Mobile memory data one-way transfer method supporting domestic cryptographic algorithm

Abstract

The invention belongs to the technical field of mobile storage, and discloses a mobile memory data one-way transfer method supporting a domestic cryptographic algorithm. A data encryption and decryption and integrity verification module is introduced to carry out encryption, decryption and integrity verification operation on data, a domestic cryptographic algorithm is supported, and the integrity of the data is ensured. In this way, the problem that the data are tampered or damaged in the transmission or storage process is solved, and the reliability and safety of the data are improved. By providing the mobile memory data one-way transfer method supporting the domestic encryption algorithm, the practicability and the safety can be improved while the cost is reduced. According to the method, a data one-way transfer file system is constructed, deployment is carried out on computer equipment of a sender and a receiver, and non-perception of encryption and decryption operation is achieved.

Description

Technical Field

[0001] The invention belongs to the field of mobile storage technology, and in particular relates to a method and system for unidirectional transfer of data in a mobile storage device supporting a domestic cryptographic algorithm. Background Art

[0002] Mobile storage devices such as USB flash drives and mobile hard disks provide a two-way data transfer carrier and path for copying in and out, facilitating the flow of cross-domain data and becoming one of the mainstream tools for forwarding data between internal and external networks. However, during the process of bidirectional plaintext data transfer, data is vulnerable to security threats such as hardware brute force attacks and data tampering attacks, which seriously affect data security and threaten the interests of society and the country. For this reason, the security control of mobile storage devices has become a hot topic of concern to all sectors.

[0003] The main technical routes for the current removable storage data security management and control are hardware-based management and control technology and software-based management and control technology. Among them, hardware-based management and control technologies include encryption chips, physical locks, etc., and their main problems are complex design and high cost. Software-based management and control technologies include data encryption software, access control software, etc., and their main problems are weak security and poor user experience.

[0004] First, although hardware-based control technology has high security, the complexity of the design and the high price of the hardware increase the cost and make it difficult to use on a large scale. Usually, this technology requires the integration of additional dedicated encryption chips or modules on the basis of the original mobile storage device to implement encryption operations to protect data security, design a secure communication protocol to coordinate the data transmission between the storage chip and the security chip, and use decryption key verification to achieve one-way transfer from the sender to the receiver. The additional encryption chip cost, circuit design cost and communication protocol design cost lead to an increase in overall cost, which is not conducive to the large-scale use of the product.

[0005] Secondly, although software-based control technology performs well in cost control, it has the defects of weak security and poor usability. This type of technology is based on the encryption and decryption software program implemented in the operating system application layer to encrypt the data and store it in the mobile storage. When decrypting, it is also necessary to complete the decryption operation in the encryption and decryption software before accessing the data. Users cannot directly access the data like operating ordinary files, and cannot achieve non-sensing operation of encrypted data. The key management method of the prior art has poor security. Some software does not have a sufficiently strong password management strategy, allowing the use of weak passwords or lacking password complexity requirements, which increases the risk of password cracking. The prior art has the security defect of not using domestic cryptographic algorithms. Domestic cryptographic algorithms have been reviewed and certified by the government and have high credibility and security. However, some non-domestic cryptographic algorithms lack public and reliable security assessments and certifications, which makes them have greater uncertainty in actual use and vulnerable to attacks. The use of such cryptographic algorithms will bring data security risks.

[0006] In order to achieve the best data security transmission, this patent will target the software management solution and solve its existing defects in availability and security, including the inability to read and write seamlessly, the lack of support for domestic cryptographic algorithms, and the inability to ensure data integrity.

[0007] Data security is extremely important for medical, government, financial and other institutions. To protect the security of their data, the data is usually placed in a dedicated network environment to avoid attacks from the external network environment, but data exchange with the outside world is still unavoidable. In order to achieve secure data forwarding, one-way data transfer based on removable storage is introduced. Through the removable storage, the data is forwarded offline to another controllable and secure environment for data processing.

[0008] The one-way data transfer technology based on removable storage is designed to protect the data from being securely forwarded from the sender to the receiver, ensuring that the data is not tampered with or leaked during the transmission process, and that the target receiver can only access the data after passing identity authentication. The one-way data transfer technology based on removable storage makes the data invisible to illegal users during the transmission process by means of removable storage management methods such as encryption, identity authentication, integrity verification, and audit logs, ensuring that the target receiver can access the data stored in the removable storage only after completing identity verification, and performs integrity verification before accessing the data, refusing to accept tampered data, and reviewing the data access records, so that the entire data process is controllable.

