decrypt and verify the ciphertext data to obtain plaintext data. The confidential computing coprocessor of this embodiment can ensure that all data stored on the host are encrypted data, effectively preventing malicious users from stealing or tampering with data stored on the host, and ensuring data security.

[0060] Based on the above embodiments, the present invention also provides a file security storage system, such as Figure 7 As shown in , the system includes: a device creation module 10, an encryption processing module 20, and a data decryption module 30. Specifically, the device creation module 10 is used to establish a virtual block device in the confidential computing coprocessor and a storage file in the host, generate a symmetric key, and back up the symmetric key in the flash of the confidential computing coprocessor; the encryption processing module 20 is used to receive a data storage request, encrypt the data to be stored using the security algorithm SM4, obtain ciphertext data, and store the ciphertext data on the host's disk; the data decryption module 30 is used to obtain the ciphertext data after sending a data read request to the host, and use the symmetric key to decrypt and verify the ciphertext data to obtain plaintext data.

[0061] In one implementation, the device creation module 10 includes:

[0062] a parameter acquisition unit, configured to acquire SPU startup parameters and determine whether the SPU startup parameters include legal parameters;

[0063] a block device creation unit, configured to, if the legal parameters are included, cause an internal driver of the confidential computing coprocessor to establish the virtual block device based on the legal parameters;

[0064] The storage file creation unit is used to use a dedicated data channel and a file mapping protocol to inform the host to create the storage file.

[0065] In one implementation, the device creation module 10 includes:

[0066] A key generation unit, configured to generate a symmetric key in the flash of the confidential computing coprocessor after successfully establishing the pseudo-block device and the storage file;

[0067] A key backup unit is used to bind the symmetric key to a trusted application and back up the symmetric key in the flash of the confidential computing coprocessor.

[0068] In one implementation, the data storage request is a page storage request, and the encryption processing module 20 includes:

[0069] A storage request unit, configured to receive a page storage request from an internal driver of the confidential computing coprocessor when the internal file system in the confidential computing coprocessor initiates a write operation;

[0070] The data processing unit is used to drive the internal packaging of the confidential computing coprocessor and send it to the FPGA. The FPGA encrypts the data to be stored using the security algorithm SM4 to obtain ciphertext data.

[0071] The ciphertext storage unit is used for the FPGA to send the IV and TAG corresponding to the ciphertext data to the internal driver of the confidential computing coprocessor, and send the ciphertext data to the host to store the ciphertext data on the host's disk.

[0072] In one implementation, the data read request is a page read request, and the data decryption module 30 includes:

[0073] A read request unit, configured to receive a page read request from an internal driver of the confidential computing coprocessor when the internal file system in the confidential computing coprocessor initiates a read operation;

[0074] A request sending unit, configured for an internal driver of the confidential computing coprocessor to send the page read request to the host via the FPGA;

[0075] The data decryption unit is used for the host driver to read the ciphertext data and return it to the FPGA. The FPGA decrypts the ciphertext data and verifies the IV and TAG, then packages the obtained plaintext data and sends it to the internal driver in the confidential computing coprocessor.

[0076] The data feedback unit is used for the driver of the confidential computing coprocessor to return the received plaintext data to the upper-layer application.

[0077] In one implementation, the system further includes:

[0078] A resource clearing unit is used to clear all resources used by the confidential computing coprocessor when an exit request is received.

[0079] In one implementation, the system further includes:

[0080] a change data determining unit, configured to obtain a change record of a file to be backed up and determine the change data based on the change record;

[0081] The incremental backup execution unit is used to perform incremental backup according to the changed data, obtain a backup file, and generate a backup index and directory of the backup file.

[0082] The working principles of each module in the file security storage system of this embodiment are the same as the principles of each step in the above method embodiment, and will not be repeated here.

[0083] Based on the above embodiment, the present invention further provides a terminal, the principle block diagram of the terminal can be as follows: Figure 8 The terminal may include one or more processors 100 ( Figure 8 (only one is shown in the figure), memory 101, and a computer program 102 stored in memory 101 and executable on one or more processors 100, such as a file security storage program. When one or more processors 100 execute computer program 102, each step in the embodiment of the file security storage method can be implemented. Alternatively, when one or more processors 100 execute computer program 102, the functions of each module / unit in the embodiment of the file security storage method can be implemented, without limitation herein.

[0084] In one embodiment, the processor 100 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0085] In one embodiment, the memory 101 may be an internal storage unit of an electronic device, such as a hard disk or memory of the electronic device. The memory 101 may also be an external storage device of the electronic device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device. Furthermore, the memory 101 may include both an internal storage unit of the electronic device and an external storage device. The memory 101 is used to store computer programs and other programs and data required by the terminal. The memory 101 may also be used to temporarily store data that has been output or is about to be output.

