Bare metal cloud hard disk data encryption device, method and equipment based on national cryptographic algorithm and medium

Abstract

The invention discloses a bare metal cloud hard disk data encryption device and method based on a national cryptographic algorithm, equipment and a medium, and relates to the technical field of cloud computing, and the device comprises a block storage management module which is used for receiving a bare metal cloud hard disk data encryption request, and generating an encryption volume creation demand according to analyzed encryption demand information; the key management module is used for triggering an encryption algorithm selection operation, and creating and managing a target key and a target key ID corresponding to an encryption volume creation demand based on a target national cryptographic algorithm; the block storage management module is used for acquiring target key information containing a target key ID, and creating and verifying a target encrypted cloud hard disk based on the target key information; the storage encryption module is used for creating and storing target mirror image information corresponding to the to-be-encrypted hard disk data in the bare metal cloud hard disk data encryption request based on the verification result; and the bare metal product module is used for generating a bare metal instance according to the bare metal cloud hard disk data encryption request and mounting the bare metal instance to complete encryption of bare metal hard disk data.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a bare metal cloud hard disk data encryption device, method, equipment and medium based on a national secret algorithm. Background Art

[0002] At present, new technologies and applications are constantly accelerating the digital transformation of traditional industries, resulting in a massive increase in data. The amount of data that enterprises need to store and manage is increasing, including sensitive and critical information. The demand for data protection is increasing, and enterprises need to encrypt the storage and transmission of sensitive data to prevent data leakage, ensure the integrity, confidentiality and availability of data, and prevent data leakage, tampering or loss.

[0003] At present, the underlying implementation technologies of cloud hard disks include centralized storage and distributed storage. For centralized storage, based on a unified controller, data can be easily encrypted on the server side (service end), but the key is stored in the centralized storage of the cloud vendor. Therefore, the cloud hard disk encryption function is transparent to the cloud service provider, and there are certain security risks. For distributed storage, cloud hard disk encryption is mainly based on the device mapping mechanism. The most widely used is Linux's LUKS (Linux Unified Key Setup) encryption technology. The general process is to mount the cloud hard disk on the bare metal through the device mapping of the smart network card, and transparently transmit the encrypted mapping device to the bare metal.

[0004] Bare metal servers are a type of cloud computing service that provides direct access to physical servers without a virtualization layer. The main advantages of bare metal servers are their high performance and low latency, which makes them ideal for applications that require high-performance computing or low-latency networks. However, bare metal servers also face some challenges, one of which is how to expand the storage space of physical servers and the security and manageability of storage. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a bare metal cloud hard disk data encryption device, method, equipment and medium based on the national secret algorithm, which can ensure the storage security and manageability of data in the bare metal hard disk. The specific scheme is as follows:

[0006] In the first aspect, the present application discloses a bare metal cloud hard disk data encryption device based on a national secret algorithm, including: a block storage management module, a key management module, a storage encryption module, and a bare metal product module, wherein:

[0007] The block storage management module is used to receive a bare metal cloud hard disk data encryption request sent by the client through a first data transmission channel connected to the client, parse the bare metal cloud hard disk data encryption request to obtain encryption requirement information, and generate a corresponding encrypted volume creation requirement according to the encryption requirement information;

[0008] The key management module is used to obtain the encrypted volume creation requirement through the key creation interface connected to the block storage management module, trigger the encryption algorithm selection operation to determine the target national encryption algorithm, and create and manage the target key and target key ID corresponding to the encrypted volume creation requirement based on the target national encryption algorithm;

[0009] The block storage management module is used to obtain the target key information including the target key ID through the key query interface of the key management module, to define the encrypted volume type based on the target key information, and to create and verify the target encrypted cloud hard disk based on the encrypted volume type, and then send the target key information to the storage encryption module through the second data transmission channel connected to the storage encryption module;

[0010] The storage encryption module is used to create target image information corresponding to the hard disk data to be encrypted in the bare metal cloud hard disk data encryption request based on the verification result of the key attribute in the target key information, and store the target image information in the target encrypted cloud hard disk;

[0011] The bare metal product module is used to generate a corresponding bare metal instance according to the bare metal cloud hard disk data encryption request, and perform a distributed mounting operation on the target encrypted cloud hard disk to the bare metal instance to complete the encryption of the bare metal hard disk data.