[0009] Software-based removable storage management technology uses encryption and decryption software implemented in the operating system application layer to store and access storage data after encrypting and decrypting the data. Common examples include TrueCrypt[1], DriveCrypt, and BitLocker[2].

[0010] TrueCrypt is an open source removable storage management software that supports data encryption to protect removable storage. It supports AES, Serpent, and Twofish cryptographic algorithms. It creates encrypted containers to store data and verifies access through passwords. It supports password strength checks to help users choose passwords with higher security and enhance data security. DriveCrypt is an enterprise-level removable storage management software that also supports AES, Serpent, and Twofish cryptographic algorithms to encrypt data and supports the creation of multiple encrypted virtual drives to store sensitive data, ensuring the security and confidentiality of data storage and transmission processes. It also supports two-factor authentication and disk pre-boot authentication. BitLocker is a removable storage management tool provided by the Windows operating system that can perform full disk encryption on removable storage and encrypt the entire data storage area. It also provides multiple authentication methods, such as passwords, smart cards, and USB keys. It supports acceleration of the data encryption process based on computer hardware and supports the AES encryption algorithm. The above software all perform security control on removable storage to a certain extent, but they lack data access record auditing and data integrity verification, do not support domestic cryptographic algorithms, have weak security, and are all implemented at the operating system application layer and cannot support seamless operation of encrypted files.

[0011] Although there are relatively mature solutions for the one-way transfer of data in existing removable storage devices, each solution has certain defects.

[0012] The one-way data transfer solution implemented by software-based removable storage management technology has relatively weak security and poor availability:

[0013] Weak security: The weak security problem is reflected in the lack of support for domestic cryptographic algorithms and the inability to ensure data integrity. Software control technology usually uses non-domestic cryptographic algorithms to encrypt and decrypt data. Non-domestic cryptographic algorithms have undiscovered or undisclosed security vulnerabilities, which make them vulnerable to attacks such as cryptanalysis and exhaustive attacks in actual use. Software control technology usually only provides encryption and decryption functions for data, but cannot provide protection for data integrity. During data transmission or storage, if the data is tampered with or damaged, software control technology cannot detect or prevent this from happening, which affects the reliability and security of the data.

[0014] Problem of poor usability: Software control-based technology encrypts and protects data by implementing encryption software in the application layer of the operating system. During encryption and decryption, confidential data needs to be operated in the software to achieve data encryption and decryption. Users cannot directly access data like operating ordinary files, and cannot achieve seamless operation of encrypted data, which brings a poor user experience.

[0015] Through the above analysis, the problems and defects of the prior art are as follows:

[0016] (1) Weak security: The problem of weak security is reflected in the lack of support for domestic cryptographic algorithms and the inability to ensure data integrity. Software control technology usually uses non-domestic cryptographic algorithms to encrypt and decrypt data. Non-domestic cryptographic algorithms have undiscovered or undisclosed security vulnerabilities, which make them vulnerable to attacks such as cryptanalysis and exhaustive attacks in actual use. Software control technology usually only provides encryption and decryption functions for data, but cannot provide protection for data integrity. During data transmission or storage, if the data is tampered with or damaged, software control technology cannot detect or prevent this from happening, which affects the reliability and security of the data.

[0017] (2) Poor usability: Software control-based technology encrypts and protects data by implementing encryption software in the application layer of the operating system. During encryption and decryption, confidential data needs to be operated in the software to achieve data encryption and decryption. Users cannot directly access data like operating ordinary files, and cannot achieve seamless operation of encrypted data, which brings a poor user experience. Summary of the invention

[0018] In view of the problems existing in the prior art, the present invention provides a one-way transfer method of data in a removable memory device supporting a domestic cryptographic algorithm.

[0019] The present invention is implemented in this way: a one-way transfer method of data in a removable memory supporting a domestic cryptographic algorithm comprises:

[0020] Step 1: The one-way transfer file system architecture consists of two modules, including a basic user-mode file system module and a data security module;

[0021] Step 2: The data security assurance method supporting domestic cryptographic algorithms consists of two modules: a key security enhancement module and a data encryption and integrity verification module;

[0022] Step 3, the key security enhancement module enhances the security of the password stored in the system by combining the password with the salt;

[0023] Step 4: The data encryption and decryption and integrity check module uses a domestic symmetric encryption algorithm to encrypt the data in groups, uses the encryption result of the previous data block as the initialization vector of the next data block, and generates a CRC check value for each data block.

[0024] Furthermore, the one-way transfer file system architecture and the user-mode file system design mode are implemented using all file system interfaces based on user-mode space.

