Secure cross-platform file system and method for mobile storage device

Abstract

The invention belongs to the technical field of mobile storage, and discloses a secure cross-platform file system for mobile storage equipment, which comprises a file module 1, an encryption and decryption module 2 and a metadata authentication module 3, a file system architecture based on a user mode space is adopted, a file system implementation part is stripped from a kernel space through a standard user space file system interface standard and a user mode runtime library, the kernel difference of different types of operating systems is shielded, and the problems that an existing scheme is tightly coupled with the kernel of the operating system, and the operation efficiency is low are solved. And the problem of poor cross-platform compatibility exists. A metadata authentication method based on an exclusive address space trusted server is adopted, file system metadata which is difficult to protect by an encryption and decryption module 2 is updated by adopting distributed lock service through the trusted server, and the problems that in an existing scheme, the metadata protection mechanism is weak, and tampering is prone to occurring due to malicious programs are solved.

Description

Technical Field

[0001] The present invention belongs to the field of mobile storage technology, and in particular relates to a secure cross-platform file system and method for mobile storage devices. Background Art

[0002] Mobile storage devices refer to portable electronic devices that have the ability to store and transmit data and can exchange data between different computers or mobile devices, such as hard disks and flash drives. In order to facilitate the storage, access and management of data on mobile storage devices, the file system is introduced as a specific structure for organizing and managing data. By establishing a logical hierarchical model on mobile storage devices, it can effectively complete tasks such as file and directory organization, storage allocation, metadata and access control. Once the data stored in the mobile storage device in plain text is accessed without authorization, the exposure of sensitive information is likely to lead to a series of serious consequences such as personal privacy leakage, commercial secrets theft, and national security threats.

[0003] At present, the solutions for the security of mobile storage devices are mainly divided into hardware system level and file system level. The hardware system level solution refers to protecting the confidentiality and integrity of data by introducing security functions and mechanisms at the hardware level of mobile storage devices, such as installing encryption chips and adding anti-tampering boxes. The file system level solution relies on the file system adapted to the mobile storage device to provide security. Such solutions usually include integrated encryption mechanisms, access control mechanisms, etc. Hardware system solutions usually require specially designed and manufactured hardware components, which have a series of disadvantages such as high cost, high complexity, limited scalability and flexibility, and difficulty in updating and fixing vulnerabilities. Compared with the hardware system level solution, the file system level solution has better scalability and flexibility, and is more adaptable to new technologies and equipment changes. However, the existing file system level solutions for mobile storage devices still have the following problems.

[0004] Existing solutions are tightly coupled with the operating system kernel and have poor cross-platform compatibility. Kernel-state file system solutions refer to solutions designed and implemented for specific operating system kernels. The kernel architectures, APIs, and functions of different operating systems are very different. Since they rely on operating system-specific functions and mechanisms, such solutions cannot provide data security protection for mobile storage devices between different native operating systems without the help of third-party software or tools. Existing kernel-state file system solutions are tightly coupled with the operating system kernel, making it cumbersome and difficult to share data securely between mobile storage devices in different operating systems.

[0005] The existing file system metadata protection mechanism is weak, and there is a problem that metadata is easily tampered by malicious programs. File system metadata refers to the key information used to describe and manage files and directories in the file system, such as file names, permissions, timestamps, directory structures, etc. Its integrity and credibility are crucial to the normal operation of the file system and the security of data. In the existing user-mode file system solution, the management of metadata by mobile storage devices depends on the instances created according to the file system runtime library. Due to the characteristics of shared address space, malicious programs can easily bypass instance transactions and implement illegal updates to metadata, which makes the security and reliability of mobile storage devices between different operating systems seriously insufficient.

[0006] With the popularization of mobile storage devices and Internet technology, the security of mobile storage media has become the key to information system security. Traditional hardware-based security solutions are difficult to meet the requirements of low cost, scalability and customization, which seriously limits the application of storage devices such as USB flash drives in small or medium-sized enterprises, educational institutions and other fields with high requirements for cost and data security. In order to address these challenges, file system-based security solutions have been introduced. By implementing encryption, access control and authentication measures at the file system level, the security of data in mobile storage devices is improved without the need to introduce additional hardware components. Such solutions can be configured, managed and updated according to different security requirements, and are both flexible and secure at low cost.

[0007] In security solutions based on file systems, data security is usually achieved through data encryption, which aims to use cryptographic technologies to protect the confidentiality of data stored in the file system. Files and directories are encrypted to prevent unauthorized access to sensitive information. Encryption can be performed at the file level or storage block level to ensure that data is protected during storage and transmission. In addition, access control technology is combined to implement role-based or user-based access policies, and access permission bits are used to control operations such as reading, writing, and executing, ensuring that only authorized users or roles can access sensitive data in the file system.