[0012] Optionally, the key management module includes:

[0013] The key creation unit is used to select a target national encryption algorithm through a pre-written multi-national encryption algorithm integration plug-in, so as to create a target key and a target key ID corresponding to the encrypted volume creation requirement based on the target national encryption algorithm.

[0014] Optionally, the block storage management module includes:

[0015] An encrypted volume type definition unit, used to define an encrypted volume type according to the encryption type corresponding to the target national encryption algorithm, the target key ID and the key query interface URL;

[0016] An encrypted cloud hard disk creation unit, configured to create a target encrypted cloud hard disk in the cloud hard disk management of the block storage management module based on the encrypted volume type;

[0017] The encrypted cloud hard disk verification unit is used to obtain the encryption key according to the target key ID corresponding to the encrypted volume type and the key query interface URL, and determine that the target encrypted cloud hard disk corresponding to the successful acquisition of the encryption key has passed the verification.

[0018] Optionally, the bare metal cloud hard disk data encryption device based on the national encryption algorithm further includes:

[0019] The data processing module is used to perform data alignment processing on the hard disk data in the bare metal cloud hard disk data encryption request to synthesize the hard disk data to be encrypted.

[0020] Optionally, the storage encryption module includes:

[0021] An interface modification unit, used to modify a block device creation interface in a Ceph block device library to add current attribute information in the current block device creation interface to obtain an updated block device creation interface;

[0022] The interface verification unit is used to verify the interface attributes of the updated block device creation interface based on the key attributes in the target key information. If the verification passes, the target image information corresponding to the hard disk data to be encrypted in the bare metal cloud hard disk data encryption request is created.

[0023] Optionally, the bare metal product module includes:

[0024] The instance generation unit is used to select a target smart network card model according to the bare metal cloud hard disk data encryption request, create a bare metal instance according to the target smart network card model, and record the bare metal instance through a preset instance identifier.

[0025] Optionally, the bare metal product module includes:

[0026] The unloading unit is used to unload the target encrypted cloud hard disk located in the bare metal instance through a preset unloading instruction when an unloading request for unloading the target encrypted cloud hard disk is detected.

[0027] In the second aspect, the present application discloses a bare metal cloud hard disk data encryption method based on a national secret algorithm, including:

[0028] Receiving a bare metal cloud hard disk data encryption request sent by the client through a first data transmission channel connected to the client, parsing the bare metal cloud hard disk data encryption request to obtain encryption requirement information, and generating a corresponding encrypted volume creation requirement according to the encryption requirement information;

[0029] Obtain the encrypted volume creation requirement through the key creation interface, trigger the encryption algorithm selection operation to determine the target national encryption algorithm, and create and manage the target key and target key ID corresponding to the encrypted volume creation requirement based on the target national encryption algorithm;

[0030] Obtain target key information including the target key ID through the key query interface, define an encrypted volume type based on the target key information, and create and verify a target encrypted cloud hard disk based on the encrypted volume type;

[0031] Acquire the target key information through the second data transmission channel, create target image information corresponding to the hard disk data to be encrypted in the bare metal cloud hard disk data encryption request based on the verification result of the key attribute in the target key information, and store the target image information in the target encrypted cloud hard disk;

[0032] A corresponding bare metal instance is generated according to the bare metal cloud hard disk data encryption request, and a distributed mounting operation of mounting the target encrypted cloud hard disk to the bare metal instance is performed to complete the encryption of the bare metal hard disk data.

[0033] In a third aspect, the present application discloses an electronic device, comprising:

[0034] Memory, used to store computer programs;

[0035] The processor is used to execute the computer program to implement the steps of the aforementioned bare metal cloud hard disk data encryption method based on the national encryption algorithm.

[0036] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the aforementioned bare metal cloud hard disk data encryption method based on the national encryption algorithm are implemented.