[0025] Furthermore, the data security assurance method supporting domestic cryptographic algorithms is composed of a key security enhancement module and a data encryption and integrity verification module; the module for enhancing the key security level is responsible for ensuring the complexity and unpredictability of the key; the data encryption, decryption and integrity verification module uses a symmetric encryption algorithm to encrypt the data and store it in a removable storage device, supporting domestic cryptographic algorithms to realize ciphertext storage of data in mobile storage devices.

[0026] Furthermore, the password salting method of the key security enhancement module combines the account password of the data operator with the generated salt, and uses the HMAC operation to hash the password as the key and the salt as the data.

[0027] Furthermore, the data encryption / decryption and integrity verification module encrypts / decrypts and verifies the integrity of the data content, and uses the domestic symmetric encryption algorithm SM4 to encrypt the data in groups; first, the key security enhancement module generates an initial vector, processes and encrypts the first data block of the file data block, and then performs the same operation on subsequent data blocks; the encryption result of each data block is used as the initialization vector of the next data block, and a CRC check value is generated for each data block and stored in the encrypted data block; the decryption operation requires the use of the generated key and initialization vector to decrypt the data, and then performs a CRC integrity check and a cryptographic hash check; if the check passes, the password is correct; otherwise, access to the tampered data will be denied.

[0028] Another object of the present invention is to provide a removable memory data one-way transfer system supporting domestic cryptographic algorithms, comprising:

[0029] The basic user-mode file system module is used to adopt the user-mode file system design mode and implement the file system interface based on the user-mode space;

[0030] Data security assurance module, used to ensure data security;

[0031] The data security module includes:

[0032] A key security enhancement module for enhancing the security of passwords stored in the system by combining the passwords with salts;

[0033] The data encryption, decryption and integrity check module is used to encrypt data in groups using a domestic symmetric encryption algorithm, use the encryption result of the previous data block as the initialization vector of the next data block, and generate a CRC check value for each data block.

[0034] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for one-way transfer of data in a removable memory that supports a domestic cryptographic algorithm.

[0035] Another object of the present invention is to provide a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of the method for one-way transfer of data in a removable memory that supports a domestic cryptographic algorithm.

[0036] Another object of the present invention is to provide an information data processing terminal, which is used to implement the removable memory data one-way transfer system that supports domestic cryptographic algorithms.

[0037] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0038] First, the present invention proposes a one-way transfer method for removable storage data that supports domestic encryption algorithms, which reduces costs while enhancing practicality and security. The method constructs a one-way data transfer file system, deploys the file system in the sender and receiver computer devices, disables the sender's permission to open and delete files, and ensures that the data cannot be modified and deleted after being stored in the removable storage. In the receiver, the receiver's access rights are ensured by key identity authentication, and only visitors who pass the key authentication can normally read and write the data in the mobile storage. For the security problems existing in the software-based one-way transfer scheme of removable storage data, the present invention specifically proposes a data security guarantee method that supports domestic cryptographic algorithms, including a key security enhancement module, a data encryption and decryption and integrity verification module. Among them, the key security enhancement module enhances the security strength of the key generated by the hash algorithm by adding salt, and the data encryption and integrity verification module implements data encryption and decryption operations based on the domestic cryptographic algorithm to avoid the security risks of non-domestic passwords, and performs data integrity verification during decryption to reject tampered data content, and integrates the module in the one-way data transfer file system to achieve user-free operation of files.

[0039] Second, as auxiliary evidence of the inventiveness of the claims of the present invention, it is also reflected in the following important aspects:

[0040] (1) The expected benefits and commercial value of the technical solution of the present invention after transformation are:

[0041] The present invention adopts domestic cryptographic algorithms, avoids the potential security risks of using non-domestic cryptographic algorithms, improves the security and compliance of the system, enhances the security strength of the key by adding salt, further improves the security protection capability of the system, and performs integrity verification when decrypting data to prevent data from being tampered with, thereby ensuring the authenticity and integrity of the data. By constructing a data one-way transfer file system, it is ensured that the data cannot be modified or deleted after being stored in the removable memory, thereby ensuring the irreversibility and security of data transmission. The sender is prohibited from opening and deleting files, and the receiver controls access rights through key identity authentication to ensure that only legitimate users can access the data, thereby improving the controllability and security of the system. The software-based one-way transfer scheme of removable memory data reduces dependence on hardware, thereby reducing the overall cost of the system. The use of domestic algorithms reduces dependence on imported encryption algorithms and related technologies, thereby reducing technical costs and licensing fees.