[0008] Currently, there are data security solutions that use encryption mechanisms in file system-based security solutions, but there are still some problems. The specific solution details and existing problems are as follows: 1) Existing solutions are tightly coupled with the operating system kernel and have poor cross-platform compatibility: Microsoft has launched BitLocker, a full-disk encryption solution. As part of the Windows operating system, the solution provides a reliable way to encrypt the entire storage device. BitLocker uses a symmetric encryption algorithm to encrypt and decrypt storage device data. By storing the encryption key in the trusted platform module in the computer, it ensures that the key will not be tampered with even if the computer is unattended, lost or stolen. In addition, BitLocker provides additional security features such as boot authentication and centralized management. Boot authentication requires identity authentication at startup to ensure the integrity and security of the system. Centralized management enables administrators to configure, monitor and remotely manage BitLocker to ensure the consistency and compliance of encryption policies. However, since BitLocker is integrated into the Windows operating system kernel, it cannot be used in other categories of operating systems without the help of third-party tools or software. FileVault, a disk encryption tool launched by Apple, encrypts data in storage devices by using the XTSAES128 encryption algorithm. The tool combines the user ID and group ID as a key and compiles it into the secure enclave chip during manufacturing to ensure that no software or firmware can directly read the key. The key is only used by the AES engine in the secure enclave, which only provides the results of encryption and decryption operations. However, the tool can only be used on Mac computers with the Apple T2 security chip.

[0009] 2) The metadata protection mechanism of the existing scheme is weak, and there is a problem that metadata is easily tampered by malicious programs: VeraCrypt is an open source storage device encryption solution that supports multiple encryption algorithms to encrypt data on disk drives, such as AES, Twofish, and Serpent. It uses multi-level encryption and randomization technology and provides multiple encryption modes to meet its specific security requirements. In addition, VeraCrypt protects data during storage and transmission by storing the encrypted data in the created encrypted virtual disk. EncFS[5] is an open source encrypted file system for mobile storage devices. It encrypts data at the file system level to achieve data confidentiality and security while maintaining data integrity. EncFS stores plaintext data in a virtual file system composed of encrypted data blocks8, and accesses and operates encrypted files and directories by mounting the EncFS file system. When reading or writing files, EncFS automatically encrypts or decrypts the data, thereby achieving a transparent encryption and decryption process. EncFS uses the key provided by the user and a symmetric encryption algorithm to encrypt data. It also uses file-level encryption so that each file is encrypted individually to increase data security. In addition, EncFS also provides some additional security features, such as hiding file name and file size information, to increase data privacy and confidentiality.

[0010] Although there are relatively mature solutions for secure file systems of mobile storage devices, there are still some problems.

[0011] (1) Existing solutions are tightly coupled with the operating system kernel and have poor cross-platform compatibility. Current kernel-mode file system solutions are usually designed and implemented for specific operating system kernels. Due to differences in operating system kernels, these solutions require specific adaptation and customization to run on different operating systems, resulting in additional development work and resource investment, which increases the complexity of implementation and maintenance. In addition, due to the tightly coupled nature, these solutions also face compatibility issues with operating system upgrades and updates. Due to changes in the operating system kernel, the solution needs to be adjusted and updated accordingly to adapt to the new kernel version, resulting in additional resource investment during the operating system upgrade process to ensure the stability and reliability of the solution.

[0012] (2) The metadata protection mechanism of the existing solution is weak, and there is a problem that metadata is easily tampered by malicious programs. Current user-mode file system solutions usually manage and synchronize the data and metadata of mobile storage devices by creating a custom user-mode file system runtime library instance. In the case of a single process, due to the characteristic that user-mode programs share address space, malicious programs can easily bypass instance transactions and implement illegal updates to metadata. In the case of concurrent access and sharing, metadata updates to memory and storage devices must rely on the serialization and sorting of library instances, and use shared user-level locks or transactions between library instances. Malicious programs can easily bypass user-level locks or transactions to update metadata, resulting in an incorrect file system state, which makes the security and reliability of mobile storage devices between different operating systems seriously insufficient.

[0013] Through the above analysis, the problems and defects of the prior art are as follows: (1) The existing solution is tightly coupled with the operating system kernel and has poor cross-platform compatibility.

[0014] (2) The existing file system metadata protection mechanism is weak, and there is a problem that metadata can be easily tampered with by malicious programs. Summary of the invention

[0015] In view of the problems existing in the prior art, the present invention provides a secure cross-platform file system for mobile storage devices.

[0016] The present invention is implemented in such a way that a secure cross-platform file system for mobile storage devices comprises: File module 1, encryption and decryption module 2, metadata authentication module 3; The file module 1 is connected to the encryption and decryption module 2 and is used for the file system architecture based on the user space to adapt the file system to the operating system types of different kernels by decoupling the file system implementation part from the kernel; The encryption and decryption module 2 is connected to the metadata authentication module 3 and is used to encrypt the stored data using a symmetric encryption algorithm in combination with the key management module and realize non-sensitive decryption during use; The metadata authentication module 3 is connected to the encryption and decryption module 2 and is used to use the exclusive address space to trust the server to achieve authentication and synchronization of file system metadata.

[0017] Furthermore, the file system architecture based on user space adopts a unified user space file system interface standard, customizes various operation logics of opening, creating, and deleting files, and separates the file system part from the kernel space through the user space runtime library, so that the file system implementation part runs in the user space, shielding the differences between the kernels of different types of operating systems.

[0018] Furthermore, the encryption and decryption module 2, the file system data encryption and decryption part adopts a block encryption mechanism, and supports multiple symmetric encryption algorithms such as AES, DES, IDEA and SM4; by dividing the data into fixed-length data blocks 8 for processing, the data is obfuscated and diffused by executing a series of round functions to achieve the purpose of encryption; the key generation part processes the plaintext password entered by the user and the randomly generated salt value through a hash algorithm, generates a 128-bit key as the encryption master key and stores it.