[0086] Those skilled in the art will understand that Figure 8 The principle block diagram shown in the figure is only a block diagram of a partial structure related to the solution of the present invention, and does not constitute a limitation on the terminal to which the solution of the present invention is applied. The specific terminal may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0087] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, operating database or other media used in the embodiments provided by the present invention may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct RAMbus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0088] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for secure file storage, characterized in that: The method is applied to a confidential computing coprocessor having a persistent data security storage function, and the method includes: Establishing a virtual block device in the confidential computing coprocessor and a storage file in the host, generating a symmetric key, and backing up the symmetric key in the flash of the confidential computing coprocessor; Receive a data storage request, encrypt the data to be stored using the security algorithm SM4 to obtain ciphertext data, and store the ciphertext data on the host's disk; After sending a data read request to the host, the ciphertext data is obtained, and the ciphertext data is decrypted and verified using the symmetric key to obtain the plaintext data; The data storage request is a page storage request, and the receiving of the data storage request, encrypting the data to be stored using the security algorithm SM4 to obtain ciphertext data, and storing the ciphertext data on a disk of the host includes: When the internal file system in the confidential computing coprocessor initiates a write operation, the internal driver of the confidential computing coprocessor receives the page storage request; The internal driver of the confidential computing coprocessor packages the data to be stored and sends it to the FPGA. In the FPGA, the data to be stored is encrypted using the security algorithm SM4 to obtain ciphertext data. The FPGA sends the IV and TAG corresponding to the ciphertext data to the internal driver of the confidential computing coprocessor, and sends the ciphertext data to the host to store the ciphertext data on the disk of the host; The data read request is a page read request. After sending the data read request to the host, the ciphertext data is obtained, and the ciphertext data is decrypted and verified using the symmetric key to obtain plaintext data, including: When the internal file system in the confidential computing coprocessor initiates a read operation, the internal driver of the confidential computing coprocessor receives the page read request; The internal driver of the confidential computing coprocessor sends the page read request to the host through the FPGA; The host driver reads the ciphertext data and returns it to the FPGA. The FPGA decrypts the ciphertext data and verifies the IV and TAG. The obtained plaintext data is packaged and sent to the internal driver in the confidential computing coprocessor. The driver of the confidential computing coprocessor receives the plaintext data and returns it to the upper-level application.

2. The file security storage method according to claim 1, characterized in that: The step of establishing a virtual block device in the confidential computing coprocessor and establishing a storage file in the host includes: Obtaining SPU startup parameters and determining whether the SPU startup parameters contain legal parameters; If the legal parameters are included, the internal driver of the confidential computing coprocessor establishes the virtual block device based on the legal parameters; Use a dedicated data channel and a file mapping protocol to inform the host to create the storage file.

3. The file security storage method according to claim 2, characterized in that: Generating a symmetric key and backing up the symmetric key in a flash memory of a confidential computing coprocessor includes: After successfully establishing the pseudo-block device and the storage file, the flash of the confidential computing coprocessor generates a symmetric key; The symmetric key is bound to a trusted application and backed up in the flash of the confidential computing coprocessor.

4. The file security storage method according to claim 1, wherein: The method further comprises: When an exit request is received, all resources used by the confidential computing coprocessor are cleared.

5. The file security storage method according to claim 1, characterized in that: The method further comprises: Obtaining a change record of the file to be backed up, and determining the changed data based on the change record; An incremental backup is performed based on the changed data to obtain a backup file, and a backup index and directory of the backup file are generated.

6. A file security storage system, characterized in that: The system is used to implement the steps of the file security storage method according to any one of claims 1 to 5, and the system is applied to a confidential computing coprocessor, and the confidential computing coprocessor has a persistent data security storage function, and the system includes: A device creation module, configured to create a virtual block device in the confidential computing coprocessor and a storage file in the host, generate a symmetric key, and back up the symmetric key in the flash memory of the confidential computing coprocessor; An encryption processing module is used to receive a data storage request, encrypt the data to be stored using the security algorithm SM4, obtain ciphertext data, and store the ciphertext data on the host's disk; The data decryption module is used to obtain the ciphertext data after sending a data read request to the host, and use the symmetric key to decrypt and verify the ciphertext data to obtain plaintext data.

7. A terminal, characterized in that: The terminal includes a memory, a processor, and a file security storage program stored in the memory and executable on the processor. When the processor executes the file security storage program, the steps of the file security storage method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a file security storage program, and when the file security storage program is executed by the processor, the steps of the file security storage method according to any one of claims 1 to 5 are implemented.

Images