[0037] It can be seen that the present application provides a bare metal cloud hard disk data encryption device based on the national secret algorithm, including: a block storage management module, a key management module, a storage encryption module, and a bare metal product module, wherein the block storage management module is used to receive a bare metal cloud hard disk data encryption request sent by the client through a first data transmission channel connected to the client, and parse the bare metal cloud hard disk data encryption request to obtain encryption requirement information, and generate a corresponding encrypted volume creation requirement according to the encryption requirement information; the key management module is used to obtain the encrypted volume creation requirement through a key creation interface connected to the block storage management module, trigger an encryption algorithm selection operation to determine a target national secret algorithm, and create and manage a target key and target key ID corresponding to the encrypted volume creation requirement based on the target national secret algorithm; the block storage management module is used to obtain the encrypted volume creation requirement through the key creation interface connected to the block storage management module, trigger an encryption algorithm selection operation to determine a target national secret algorithm, and create and manage a target key and target key ID corresponding to the encrypted volume creation requirement based on the target national secret algorithm; The key query interface of the management module obtains the target key information containing the target key ID, so as to define the encryption volume type based on the target key information, and create and verify the target encrypted cloud hard disk based on the encryption volume type, and then send the target key information to the storage encryption module through the second data transmission channel connected to the storage encryption module; the storage encryption module is used to create the target image information corresponding to the hard disk data to be encrypted in the bare metal cloud hard disk data encryption request based on the verification result of the key attribute in the target key information, and store the target image information in the target encrypted cloud hard disk; the bare metal product module is used to generate the corresponding bare metal instance according to the bare metal cloud hard disk data encryption request, and perform the distributed mounting operation of mounting the target encrypted cloud hard disk to the bare metal instance to complete the encryption of the bare metal hard disk data. It can be seen that by combining the bare metal server and the application of the national encryption algorithm in data storage security, the function of using the national encryption of the bare metal cloud hard disk can be realized, effectively protecting the security of user data during transmission and storage, ensuring that the data is not easily stolen and decrypted, improving the security and controllability of the data, and meeting the user's needs for data security. Using national secret algorithms for encryption can avoid the risks of relying on imported technology and improve the independent controllability of information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0039] Figure 1 This is a schematic diagram of the structure of a bare metal cloud hard disk data encryption device based on a national secret algorithm disclosed in this application;

[0040] Figure 2 This is a data encryption and writing flow chart of a bare metal cloud hard disk based on a national encryption algorithm disclosed in this application;

[0041] Figure 3 This is a flowchart of reading data after data encryption of a bare metal cloud hard disk based on a national encryption algorithm disclosed in this application;

[0042] Figure 4 This is a flow chart of a bare metal cloud hard disk data encryption method based on a national encryption algorithm disclosed in this application;

[0043] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0045] At present, new technologies and applications are constantly accelerating the digital transformation of traditional industries, resulting in a massive increase in data. The amount of data that enterprises need to store and manage is increasing, including sensitive and critical information. The demand for data protection is increasing, and enterprises need to encrypt the storage and transmission of sensitive data to prevent data leakage, ensure the integrity, confidentiality and availability of data, and prevent data leakage, tampering or loss.

[0046] At present, the underlying implementation technologies of cloud hard disks include centralized storage and distributed storage. For centralized storage, based on a unified controller, data can be easily encrypted on the server side, but the key is stored in the centralized storage of the cloud vendor. Therefore, the cloud hard disk encryption function is transparent to the cloud service provider, which has certain security risks. For distributed storage, cloud hard disk encryption is mainly based on the device mapping mechanism. The most widely used is Linux's LUKS encryption technology. The general process is to mount the cloud hard disk on the bare metal through the device mapping of the smart network card, and transparently transmit the encrypted mapped device to the bare metal.

[0047] Bare metal servers are a type of cloud computing service that provides direct access to physical servers without a virtualization layer. The main advantages of bare metal servers are their high performance and low latency, which makes them ideal for applications that require high-performance computing or low-latency networks. However, bare metal servers also face some challenges, one of which is how to expand the storage space of physical servers and the security and manageability of storage.

[0048] To this end, the present invention provides a bare metal cloud hard disk data encryption solution based on a national secret algorithm, which can ensure the storage security and manageability of data in the bare metal hard disk.

[0049] Reference Figure 1 As shown, the embodiment of the present invention discloses a bare metal cloud hard disk data encryption device based on a national secret algorithm, including: a block storage management module 11, a key management module 12, a storage encryption module 13, and a bare metal product module 14, wherein:

[0050] The block storage management module 11 is used to receive a bare metal cloud hard disk data encryption request sent by the client through a first data transmission channel connected to the client, parse the bare metal cloud hard disk data encryption request to obtain encryption requirement information, and generate a corresponding encrypted volume creation requirement according to the encryption requirement information;

[0051] The key management module 12 is used to obtain the encrypted volume creation requirement through the key creation interface connected to the block storage management module 11, trigger the encryption algorithm selection operation to determine the target national encryption algorithm, and create and manage the target key and target key ID corresponding to the encrypted volume creation requirement based on the target national encryption algorithm;