[0019] Furthermore, the metadata authentication module 3 uses a distributed lock service to manage files and directories of various file system objects; when the metadata needs to be updated, the user-mode runtime synchronizes the update information to the local log file, and the log file is responsible for regularly sending the update information to the trusted server, and the trusted server completes the metadata update; before executing the update, the trusted server verifies whether the update is legal, which includes two steps: 1) verifying whether the data structure of the update message is valid and whether it corresponds to a known operation; 2) verifying whether the user-mode runtime has the global lock and authority of the updated file system object; if the verification passes, the update is executed; otherwise, the metadata update is judged to be an illegal operation and a warning message is reported.

[0020] Another object of the present invention is to provide a secure cross-platform file method for a mobile storage device, comprising: Step 1, through the file module 1, the file system architecture based on the user space is decoupled from the kernel by the file system implementation part, so that the file system can be adapted to the operating system types of different kernels; Step 2: Encrypt the stored data using a symmetric encryption algorithm in combination with the key management module through the encryption and decryption module 2 and realize non-sensitive decryption during use; Step 3: The metadata authentication module 3 uses the exclusive address space to trust the server to implement authentication and synchronization of the file system metadata.

[0021] Another object of the present invention is to provide a computer device, characterized in that the computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the secure cross-platform file method for mobile storage devices.

[0022] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to execute the steps of the secure cross-platform file method for mobile storage devices.

[0023] Another object of the present invention is to provide an information data processing terminal, which is used to implement the secure cross-platform file system for mobile storage devices.

[0024] First, the present invention adopts a file system architecture based on user space, and separates the file system implementation part from the kernel space through the standard user space file system interface standard and the user space runtime library, shielding the differences between different types of operating system kernels, and solving the problem that the existing solutions are tightly coupled with the operating system kernel and have poor cross-platform compatibility.

[0025] A metadata authentication method based on a trusted server with an exclusive address space is adopted. For file system metadata that is difficult to be protected by the encryption and decryption module 2, a distributed lock service is used through the trusted server to implement the update of the file system metadata, thereby solving the problem that the metadata protection mechanism of the existing solution is weak and easily tampered by malicious programs.

[0026] The present invention adopts the FUSE file system unified interface standard, decouples the file system implementation part from the operating system kernel, shields the differences between different types of operating system kernels, and solves the problem of poor cross-platform compatibility of existing solutions; the encryption and decryption module 2 is responsible for protecting the file system data, and the metadata authentication module 3 is responsible for protecting the file system metadata. While taking into account the high security protection of file data in the existing solutions, it solves the problem that the metadata protection mechanism of other current solutions is weak and easy to be tampered by malicious programs.

[0027] Second, as auxiliary evidence of the inventiveness of the claims of the present invention, it is also reflected in the following important aspects: The expected benefits and commercial value of the technical solution of the present invention after transformation are: The present invention achieves a dual improvement in cross-platform compatibility and data security through a file system architecture based on user-state space and an innovative metadata protection mechanism. By adopting a file system architecture based on user-state space and separating the file system implementation part from the kernel space, cross-platform compatibility is significantly improved, so that the file system can run seamlessly on different types of operating systems, reducing development and maintenance costs. By reducing the file system's dependence on a specific operating system kernel, the complexity and maintenance workload of cross-platform development are simplified. Both individual users and corporate users can deploy and use the file system in the operating system environment they use, expanding the potential user group. At the same time, because the present invention can adapt to updates and changes in different operating systems, compatibility issues and subsequent maintenance costs caused by operating system upgrades are reduced, so that the product has a longer life cycle.

[0028] In addition, the present invention provides an efficient metadata protection mechanism, which ensures dual security protection of file system data and metadata through close integration with the encryption and decryption module 2. While improving the security of file data, it also effectively protects the integrity and reliability of metadata. The introduction of higher standard security measures has increased users' trust in the system, especially in today's market environment where data security and privacy protection requirements are increasingly high. This advantage will help companies win more trust and support from users. In addition, high-level security protection mechanisms can help companies better meet various data protection laws, regulations and compliance requirements, and improve the company's competitiveness in compliance. (2) The technical solution of the present invention fills the technical gap in the industry at home and abroad: The present invention introduces a metadata authentication method of a trust server with an exclusive address space, and uses a distributed lock service through the trust server to implement the update of the file system metadata. In current research at home and abroad, the distributed lock service is mainly used in the transaction management of databases and distributed systems, and the present invention innovatively applies it to the field of file system metadata protection, solving the problem that metadata is easily tampered with, and providing a new solution for the security of the file system. In addition, at home and abroad, the existing file system metadata protection scheme usually relies on the kernel space to implement it. The present invention combines with the FUSE file system unified interface standard to implement this function in the user space, creating a new technical path and filling the technical gap in this field.

[0029] In addition, the present invention combines the encryption and decryption module 2 and the metadata authentication module 3 in the file system architecture, which are responsible for protecting the file data and metadata respectively. This dual protection mechanism significantly improves the security of metadata while ensuring high data security. Although some file systems at home and abroad have data encryption functions, the protection of metadata is often insufficient. In this regard, the present invention proposes an innovative solution, which fills the gap in metadata protection in the prior art and provides more comprehensive security protection.