[0042] The invention adopts domestic cryptographic algorithms in line with national network security policies, can gain the trust and support of the government and large enterprises, has stronger competitiveness in the domestic market, and provides an innovative and highly secure data transfer solution, which helps to gain differentiated advantages in the market. High security and data integrity guarantee improve customer trust and satisfaction, increase customer stickiness and loyalty, and the seamless operation experience of the data one-way transfer file system improves user convenience and enhances customer experience. This technical solution is particularly suitable for industries involving sensitive data transmission, such as finance, medical care, government, etc., and opens up new business markets and application scenarios. Based on this technical solution, related services for data protection and secure transmission can be provided, expanding business scope and increasing revenue sources.

[0043] Third, the technical solution of the present invention can be explained from the following aspects in terms of solving the existing technical problems and bringing about significant technical progress:

[0044] 1) Insufficient data security:

[0045] In the prior art, removable storage devices (such as USB flash drives, portable hard drives, etc.) often lack effective encryption measures during data transmission and storage, resulting in data being easily illegally accessed and tampered with.

[0046] The key management mechanism is imperfect and there is a risk of key leakage, which further exacerbates the hidden dangers of data security.

[0047] 2) Encryption algorithm relies on foreign technology:

[0048] Many existing systems use foreign encryption algorithms (such as AES, RSA, etc.), which are subject to export restrictions or security reviews in specific environments, which is not conducive to independent control and information security.

[0049] 3) Data transmission and storage efficiency issues:

[0050] While some encryption technologies ensure data security, they also affect the efficiency of data transmission and storage due to their high computational complexity.

[0051] 4) Imperfect one-way transfer mechanism:

[0052] The existing one-way transfer system lacks a complete data security mechanism, or its implementation method is not flexible enough to meet the needs of diverse application scenarios.

[0053] ###Significant technological advancements:

[0054] 1) Improve data security:

[0055] The present invention provides a high-intensity data encryption and integrity verification mechanism for removable storage devices by introducing domestic cryptographic algorithms (such as SM4, ZUC, SM3, etc.), effectively preventing the risks of data leakage and tampering.

[0056] The key security enhancement module significantly improves the complexity and unpredictability of keys and reduces the risk of key leakage by combining passwords, salt values, and elliptic curve cryptography algorithms.

[0057] 2) Realize independent and controllable technology:

[0058] By adopting domestic cryptographic algorithms, we have gotten rid of our dependence on foreign technology, achieved independent control of technology, and enhanced our information security protection capabilities.

[0059] 3) Optimize data transmission and storage efficiency:

[0060] By reasonably designing the implementation method of the encryption algorithm (such as using the encryption result of the previous data block as the initialization vector of the next data block), while ensuring security, the computational complexity is reduced as much as possible and the efficiency of data transmission and storage is improved.

[0061] 4) Enhance the flexibility and applicability of the one-way transfer mechanism:

[0062] The one-way transfer file system architecture and data security guarantee method of the present invention have high flexibility and scalability, can adapt to the needs of different application scenarios, and provide users with a more convenient and efficient data transfer solution.

[0063] 5) Improve user experience:

[0064] On the premise of ensuring data security, by optimizing system design and algorithm implementation, the complexity and difficulty of operation during user use are reduced, thereby improving the user experience.

[0065] In summary, the technical solution of the present invention not only solves the problems of the prior art, but also brings significant technical progress and practical application value. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 The present invention provides a flow chart of a one-way data transfer method for a removable storage device supporting a domestic cryptographic algorithm.

[0067] Figure 2 The present invention provides a structural block diagram of a removable storage device data one-way transfer system supporting domestic cryptographic algorithms provided by an embodiment of the present invention.

[0068] Figure 3 This is an abstract architecture diagram of a single-item transfer file system provided by an embodiment of the present invention.

[0069] Figure 4 It is a schematic diagram of a data one-way transfer file system provided by an embodiment of the present invention.

[0070] Figure 5 It is a schematic diagram of a data security assurance method supporting domestic cryptographic algorithms provided by an embodiment of the present invention.

[0071] Figure 6 It is a schematic diagram of a data encryption and decryption and integrity verification module provided by an embodiment of the present invention;

[0072] Figure 7 4 is a schematic diagram of a fuse according to an embodiment of the present invention. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0074] ###Example 1: USB flash drive data one-way transfer system based on SM4 algorithm

[0075] A government agency needs to securely transfer its sensitive data from an internal server to an external USB flash drive and requires the use of domestic cryptographic algorithms to ensure the security of data transmission and storage.

[0076] 1) One-way transfer file system architecture:

[0077] Basic user-mode file system module: Design and implement a file system interface based on user-mode space, which provides standard file operation functions such as opening, reading, writing, and closing files.