[0052] The block storage management module 11 is used to obtain the target key information including the target key ID through the key query interface of the key management module 12, to define the encrypted volume type based on the target key information, and to create and verify the target encrypted cloud hard disk based on the encrypted volume type, and then send the target key information to the storage encryption module 13 through the second data transmission channel connected to the storage encryption module 13;

[0053] The storage encryption module 13 is used to create target image information corresponding to the hard disk data to be encrypted in the bare metal cloud hard disk data encryption request based on the verification result of the key attribute in the target key information, and store the target image information in the target encrypted cloud hard disk;

[0054] The bare metal product module 14 is used to generate a corresponding bare metal instance according to the bare metal cloud hard disk data encryption request, and perform a distributed mounting operation on the target encrypted cloud hard disk to the bare metal instance to complete the encryption of the bare metal hard disk data.

[0055] It can be understood that the cloud computing platform adopts OpenStack ironic (bare metal service component in the OpenStack project) for bare metal management, uses Cinder Volume (block storage service component Cinder in OpenStack) for virtual block storage management, and Ceph (storage system) for underlying data storage. The device includes modules such as key management module 12, block storage management module 11, bare metal product module 13, storage encryption module 13, etc. The key management module 12 implements the management of various key algorithms, and the creation and management of national secret keys can be realized through this module; the block storage management module 11 is connected to the storage encryption module 13 to realize the management of encrypted cloud hard disk devices and the reading and writing of data; the bare metal product module 14 realizes the creation of bare metal instances, and realizes the mounting, unmounting and data reading and writing of block storage based on the block storage management capabilities; the storage encryption module 13 supports data encryption writing and decryption reading functions on the client by modifying the Ceph librbd library (the client library used to operate block devices (Rados BlockDevice, RBD) in the Ceph distributed storage system); an encrypted cloud hard disk is created according to the national secret encryption algorithm selected by the user, and the encrypted storage of bare metal cloud hard disk data is realized, thereby improving the security of user data.

[0056] The key management module 12 includes:

[0057] The key creation unit 121 is used to select a target national encryption algorithm through a pre-written multi-national encryption algorithm integration plug-in, so as to create a target key and a target key ID corresponding to the encrypted volume creation requirement based on the target national encryption algorithm.

[0058] It is understandable that the key management module 12 provides users with a visual key management interface to achieve the creation, acquisition, update and deletion of the national secret algorithm. The present invention is based on the OpenStack barbican capability, and mainly has two core functions: support for the national secret algorithm and key management. For the support of the national secret algorithm, according to the requirements of the Barbican plug-in, a plug-in for the national secret algorithm is written based on plugin.interface.secret_store.SecretStoreBase, and integrated into barbican to achieve support for the national secret algorithm, so that the national secret algorithm can be used in barbican to encrypt, decrypt or sign data. Key management implements the creation, query, enable / disable, and deletion of national secret keys. After the key is created or imported, it is hosted in barbican. Barbican encrypts the key according to its own unique algorithm and then stores it in the database. No one, including the administrator, can view the key plaintext. The key management module 12 exposes the key creation interface, key query interface, online encryption interface, online decryption interface, etc. Specifically, the key creation unit 121 selects a target national secret algorithm from an integrated plug-in that integrates multiple national secret algorithms, such as the SM4 (block symmetric encryption algorithm) national secret algorithm. The SM4 national secret algorithm is used to create a target key and a corresponding target key ID corresponding to the encrypted volume creation requirement sent by the block storage management module, so that other modules can query key information related to the target key according to the target key ID.

[0059] The block storage management module 11 includes:

[0060] The encrypted volume type definition unit 111 is used to define the encrypted volume type according to the encryption type corresponding to the target national encryption algorithm, the target key ID and the key query interface URL;

[0061] An encrypted cloud hard disk creation unit 112, configured to create a target encrypted cloud hard disk in the cloud hard disk management of the block storage management module based on the encrypted volume type;

[0062] The encrypted cloud hard disk verification unit 113 is used to obtain the encryption key according to the target key ID corresponding to the encrypted volume type and the key query interface URL, and determine that the target encrypted cloud hard disk corresponding to the successful acquisition of the encryption key has passed the verification.