[0030] (3) The technical solution of the present invention solves a technical problem that people have been eager to solve but have never been able to solve successfully: Solved. Existing kernel-mode file system solutions refer to solutions designed and implemented for specific operating system kernels. The kernel architectures, APIs, and functions of different operating systems are very different. Since they rely on operating system-specific functions and mechanisms, such solutions cannot provide data security protection for mobile storage devices between different native operating systems without the help of third-party software or tools. Existing kernel-mode file system solutions are tightly coupled with the operating system kernel, making it cumbersome and difficult to share data securely between mobile storage devices in different operating systems. In addition, in existing user-mode file system solutions, the management of metadata by mobile storage devices depends on instances created based on the file system runtime library. Due to the characteristics of shared address space, malicious programs can easily bypass instance transactions and implement illegal changes to metadata, which seriously deficiencies in the security and reliability of mobile storage devices between different operating systems.

[0031] The present invention adopts the FUSE file system unified interface standard, decouples the file system implementation part from the operating system kernel, shields the differences between different types of operating system kernels, and solves the problem of poor cross-platform compatibility of existing solutions; the encryption and decryption module 2 is responsible for protecting the file system data, and the metadata authentication module 3 is responsible for protecting the file system metadata. While taking into account the high security protection of file data in the existing solutions, it solves the problem that other current solutions have weak metadata protection mechanisms in cross-platform scenarios and are easily tampered by malicious programs.

[0032] (4) The technical solution of the present invention overcomes technical prejudice: overcomes. First, for a long time, the tight coupling of the file system and the operating system kernel has been considered a necessary condition for achieving high performance and reliability. Many developers believe that the user space cannot provide the same performance and reliability. Therefore, the user-state file system is considered unsuitable for application scenarios with high performance and high security requirements. The present invention successfully overcomes the above technical prejudice by using a file system architecture based on the user space, adopting a standard user space file system interface and a user space runtime library, and separating the file system implementation part from the kernel space. The FUSE file system unified interface standard ensures that the file system runs seamlessly on different operating systems, solving the problem of poor cross-platform compatibility. Practical applications show that the present invention significantly improves cross-platform compatibility while ensuring high performance and high reliability, reduces development and maintenance costs, and breaks the traditional concept that the user-state file system is not suitable for high-performance applications. Secondly, many developers believe that high-security protection of metadata can only be achieved through the kernel state, and the user-state protection measures cannot meet the same security standards. Therefore, the user-state file system is generally considered to be unsafe and unreliable. The present invention uses a metadata authentication method based on a unique address space trust server and introduces a distributed lock service to implement file system metadata updates. The trust server and distributed lock service ensure the atomicity and consistency of metadata operations, prevent malicious programs from tampering, and overcome the above technical bias. This innovative method proves that user space can also achieve efficient and secure metadata protection, changing the traditional concept that user space cannot provide high security protection.

[0033] Fourth, the technical solution of the present invention solves many technical problems in the prior art and achieves significant technical progress, as follows: Technical issues

[0034] 1) Poor cross-platform compatibility: Existing file systems have poor compatibility between different operating systems and need to be adapted separately for each operating system, which increases the complexity of development and maintenance.

[0035] 2) Low data security: Traditional file systems have the problem of cumbersome user operations during data encryption and decryption, and cannot achieve seamless decryption, which affects the user experience.

[0036] Data lacks effective encryption protection during storage and transmission, making it vulnerable to attacks and leading to data leakage.

[0037] 3) Metadata consistency and security are difficult to ensure: When existing file systems are synchronized between multiple devices, the consistency and security of metadata are difficult to guarantee, which can easily lead to data loss and inconsistency.

[0038] Technological advancements: 1) Cross-platform compatibility: The present invention adopts a file system architecture based on user space, separates the file system implementation part from the kernel space, runs in the user space, and adapts the file system to different operating system types through a unified user space file system interface standard. This architecture design not only simplifies development and maintenance work, but also improves the cross-platform compatibility of the file system, and users can seamlessly use the same file system on different operating systems.

[0039] 2) Data security: By introducing the encryption and decryption module 2, a symmetric encryption algorithm (such as AES or ChaCha20) is used in combination with the key management module to encrypt the stored data. During use, non-sensitive decryption is achieved, so that users do not need to perform additional operations when accessing data, which improves the user experience. At the same time, the key management module ensures the security of the key and prevents key leakage and abuse.

[0040] 3) Metadata consistency and security: The exclusive address space trust server is used to authenticate and synchronize the file system metadata. Each operation on the file system (such as reading, modifying, and deleting files) is synchronized and verified through the trust server to ensure data consistency and security.

[0041] 4) User experience: By adopting customized file operation logic (such as opening, creating, and deleting files), the file system part is separated from the kernel space through the user-mode runtime library, so that the file system implementation part runs in the user space, shielding the differences between kernels of different types of operating systems, and improving the response speed of the file system and user experience.

[0042] In summary, the present invention solves multiple technical problems in the prior art through innovative technical solutions, achieves significant technical progress, and improves the cross-platform compatibility, security, consistency and user experience of the file system. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 The present invention is a structural block diagram of a secure cross-platform file system for mobile storage devices provided by an embodiment of the present invention.

[0044] Figure 2 It is a flow chart of a secure cross-platform file method for mobile storage devices provided by an embodiment of the present invention.

[0045] Figure 3 2 is a schematic diagram of a secure cross-platform file system for mobile storage devices provided by an embodiment of the present invention.