[0078] Data security module: integrated into the user-mode file system, responsible for the secure processing of data during transmission and storage.

[0079] 2) Data security assurance methods that support domestic cryptographic algorithms:

[0080] Key security enhancement module: The original key is expanded using the SM3 hash algorithm and combined with a randomly generated salt value to generate the final encryption key using the SM2 elliptic curve cryptography algorithm. This ensures the complexity and unpredictability of the key.

[0081] Data encryption and decryption and integrity check module: Use the domestic symmetric encryption algorithm SM4 to encrypt the data to be transferred. In the specific implementation, each data block is encrypted by the SM4 algorithm, and the result of the encryption of the previous data block is used as the initialization vector (IV) of the next data block. At the same time, a CRC check value is generated for each data block and stored together with the encrypted data to ensure the integrity of the data.

[0082] 3) Operation process:

[0083] When a user requests to transfer a file from the server to a USB flash drive, the system first generates a secure encryption key through the key security enhancement module.

[0084] Next, the data security module uses the SM4 algorithm and the generated key to encrypt the file data and generate a CRC check value.

[0085] The encrypted data and its CRC checksum are written to the USB flash drive through the basic user-mode file system module.

[0086] This embodiment successfully implements a one-way data transfer system based on a domestic cryptographic algorithm, ensuring the safe storage and transmission of data in a USB flash drive.

[0087] ###Example 2: One-way encryption transmission scheme for military portable hard disk data

[0088] A military unit needs to securely transfer tactical data from the command center to a portable hard drive on the front line, and requires the use of a highly secure domestic cryptographic algorithm to protect the data from unauthorized access.

[0089] 1) One-way transfer file system architecture:

[0090] Basic user-mode file system module: Customized development of a file system suitable for portable hard disks, providing fast and efficient file reading and writing capabilities.

[0091] Data security assurance module: integrated security strategies, including data encryption, integrity verification and access control, to ensure the security of data during transmission and storage.

[0092] 2) Data security assurance methods that support domestic cryptographic algorithms:

[0093] Key security enhancement module: It uses a key negotiation protocol based on the SM9 identification cryptographic system and combines specific parameters in the tactical environment to generate highly secure session keys. This key is not only highly complex, but also closely related to the specific session and difficult to predict.

[0094] Data encryption and decryption and integrity check module: Use the domestic symmetric encryption algorithm ZUC to encrypt tactical data. Similar to SM4, ZUC also supports block encryption, using the encryption result of the previous data block as the IV of the next data block. At the same time, an HMAC-SM3 message authentication code is generated for each data block as an integrity check value.

[0095] 3) Operation process:

[0096] Before data transmission begins, a secure key negotiation channel is established between the command center and the portable hard disk through the key security enhancement module to generate a session key.

[0097] Using the session key, the data security module performs ZUC encryption on the tactical data and calculates the HMAC-SM3 checksum.

[0098] The encrypted data and checksum are written to the portable hard disk through the basic user-mode file system module.

[0099] This embodiment provides an efficient and secure one-way data encryption transmission solution for military portable hard disks, ensuring the high security of tactical data during transmission and storage.

[0100] like Figure 1 As shown, a method for unidirectionally transferring data in a removable storage device supporting a domestic cryptographic algorithm provided by an embodiment of the present invention includes the following steps:

[0101] S101, the one-way transfer file system architecture is composed of two modules including a basic user-mode file system module and a data security module;

[0102] S102, the data security assurance method supporting the domestic cryptographic algorithm is composed of two modules, namely a key security enhancement module and a data encryption and integrity verification module;

[0103] S103, the key security enhancement module enhances the security of the password stored in the system by combining the password with the salt;

[0104] S104, the data encryption and decryption and integrity check module uses a domestic symmetric encryption algorithm to encrypt the data in groups, uses the encryption result of the previous data block as the initialization vector of the next data block, and generates a CRC check value for each data block.

[0105] The one-way transfer file system architecture provided by the embodiment of the present invention and the user-mode file system design mode are implemented by using all file system interfaces based on the user-mode space.

[0106] The data security assurance method supporting domestic cryptographic algorithms provided in an embodiment of the present invention is composed of a key security enhancement module and a data encryption and integrity verification module; the module for enhancing the key security level is responsible for ensuring the complexity and unpredictability of the key; the data encryption, decryption and integrity verification module uses a symmetric encryption algorithm to encrypt the data and then stores it in a removable storage device, supporting domestic cryptographic algorithms to realize ciphertext storage of data in mobile storage devices.