[0063] It is understandable that the block storage management module 11 provides users with an interface for cloud hard disk management. Based on this module, users can implement operations such as creation, expansion, mounting, and unmounting of cloud hard disks. Based on the Openstack Cinder service docking storage encryption module, the custom encrypted volume type creation function can be realized. The encrypted volume type includes encryption type, master key, key url (Uniform Resource Locator) and other attributes. 1) Volume type stores key-related attributes; 2) When creating an encrypted volume based on the volume type and the backend is rbd, the key information is passed to librbd. Specifically, the creation of an encrypted cloud hard disk is realized through the block storage management module 11.

[0064] 1) The encrypted volume type definition unit 111 creates an encrypted volume type (volume-type): adds an encrypted volume type to the volume type in the block storage management module 11. The encrypted volume type includes attributes such as encryption type (encry-type), master key (master-key), key url (key-url), etc. The master key is the target key ID generated by the key management module 12, and the key url is the interface url for obtaining the encryption key according to the master key.

[0065] 2) The encrypted cloud hard disk creation unit 112 creates an encrypted volume of the encrypted volume type: creates an encrypted volume, ie, a target encrypted cloud hard disk, in the cloud hard disk management of the block storage management module 11, mainly to obtain the properties of the corresponding encrypted volume type.

[0066] 3) The encrypted cloud disk verification unit 113 verifies the key attributes. It needs to obtain an encryption key (target key) based on the master key and the key URL. If the acquisition is successful, the verification is passed. If the acquisition fails, the verification fails. If the verification fails, it returns that the encrypted cloud disk creation failed; if the verification passes, the rbd backend is called to continue to create the encrypted image.

[0067] The bare metal cloud hard disk data encryption device based on the national secret algorithm also includes:

[0068] The data processing module is used to perform data alignment processing on the hard disk data in the bare metal cloud hard disk data encryption request to synthesize the hard disk data to be encrypted.

[0069] The storage encryption module 13 includes:

[0070] The interface modification unit 131 is used to modify the block device creation interface in the Ceph block device library to add current attribute information in the current block device creation interface to obtain an updated block device creation interface;

[0071] The interface verification unit 132 is used to verify the interface attributes of the updated block device creation interface based on the key attributes in the target key information. If the verification passes, the target image information corresponding to the hard disk data to be encrypted in the bare metal cloud hard disk data encryption request is created.

[0072] It can be understood that, further, the storage encryption module 13 is used to create an encrypted image. Specifically, the interface modification unit 131 is used to modify the rbd_create interface in the Ceph librbd library, and add three attributes: encryption type (encry-type), master key (master-key) and key url (key-url). The interface verification unit 132 is used to verify the key attribute. If the verification fails, the creation failure is returned; if the verification succeeds, the image is continued to be created, and finally the encryption attribute is stored in the omap of the image rbd_header object. The Cinder volume service uses the rbd_create interface with the added function of creating an encrypted image.

[0073] In this way, the storage encryption module 13 supports data encryption and decryption writing and reading functions on the client by modifying the Ceph librbd library, thereby realizing encrypted reading and writing of distributed storage cloud hard disks. The steps are as follows:

[0074] 1) Create an encrypted image and store the key-related attributes in the omap of the rbd header object;

[0075] 2) When opening the image, the encryption type is loaded, and according to the encryption type, the encryption key is obtained by communicating with the key server network;

[0076] 3) When the client writes data, the data is aligned and encrypted, and then the ciphertext is sent to OSD (Object Storage Device) for storage;

[0077] 4) When the client reads data, it reads the ciphertext stored in the OSD, decrypts it and returns it to the client;

[0078] 5) Encrypted mirror rbd mirror off-site encrypted backup;

[0079] 6) Decrypt the encrypted image into a non-encrypted image;

[0080] 7) Encrypt and store the non-encrypted image.

[0081] The bare metal product module 14 includes:

[0082] The instance generation unit 141 is used to select a target smart network card model according to the bare metal cloud hard disk data encryption request, create a bare metal instance according to the target smart network card model, and record the bare metal instance through a preset instance identifier.

[0083] The bare metal product module 14 includes:

[0084] The uninstallation unit 142 is configured to uninstall the target encrypted cloud hard disk in the bare metal instance through a preset uninstallation instruction when an uninstallation request for uninstalling the target encrypted cloud hard disk is detected.

[0085] It is understandable that the bare metal product management module 14 can automatically install the operating system, initialize the network and other operations according to the user's image, network, storage and other requirements, provide bare metal instances on the cloud, and provide excellent computing performance and data security for core databases, key application systems, high-performance computing, big data and other businesses. Based on the capabilities of the bare metal smart network card, it is possible to mount a distributed storage cloud hard disk to expand the storage space of the bare metal and meet the user's large-capacity storage needs. You can also choose to mount a cloud hard disk that supports encryption to achieve encryption of data reading and writing.