[0046] Figure 4 This is an abstract architecture diagram of a user-mode file system based on a FUSE interface provided by an embodiment of the present invention.

[0047] Figure 5 2 is a schematic diagram of the structure of the metadata authentication module 3 provided in an embodiment of the present invention.

[0048] Figure 1 In it: 1. File module; 2. Encryption and decryption module; 3. Metadata authentication module; 4. FUSE daemon; 5. Authentication server; 6. VFS; 7. Network; 8. Data block; 9. Application; 10. Other kernel subsystems; 11. Kernel-mode file system; 12. FUSE driver; 13. Device manager; 14. Mobile storage device. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0050] The following are two specific embodiments of secure cross-platform file systems for mobile storage devices: like Figure 1 As shown, a secure cross-platform file system for mobile storage devices provided by an embodiment of the present invention includes: File module 1, encryption and decryption module 2, metadata authentication module 3; The file module 1 is connected to the encryption and decryption module 2 and is used for the file system architecture based on the user space to adapt the file system to the operating system types of different kernels by decoupling the file system implementation part from the kernel; The encryption and decryption module 2 is connected to the metadata authentication module 3 and is used to encrypt the stored data using a symmetric encryption algorithm in combination with the key management module and realize non-sensitive decryption during use; The metadata authentication module 3 is connected to the encryption and decryption module 2 and is used to use the exclusive address space to trust the server to achieve authentication and synchronization of file system metadata.

[0051] The working principle of the secure cross-platform file system for mobile storage devices can be described in detail as follows: The file system is mainly composed of three core modules: file module 1, encryption and decryption module 2 and metadata authentication module 3.

[0052] 1) File module 1: Responsible for basic file system operations, such as opening, creating, and deleting files.

[0053] Connected with the encryption and decryption module 2, the file system architecture is implemented based on the user space. By decoupling the file system implementation part from the kernel, the file system can adapt to the operating system types of different kernels.

[0054] Adopt a unified user space file system interface standard and customize the logic of various file operations. The file system part is separated from the kernel space through the user state runtime library, so that the file system implementation part runs in the user space, thus shielding the differences between different types of operating system kernels.

[0055] 2) Encryption and decryption module 2: Encrypt and decrypt stored data to ensure data security.

[0056] The symmetric encryption algorithm is used in combination with the key management module. During the implementation process, the encrypted data is invisible to the user, that is, the user does not need to be aware of the existence of the encryption operation during use.

[0057] When file data needs to be stored in a mobile storage device, the encryption and decryption module 2 will automatically encrypt the data; when data is read from the mobile storage device, the module will automatically decrypt the data to ensure that users can seamlessly access the original data.

[0058] 3) Metadata authentication module 3: Responsible for the authentication and synchronization of file system metadata to ensure data integrity and consistency.

[0059] The authentication and synchronization process is implemented by using a dedicated address space to trust the server. This mechanism can effectively prevent metadata from being tampered with or damaged.

[0060] During the file system operation, the metadata authentication module 3 will verify and synchronize the metadata on the storage device regularly or as needed. The server is trusted through the exclusive address space to ensure that the source of the metadata is reliable and has not been tampered with. Once the metadata anomaly is found, the system will take corresponding recovery or error handling measures.

[0061] The entire secure cross-platform file system for mobile storage devices implements its functions through the following steps: 1) File operation request: The user initiates a file operation request (such as opening, creating, deleting files, etc.) through the application layer.

[0062] 2) File module 1 processing: After receiving the request, file module 1 processes it according to the file system architecture of the user space. If data needs to be stored or read, encryption and decryption module 2 is called to perform the next step.

[0063] 3) Data encryption / decryption: The encryption / decryption module 2 encrypts or decrypts the data according to the request type. Encryption ensures the security of the data during storage; decryption ensures that users can seamlessly access the stored data.

[0064] 4) Metadata authentication and synchronization: During the file operation process, the metadata authentication module 3 will verify and synchronize the metadata on the storage device regularly or as needed to ensure the integrity and consistency of the metadata and prevent data from being tampered with or damaged.

[0065] 5) Data access: After encryption / decryption and metadata authentication, users can access the stored data through the application layer. The entire process is transparent to users, who do not need to worry about the details of data encryption and metadata authentication.

[0066] The secure cross-platform file system for mobile storage devices realizes secure storage and access control of data in mobile storage devices through the collaborative work of file module 1, encryption and decryption module 2 and metadata authentication module 3. The system is highly flexible and scalable, and can adapt to different kernel operating system types and meet the needs of diverse application scenarios.

[0067] The file system architecture based on user space provided by the embodiment of the present invention adopts a unified user space file system interface standard, customizes various operation logics of opening, creating, and deleting files, and separates the file system part from the kernel space through the user space runtime library, so that the file system implementation part runs in the user space, shielding the differences between the kernels of different types of operating systems.

[0068] The encryption and decryption module 2 provided in the embodiment of the present invention adopts a block encryption mechanism in the file system data encryption and decryption part, and supports multiple symmetric encryption algorithms such as AES, DES, IDEA and SM4; the data is divided into fixed-length data blocks 8 for processing, and the data is obfuscated and diffused by executing a series of round functions to achieve the purpose of encryption; the key generation part processes the plain text password input by the user and the randomly generated salt value through the hash algorithm, generates a 128-bit key as the encryption master key and stores it.