[0107] The password salting method of the key security enhancement module provided in the embodiment of the present invention combines the account password of the data operator with the generated salt, and uses the HMAC operation to hash the password as the key and the salt as the data.

[0108] The data encryption, decryption and integrity verification module provided by the embodiment of the present invention performs encryption, decryption and integrity verification on data content, and uses the domestic symmetric encryption algorithm SM4 to perform group encryption on data; first, the key security enhancement module generates an initial vector, processes and encrypts the first data block of the file data block, and then performs the same operation on the subsequent data blocks; the encryption result of each data block is used as the initialization vector of the next data block, and a CRC check value is generated for each data block and stored in the encrypted data block; the decryption operation needs to use the generated key and initialization vector to decrypt the data, and then perform CRC integrity check and cryptographic hash check; if the check passes, the password is correct; otherwise, access to the tampered data will be denied.

[0109] like Figure 2 As shown, a removable storage data unidirectional transfer system supporting a domestic cryptographic algorithm provided by an embodiment of the present invention includes:

[0110] The basic user-mode file system module is used to adopt the user-mode file system design mode and implement the file system interface based on the user-mode space;

[0111] Data security assurance module, used to ensure data security;

[0112] The data security module includes:

[0113] A key security enhancement module for enhancing the security of passwords stored in the system by combining the passwords with salts;

[0114] The data encryption, decryption and integrity check module is used to encrypt data in groups using a domestic symmetric encryption algorithm, use the encryption result of the previous data block as the initialization vector of the next data block, and generate a CRC check value for each data block.

[0115] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for one-way transfer of data in a removable memory that supports a domestic cryptographic algorithm.

[0116] Another object of the present invention is to provide a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of the method for one-way transfer of data in a removable memory that supports a domestic cryptographic algorithm.

[0117] Another object of the present invention is to provide an information data processing terminal, which is used to implement the removable memory data one-way transfer system that supports domestic cryptographic algorithms.

[0118] The present invention is specifically implemented:

[0119] The method for unidirectionally transferring data in a removable storage device supporting a domestic cryptographic algorithm provided in an embodiment of the present invention comprises the following steps:

[0120] (1) File system architecture for one-way data transfer

[0121] As attached Figure 3 As shown, a data one-way transfer file system architecture is constructed, including a basic user-state file system module and a data security module. In order to adapt to the differences in different operating system kernels, the basic user-state file system adopts the user-state file (FUSE, Filesystem in Userspace) system design mode, and implements the file system interface (such as opening, reading, writing, closing files, etc.) based on the user-state space. FUSE (Filesystem in Userspace) is a unified file system interface standard. It establishes a communication bridge through the FUSE driver, so that the file system operation request and processing results can communicate between the kernel space and the user space, thereby realizing the writing and operation of the file system in the user state and avoiding the modification of the operating system kernel.

[0122] When the removable storage device performs an operation on the mounted file system, the virtual file system routes the operation to the user-mode file system kernel driver. The driver allocates a user-mode file system request structure and puts it into the corresponding queue. Meanwhile, the process submitting the operation will be in a waiting state. The file system user-level daemon then picks up the request from the kernel queue by reading the corresponding device and processes the request. Depending on the type of request, it decides whether to reenter the kernel. After the request is processed, the user-mode file system daemon writes the response back to the corresponding device. The user-mode file system kernel driver then marks the request as completed and wakes up the original user process.

[0123] As attached Figure 4 As shown, by implementing different file system interfaces, the data unidirectional transfer file system can be divided into a data unidirectional sending file system and a data unidirectional receiving file system. The data unidirectional sending file system implements the interface for copying files to mobile storage devices, shields the file operation interfaces including opening, closing, reading, writing and deleting, and ensures that data only flows in one direction from the mobile storage medium in the sending direction. Mobile storage device visitors can transfer data to mobile storage devices after identity authentication, and the transferred files are encrypted and stored in the mobile storage medium. The data unidirectional receiving file system implements the file security operation space, shields the data copy interface from the mobile storage medium to the outside of the security operation space, ensures that data is only operated in the security operation space, and can perform file operations after the visitor is authenticated in the security operation space. Before the operation, the data is decrypted and integrity checked to reject tampered data and ensure that the visitor does not feel the reading and writing of encrypted files.