[0086] The bare metal product management module 14 implements the creation of bare metal instances and the mounting of cloud hard disks. The specific mounting steps are as follows:

[0087] 1) On the Bare Metal Product Management page, select the Smart NIC model to create a bare metal instance and record the bare metal instance ID instanceId.

[0088] 2) Modify the nova-compute service to obtain the instance connector information interface: get_volume_connector(instanceId), and support returning whether it is a smart network card model.

[0089] 3) nova-compute calls IronicDriver to perform mount / unmount operations: nova.virt.block_device.DriverVolumeBlockDevice._volume_attach calls the driver's attach_volume to complete the mount, and calls detach_volume to complete the unmount.

[0090] IronicDriver calls ironic-api through ironicclient to perform mount / unmount operations;

[0091] After the request is sent, IronicDriver will periodically check whether the volume is mounted successfully: if it is mounted successfully, the volume information will be written to the extra field of the node. If the mount is not completed within 3 minutes, it will be treated as a timeout and the mount will fail.

[0092] 4) Ironiccliet responds to mount / unmount requests:

[0093] In the NodeManager class of ironicclient, add attach_volume and detach_volume to respond to the API request to mount the volume to the node;

[0094] The path is <node-uuid> / volume;

[0095] 5) The api sends the attach / detach request to ironic-conductor via RPC, and calls ironic's cinder storage interface - CinderStorage to perform the mount / unmount operation;

[0096] 6) CinderStorage interface completes the mount / unmount operation:

[0097] In order to be compatible with the existing cinder interface of ironic, the new mounting logic is executed according to the volume type of rbd and the node port of is_smartnic. If the rbd volume is mounted to the smart NIC, the original logic is executed in other cases:

[0098] 7) The driver uses the netmiko module to call the ssh command to mount and unmount the volume:

[0099] After the mounting is completed, pci is returned, and pci_index identifies the mounting information of the volume on the smart network card instance; after the unmounting is completed, the volume information is returned and the volume information is removed from the extra field of the node;

[0100] 8) After nova-compute issues the mount command, IronicDriver calls ironic-api to complete the mount. At this time, IronicDriver waits for the mount result.

[0101] By periodically checking the extra dictionary of the node, determine whether the mount is successful. If successful, format the mount information into an InstanceDeviceMetadata instance and update it to the device_metadata of the instance.

[0102] If it is uninstallation, the uninstallation is successful after detecting that the extra field of the node has no corresponding volume.

[0103] 9) Mount / unmount completed.

[0104] After the mount is successful, the mount information connection_info is saved to the block_device_mapping data table of nova; cinder is notified that the volume attachment has been completed and the volume status is converted to in-use; after the unmount is successful, cinder is notified to perform the volume attachment delete operation.

[0105] like Figure 2 As shown, Figure 2 The specific process of writing data encryption is disclosed: modify the image opening interface in the librbd library, add a judgment on whether it is an encrypted image, and if it is an encrypted image, load the key information from the omap of the rbd_header object, communicate with the key server network according to the key server interface URL and the master key, obtain the encryption key, and exit if the encryption key fails to be obtained.

[0106] The librbd client data writing process uses the national encryption algorithm to encrypt. The specific encryption process is as follows:

[0107] 1) Obtain the encryption key;

[0108] 2) The original data block is aligned with 4k at the beginning and end;

[0109] The data block is divided into header_4k, middle and tail_4k, where header_4k is the new address after the first address is aligned 4k forward, and tail_4k is the new address after the tail address is aligned 4k backward minus 4k. Header_4k and tail_4k are two 4k data blocks. You need to initiate data read from the image first (see Read Data Decryption for the specific process), integrate header_4k and tail_4k data with the read header_4k_old and tail_4k_old, and synthesize 4k length data: header_4k_new and tail_4k_new.

[0110] 3) Data encryption;

[0111] Call the national encryption algorithm to encrypt the three blocks of data header_4k_new, middle and tail_4k_new, combine the encrypted data header_4k_encry, middle_encry and tail_4k_encry into one data block, and call the librbd normal write interface to store the encrypted data in ceph OSD.