[0069] The metadata authentication module 3 provided in the embodiment of the present invention uses a distributed lock service to manage files and directories of various file system objects; when the metadata needs to be updated, the user-mode runtime synchronizes the update information to the local log file, and the log file is responsible for regularly sending the update information to the trusted server, and the trusted server completes the metadata update; before executing the update, the trusted server verifies whether the update is legal, which includes two steps: 1) verifying whether the data structure of the update message is valid and whether it corresponds to a known operation; 2) verifying whether the user-mode runtime has the global lock and authority of the updated file system object; if the verification passes, the update is executed; otherwise, the metadata update is judged to be an illegal operation and a warning message is reported.

[0070] like Figure 2 As shown, a secure cross-platform file method for a mobile storage device provided by an embodiment of the present invention includes: Step 1, through the file module 1, the file system architecture based on the user space is decoupled from the kernel by the file system implementation part, so that the file system can be adapted to the operating system types of different kernels; Step 2: Encrypt the stored data using a symmetric encryption algorithm in combination with the key management module through the encryption and decryption module 2 and realize non-sensitive decryption during use; Step 3: The metadata authentication module 3 uses the exclusive address space to trust the server to implement authentication and synchronization of the file system metadata.

[0071] Another object of the present invention is to provide a computer device, characterized in that the computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the secure cross-platform file method for mobile storage devices.

[0072] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to execute the steps of the secure cross-platform file method for mobile storage devices.

[0073] Another object of the present invention is to provide an information data processing terminal, which is used to implement the secure cross-platform file system for mobile storage devices.

[0074] The present invention is specifically implemented: As attached Figure 3 , 4 As shown in , 5, the secure cross-platform file system for mobile storage devices provided by the embodiment of the present invention includes the following steps: (1) Propose a secure cross-platform file system for mobile storage devices The secure cross-platform file system for mobile storage devices mainly consists of three parts, namely, a file system architecture based on user space, a data encryption and decryption module 2, and a metadata authentication module 3. As the basis of the entire file system, the file system architecture adopts the FUSE file system unified interface standard and uses the user-state runtime library as the core component, so that the file system implementation part runs in the user space, shielding the differences between different types of operating system kernels. When the user-state runtime library performs various operations, file system data and metadata are involved. File system data refers to the actual file content created, stored and operated. This part of the data is protected by the data encryption and decryption module 2, which supports various symmetric encryption algorithms and adopts a group encryption mechanism to ensure that the data is always stored in the storage device as ciphertext data, thereby realizing the confidentiality protection of the stored data. File system metadata refers to the key information used to describe and manage files and directories in the file system. This part of the data is updated and synchronized through the metadata authentication module 3, and a warning message is issued when an illegal metadata update operation occurs.

[0075] (2) File system architecture based on user space User space is a part of the virtual address space allocated by the operating system to the user process. By providing an isolated environment, the user process can run in a relatively restricted environment and can interact with the operating system kernel through a communication mechanism. FUSE (Filesystem in Userspace) is a unified file system interface standard. It establishes a communication bridge through the FUSE driver 13, so that the file system operation request and processing results can communicate between the kernel space and the user space, thereby realizing the writing and operation of the file system in the user state and avoiding the modification of the operating system kernel. This architecture adopts the FUSE file system unified interface standard, with the user state runtime library as the core component, and customizes various operation logics such as opening, creating, and deleting files, so that the file system implementation partially runs in the user space, thereby shielding the differences between different types of operating system kernels. The process of processing device operations in this architecture is as follows.

[0076] When the mobile storage device 14 performs an operation on the mounted file system, the virtual file system routes the operation to the user-mode file system kernel driver. The driver allocates a user-mode file system request structure and puts it into the corresponding queue. At the same time, the process submitting the operation will be in a waiting state. The file system user-level daemon then selects the request from the kernel queue and processes the request by reading the corresponding device. Based on the difference in the request type, it decides whether to enter the kernel again. After the request is processed, the user-mode file system daemon writes the response back to the corresponding device. The user-mode file system kernel driver then marks the request as completed and wakes up the original user process.

[0077] (3) Encryption and decryption module 2: supports various symmetric encryption algorithms and combines with the key management module to encrypt stored data and achieve seamless decryption during use This module implements the ciphertext storage of data in the mobile storage device 14 based on the block encryption mechanism, and supports the use of various symmetric encryption algorithms such as AES, DES, IDEA and SM4. This module adopts the block cipher mechanism to divide the data into fixed-length data blocks 8 for processing, and implements the obfuscation and diffusion of the data by executing a series of round functions to achieve the purpose of encryption. The key management module is responsible for the generation, storage and verification of keys. This module processes the plaintext password entered by the user and the randomly generated salt value through the hash algorithm, generates a 128-bit key as the encryption master key and stores it. The specific encryption and decryption process is: After the mobile storage device 14 is mounted, the master key is generated through the key management module using the input plaintext password and the salt value stored in the key management module. The key expansion algorithm is used to expand the master key into a series of round keys for subsequent rounds of encryption and decryption operations. When writing to the mobile storage device 14, the data to be encrypted is divided into data blocks 8 of a fixed size of 16 bytes. To enhance security, each data block 8 uses a unique initialization vector. In combination with the round key, the data block 8 is encrypted. When reading the encrypted block, the ciphertext block is divided into data blocks 8 of a fixed size of 16 bytes, and in combination with the current round key, the ciphertext data block 8 is restored to the original plaintext data through multiple rounds of decryption. The decrypted plaintext data will only be temporarily stored in the memory to avoid saving any decrypted data to the disk.