[0124] (2) Data security assurance methods that support domestic cryptographic algorithms

[0125] As attached Figure 5 As shown in the figure, the data security assurance method supporting domestic cryptographic algorithms consists of two modules, namely the key security enhancement module and the data encryption and integrity verification module. The key security enhancement module is responsible for enhancing the security level of the key, ensuring the complexity and unpredictability of the key, and storing and verifying the key to ensure that the data is accessed within the access rights. The data encryption, decryption and integrity verification module encrypts and protects the data, encrypts the data through a symmetric encryption algorithm and stores it in a removable storage device, and supports domestic cryptographic algorithms to realize the ciphertext storage of data in a removable storage device.

[0126] (3) Enhanced key security

[0127] When the sender copies the file to the mount directory of the removable storage device, the key security enhancement module will generate a random salt with a length of 128 bits, and then combine the account password of the data operator with the generated salt, using the password as the key and the salt as the data to perform an HMAC (Hash-based Message Authentication Code) operation. After the HMAC operation, two 128-bit HMAC values ​​are obtained, one as the key for symmetric encryption of the data, and the other as the initialization variable for data encryption. The salt value is stored in the database of the removable storage device. When the receiver accesses the data, the password entered by the visitor is accepted, and the HMAC value is recalculated together with the stored salt value to decrypt the file. The HMAC operation provides an additional security layer for password hashing. Even if the attacker obtains the hash value in the database, it cannot use a rainbow table or other pre-calculated hash values ​​to crack the password without the original password.

[0128] (4) Data encryption and decryption and integrity verification

[0129] The data encryption and decryption and integrity verification module encrypts and decrypts the data content and verifies its integrity. Figure 6 As shown, the data encryption and decryption module uses the domestic symmetric encryption algorithm SM4 to encrypt the data in groups, with 16 bytes per group. The initial vector generated by the key security enhancement module is used to process and encrypt the first data block of the file data block, and then the same operation is performed on the subsequent data blocks. The encryption result of the previous data block is used as the initialization vector of the next data block, and a CRC check value is generated for each data block and stored in the encrypted data block. The decryption operation is the inverse operation of the encryption operation. First, the password of the data accessor is obtained, and together with the stored salt value, the encryption key and encryption initialization vector are generated. After the data is decrypted according to the generated key and initialization vector, the CRC integrity check and password hash check are performed. If the check passes, the password is correct, and if it fails, the tampered data is rejected.

[0130] The current software-based control technology encrypts and protects data by implementing encryption software at the application layer of the operating system. During the encryption and decryption process, confidential data needs to be operated in the software, resulting in the inability to achieve seamless operation of encrypted data, which brings a poor user experience.

[0131] The present invention constructs a data one-way transfer file system architecture, including a basic user-mode file system module and a data security protection module; a key security enhancement module utilizes a method of combining passwords with salts to enhance the security of passwords stored in the system; a data encryption and decryption and integrity verification module encrypts and decrypts data content and verifies integrity, and uses a domestic symmetric encryption algorithm to encrypt data in groups, thereby solving the problem of poor availability of a data one-way transfer solution implemented by a software-based removable storage device management and control technology.

[0132] In the process of data collection and management by government departments such as a municipal audit bureau and a provincial audit office, a large amount of information closely related to citizens' privacy is involved (such as identity information, social security data, etc.). The one-way transfer method of the present invention can effectively encrypt these sensitive data through domestic cryptographic algorithms, upload file operation information and operation records to a centrally managed data platform, and manage local unauthorized removable storage devices to reduce the risk of information leakage and meet the government's legal requirements for data protection. This method improves the credibility of government data security management and enhances public trust.

[0133] The fuse principle diagram of the embodiment of the present invention is as follows: Figure 7 As shown in the figure, the detailed steps of FUSE (taking the write operation as an example):

[0134] The user application calls the write() or pwrite() function to request data to be written. The request enters the kernel and passes through the VFS (virtual file system) layer. The VFS identifies the type of file system and forwards the request to the corresponding file system implementation. For the FUSE file system, the VFS sends the request to the FUSE kernel module, which is responsible for handling the FUSE protocol. This process involves switching between kernel mode and user mode. The FUSE kernel module forwards the request to the FUSE daemon in user space through IPC (inter-process communication). At this time, the kernel mode and user mode are switched again. The FUSE daemon receives the request and calls the user-defined write function, usually with parameters such as file path, data buffer, write length and file offset. Users can perform complex operations here, such as encryption, logging, data processing, etc. Users can perform post-write updates to the file's metadata, such as modification time, size, etc., which is usually implemented through the fuse_setattr function. After the user-defined write function completes the write, it returns the number of bytes successfully written or an error code. FUSE blocks and returns the result to the kernel module, which then returns the result to the VFS and finally to the user application.