[0078] (4) Metadata authentication module 3: Propose a metadata authentication method based on a unique address space trust server As a trusted file system service solution built in the operating system user space, the trust server based on exclusive address space is designed to provide reliable management and synchronization services for file system metadata. Figure 5 As shown, the metadata authentication module 3 relies on the user state runtime library and the trust server to realize metadata authentication. The user state runtime library is responsible for providing functions including file naming, data access, data block 8 allocation, etc., and the trust server is responsible for executing metadata update and verification.

[0079] The user-mode runtime must update the file system metadata through the trust server. The trust server uses distributed lock services to manage various file system objects such as files and directories. By pre-assigning a unique global lock to each object, the user-mode runtime requests to overwrite the lock of the object before performing an operation. The lock will be used until the operation is completed or the lock of the object is reclaimed by the trust server. When the metadata needs to be updated, the user-mode runtime synchronizes the update information to the local log file, which is responsible for regularly sending the update information to the trust server, and the trust server completes the metadata update; each log entry contains three parts: the operation header, the identifier of the modified object, and the field updated by the operation; before executing the update, the trust server verifies whether the update is legal, which includes two steps: 1) Verify whether the data structure of the update message is valid and whether it corresponds to a known operation; 2) Verify whether the user-mode runtime has the global lock and permissions of the updated file system object. If the verification passes, the update is executed. Otherwise, the metadata update is judged to be an illegal operation and a warning message is reported.

[0080] Existing software encryption solutions focus on the protection of file system data and their implementation on specific types of operating systems, but ignore the protection measures for file system metadata and compatibility on different types of platforms. As a result, existing solutions are difficult to be compatible with different types of operating systems and have insufficient security.

[0081] The present invention adopts the FUSE file system unified interface standard, decouples the file system implementation part from the operating system kernel, shields the differences between different types of operating system kernels, and solves the problem of poor cross-platform compatibility of existing solutions; the encryption and decryption module 2 is responsible for protecting the file system data, and the metadata authentication module 3 is responsible for protecting the file system metadata. While taking into account the high security protection of file data in the existing solutions, it solves the problem that the metadata protection mechanism of other current solutions is weak and easy to be tampered by malicious programs.

[0082] The present invention is based on a file system architecture in user space, combined with the FUSE file system interface standard, a metadata authentication method of an exclusive address space trust server, and a distributed lock service, and has a very wide range of applications.

[0083] This technical solution solves the problem of tight coupling between the file system and the operating system kernel, and achieves cross-platform compatibility through the FUSE file system interface standard. This feature makes the present invention particularly suitable for file storage solutions that need to be deployed and used in multiple operating system environments. For example, it can be applied to enterprise file sharing systems, by providing a unified file storage and sharing platform, supporting multiple operating systems such as Windows, Linux, macOS, etc., to facilitate data sharing and collaboration between different departments and employees within the enterprise. In addition, the technical solution provides a dual protection mechanism for data and metadata by combining the encryption and decryption module 2 and the metadata authentication module 3. This feature makes it very suitable for scenarios with extremely high data security requirements. For example, the financial industry, the medical industry, and the government and public sectors store and protect important files and data, prevent data leakage and tampering, and ensure the confidentiality and integrity of the data.

[0084] Related products include Microsoft's full disk encryption solution BitLocker and Apple's FileVault encryption tool. However, such products are heavily dependent on the type of operating system. For example, without the help of any third-party tools, BitLocker can only be used in Windows operating systems, and FileVault can only be used on Mac computers with Apple T2 security chips. In addition, VeraCrypt, EncFS and other products based on user space technology have insufficient metadata protection mechanisms and are easily tampered with by malicious programs.

[0085] The present invention adds security reinforcement measures to processes such as secure transmission of common data encryption keys, metadata protection, and signaling transmission based on a symmetric encryption algorithm and a trusted server.

[0086] In terms of the protection of the transmission of encryption keys for common file data, the symmetric cryptographic algorithm is used to implement session key negotiation, and the common file data encryption keys are securely transmitted with the help of session keys. While ensuring the security of the transmission process of the encryption keys for the mobile storage data, the data identity authentication of both parties can be realized to prevent man-in-the-middle attacks, and two-way key confirmation is completed during the negotiation, which enhances reliability. The session key is used to securely transmit the encryption keys for the mobile storage device 14 data, which ensures the security of the key transmission process.

[0087] In terms of file system metadata protection, a trusted file system service solution is built in the operating system user space based on a trusted server with an exclusive address space, which realizes reliable management and synchronization services of file system metadata, ensures legal access and update audit of metadata information, and ensures the security and trustworthiness of metadata.

[0088] In terms of signaling transmission protection, a verification mechanism is added to the signaling message using negotiated keys and hash algorithms, effectively ensuring the integrity of the signaling.

[0089] Example 1: Cross-platform file system based on Linux and Windows operating systems *1. File module 1: In the Linux system, the libufse library is used to implement the file module 1, and the file system implementation part is separated from the kernel space and runs in the user space.

[0090] In the Windows system, WinFsp (Windows File System Proxy) is used to implement the file module 1, and the file system implementation part is also separated from the kernel space and runs in the user space.

[0091] Through the unified user space file system interface standard, the operation logic of opening, creating, deleting and other operations of customized files can be ensured to have a consistent user experience on different operating systems.

[0092] 2. Encryption and decryption module 2: The AES (Advanced Encryption Standard) symmetric encryption algorithm is used to encrypt stored data.

[0093] The key management module generates and manages keys. The user enters a password to generate a key when using it for the first time, and the data is encrypted and stored using the key.

[0094] When reading data, it is seamlessly decrypted in combination with the password entered by the user to achieve transparent access to data.

[0095] 3. Metadata authentication module 3: The exclusive address space trust server (such as the independent authentication server 5) is used for authentication and synchronization of file system metadata.

[0096] Each operation on the file system (such as file creation, modification, and deletion) will synchronize and verify metadata on the trusted server to ensure data consistency and security.

[0097] Example 2: Cross-platform file system based on Android and iOS operating systems 1. File module 1: In the Android system, a file system architecture based on user space is used, and the file system implementation part runs in the user space through the JNI (Java Native Interface) bridge.

[0098] In the iOS system, a file system architecture based on user-space is used, which is bridged by ObjectiveC and C language to implement user-space operation of the file system part.

[0099] Through customized file operation logic (such as opening, creating, and deleting files), unified interface standards ensure the consistency of file systems on different mobile operating systems.

[0100] 2. Encryption and decryption module 2: The ChaCha20 symmetric encryption algorithm is used to encrypt stored data, which is an efficient encryption algorithm suitable for mobile devices.

[0101] The key management module generates and manages keys based on the security module of the mobile device (such as Android's Keystore and iOS's Keychain).

[0102] During use, the key is obtained by combining the user's biometrics (such as fingerprint and facial recognition) to achieve seamless decryption and ensure a smooth user experience.

[0103] 3. Metadata authentication module 3: The exclusive address space trust server (such as the independent authentication server 5) is used for authentication and synchronization of file system metadata.

[0104] Each operation on the file system (such as file creation, modification, and deletion) will synchronize and verify metadata on the trusted server to ensure data consistency and security.

[0105] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. A person of ordinary skill in the art will appreciate that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVDROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0106] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A secure cross-platform file system for mobile storage devices, characterized in that: include: File module 1, encryption and decryption module 2, metadata authentication module 3; The file module 1 is connected to the encryption and decryption module 2 and is used for the file system architecture based on the user space to adapt the file system to the operating system types of different kernels by decoupling the file system implementation part from the kernel; The encryption and decryption module 2 is connected to the metadata authentication module 3 and is used to encrypt the stored data using a symmetric encryption algorithm in combination with the key management module and realize non-sensitive decryption during use; The metadata authentication module 3 is connected to the encryption and decryption module 2 and is used to use the exclusive address space to trust the server to achieve authentication and synchronization of file system metadata.

2. The secure cross-platform file system for mobile storage devices as claimed in claim 1, characterized in that: The file system architecture based on user space adopts a unified user space file system interface standard, customizes various operation logics of opening, creating, and deleting files, and separates the file system part from the kernel space through the user space runtime library, so that the file system implementation part runs in the user space, shielding the differences between the kernels of different types of operating systems.

3. The secure cross-platform file system for mobile storage devices as claimed in claim 1, characterized in that: The encryption and decryption module 2, the file system data encryption and decryption part adopts a block encryption mechanism, supports AES, DES, IDEA and SM4 multiple symmetric encryption algorithms; by dividing the data into fixed-length data blocks 8 for processing, and implementing a series of round functions to achieve data obfuscation and diffusion, the purpose of encryption is achieved; The key generation part processes the plain text password entered by the user and the randomly generated salt value through a hash algorithm to generate a 128-bit key as the encryption master key and store it.

4. The secure cross-platform file system for mobile storage devices as claimed in claim 1, characterized in that: The metadata authentication module 3 uses a distributed lock service to manage files and directories of various file system objects; when the metadata needs to be updated, the user-mode runtime synchronizes the update information to the local log file, which is responsible for regularly sending the update information to the trust server, and the trust server completes the metadata update; Before executing the update, the trust server verifies whether the update is legal, which includes two steps: 1) verifying whether the data structure of the update message is valid and whether it corresponds to a known operation; 2) verifying whether the user-mode runtime library has the global lock and permissions of the updated file system object; if the verification passes, the update is executed; otherwise, the metadata update is judged as an illegal operation and a warning message is reported.

5. A secure cross-platform file method for mobile storage devices implementing the secure cross-platform file system for mobile storage devices as claimed in any one of claims 1 to 4, characterized in that: The secure cross-platform file method for mobile storage devices comprises: Step 1, through the file module 1, the file system architecture based on the user space is decoupled from the kernel by the file system implementation part, so that the file system can be adapted to the operating system types of different kernels; Step 2: Encrypt the stored data using a symmetric encryption algorithm in combination with the key management module through the encryption and decryption module 2 and realize non-sensitive decryption during use; Step 3: The metadata authentication module 3 uses the exclusive address space to trust the server to implement authentication and synchronization of the file system metadata.

6. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the secure cross-platform file method for mobile storage devices as claimed in claim 5.

7. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the secure cross-platform file method for mobile storage devices as claimed in claim 5.

8. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the secure cross-platform file system for mobile storage devices as described in any one of claims 1 to 4.

Images