[0135] Data encryption and decryption:

[0136] SM4 uses a 128-bit key (16 bytes) for encryption. The key is first generated through a key expansion algorithm to generate a total of 32 subkeys (K0 to K31), each subkey is 128 bits long. The data to be encrypted is divided into 128-bit (16-byte) blocks. If the data length is not a multiple of 128 bits, padding is required. Round Function: SM4 uses a 32-round Feistel structure, and each round uses a subkey. The encryption process of each round includes several steps: first, the data block is nonlinearly transformed (S-box replacement), then linearly transformed (linear transformation includes a matrix transformation and XOR operation), and finally, XOR processing is performed using the symmetric key.

[0137] The decryption process also uses a 32-round Feistel structure, with the subkeys used in each round being in the reverse order of encryption (K31 to K0). Each round also performs S-box replacement, linear transformation, and XOR operations. The initial ciphertext block is processed by 32 rounds of inverse round functions to obtain the plaintext data.

[0138] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0139] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A method for unidirectionally transferring data in a removable storage device supporting a domestic cryptographic algorithm, characterized in that: The following steps are involved: Step 1: The one-way transfer file system architecture consists of two modules, including a basic user-mode file system module and a data security module; Step 2: The data security assurance method supporting domestic cryptographic algorithms consists of two modules: a key security enhancement module and a data encryption and integrity verification module; Step 3, the key security enhancement module enhances the security of the password stored in the system by combining the password with the salt; Step 4: The data encryption and decryption and integrity check module uses a domestic symmetric encryption algorithm to encrypt the data in groups, uses the encryption result of the previous data block as the initialization vector of the next data block, and generates a CRC check value for each data block.

2. The method for unidirectionally transferring data in a removable storage device supporting a domestic cryptographic algorithm as claimed in claim 1, characterized in that: The one-way transfer file system architecture and the user-mode file system design mode are implemented using all file system interfaces based on user-mode space.

3. The method for unidirectionally transferring data in a removable storage device supporting a domestic cryptographic algorithm as claimed in claim 1, characterized in that: The data security assurance method supporting domestic cryptographic algorithms is composed of a key security enhancement module and a data encryption and integrity verification module; the module for enhancing the key security level is responsible for ensuring the complexity and unpredictability of the key; the data encryption, decryption and integrity verification module uses a symmetric encryption algorithm to encrypt the data and store it in a removable storage device, supporting domestic cryptographic algorithms to realize ciphertext storage of data in mobile storage devices.

4. The method for unidirectionally transferring data in a removable storage device supporting a domestic cryptographic algorithm as claimed in claim 1, characterized in that: The password salting method of the key security enhancement module combines the account password of the data operator with the generated salt, and uses the HMAC operation to hash the password as the key and the salt as the data.

5. The method for unidirectionally transferring data in a removable storage device supporting a domestic cryptographic algorithm as claimed in claim 1, characterized in that: The data encryption and decryption and integrity verification module encrypts and decrypts the data content and verifies the integrity, and uses the domestic symmetric encryption algorithm SM4 to encrypt the data in groups; first, the key security enhancement module generates an initial vector, processes and encrypts the first data block of the file data block, and then performs the same operation on the subsequent data blocks; the encryption result of each data block is used as the initialization vector of the next data block, and a CRC check value is generated for each data block and stored in the encrypted data block; The decryption operation requires using the generated key and initialization vector to decrypt the data, and then perform CRC integrity check and cryptographic hash check; If the verification passes, the password is correct; otherwise, access to the tampered data will be denied.

6. A removable storage device data unidirectional transfer system supporting domestic cryptographic algorithms that implements the removable storage device data unidirectional transfer method supporting domestic cryptographic algorithms as claimed in any one of claims 1 to 5, characterized in that: The removable memory data one-way transfer system supporting the domestic cryptographic algorithm comprises: The basic user-mode file system module is used to adopt the user-mode file system design mode and implement the file system interface based on the user-mode space; Data security assurance module, used to ensure data security; The data security module includes: A key security enhancement module for enhancing the security of passwords stored in the system by combining the passwords with salts; The data encryption, decryption and integrity check module is used to encrypt data in groups using a domestic symmetric encryption algorithm, use the encryption result of the previous data block as the initialization vector of the next data block, and generate a CRC check value for each data block.

7. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for one-way transfer of data in a removable memory supporting a domestic cryptographic algorithm as described in any one of claims 1-5.

8. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the method for one-way data transfer of a removable memory device supporting a domestic cryptographic algorithm as described in any one of claims 1 to 5.

9. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the removable memory data one-way transfer system supporting the domestic cryptographic algorithm as described in claim 6.

Images