[0112] Read data decryption

[0113] Modify the image opening interface in the librbd library to add a check on whether it is an encrypted image. If it is an encrypted image, load the key information from the omap of the rbd_header object, communicate with the key server network based on the key server interface URL and the master key, and obtain the encryption key. If the encryption key fails to be obtained, exit.

[0114] like Figure 3 As shown, the librbd client data reading process decryption supports the national encryption algorithm. The specific reading data decryption process is as follows:

[0115] 1) Obtain the encryption key;

[0116] 2) The read data block address is aligned to the beginning and end of 4k;

[0117] Record the start address src_addr and end address dest_addr of the read data block. Divide the data block into header_4k, middle and tail_4k, where header_4k is the new address after the head address is aligned 4k forward, and tail_4k is the tail address aligned 4k backward. Call librbd normal read interface to obtain encrypted data [header_4k, tail_4k+4k].

[0118] 3) Data decryption;

[0119] The national encryption algorithm is called to decrypt the [header_4k, tail_4k+4k] data block, and the data of the starting address src_addr and the ending address dest_addr are obtained and returned to the client.

[0120] Combining the application of bare metal servers and national secret algorithms in data storage security, the function of bare metal cloud hard drives using national secret encryption can be realized, effectively protecting the security of user data during transmission and storage, ensuring that data is not easily stolen and decrypted, improving data security and controllability, and meeting users' needs for data security.

[0121] It can be seen that the present application provides a bare metal cloud hard disk data encryption device based on the national secret algorithm, including: a block storage management module, a key management module, a storage encryption module, and a bare metal product module, wherein the block storage management module is used to receive a bare metal cloud hard disk data encryption request sent by the client through a first data transmission channel connected to the client, and parse the bare metal cloud hard disk data encryption request to obtain encryption requirement information, and generate a corresponding encrypted volume creation requirement according to the encryption requirement information; the key management module is used to obtain the encrypted volume creation requirement through a key creation interface connected to the block storage management module, trigger an encryption algorithm selection operation to determine a target national secret algorithm, and create and manage a target key and target key ID corresponding to the encrypted volume creation requirement based on the target national secret algorithm; the block storage management module is used to obtain the encrypted volume creation requirement through the key creation interface connected to the block storage management module, trigger an encryption algorithm selection operation to determine a target national secret algorithm, and create and manage a target key and target key ID corresponding to the encrypted volume creation requirement based on the target national secret algorithm; The key query interface of the management module obtains the target key information containing the target key ID, so as to define the encryption volume type based on the target key information, and create and verify the target encrypted cloud hard disk based on the encryption volume type, and then send the target key information to the storage encryption module through the second data transmission channel connected to the storage encryption module; the storage encryption module is used to create the target image information corresponding to the hard disk data to be encrypted in the bare metal cloud hard disk data encryption request based on the verification result of the key attribute in the target key information, and store the target image information in the target encrypted cloud hard disk; the bare metal product module is used to generate the corresponding bare metal instance according to the bare metal cloud hard disk data encryption request, and perform the distributed mounting operation of mounting the target encrypted cloud hard disk to the bare metal instance to complete the encryption of the bare metal hard disk data. It can be seen that by combining the bare metal server and the application of the national encryption algorithm in data storage security, the function of using the national encryption of the bare metal cloud hard disk can be realized, effectively protecting the security of user data during transmission and storage, ensuring that the data is not easily stolen and decrypted, improving the security and controllability of the data, and meeting the user's needs for data security. Using national secret algorithms for encryption can avoid the risks of relying on imported technology and improve the independent controllability of information security.

[0122] Reference Figure 4 As shown, the present invention provides a bare metal cloud hard disk data encryption method based on a national encryption algorithm, comprising:

[0123] Step S11: receiving a bare metal cloud hard disk data encryption request sent by the client through a first data transmission channel connected to the client, parsing the bare metal cloud hard disk data encryption request to obtain encryption requirement information, and generating a corresponding encrypted volume creation requirement according to the encryption requirement information;

[0124] Step S12: obtaining the encrypted volume creation requirement through the key creation interface, triggering the encryption algorithm selection operation to determine the target national encryption algorithm, and creating and managing the target key and target key ID corresponding to the encrypted volume creation requirement based on the target national encryption algorithm;

[0125] Step S13: acquiring target key information including the target key ID through the key query interface, defining an encrypted volume type based on the target key information, and creating and verifying a target encrypted cloud hard disk based on the encrypted volume type;

[0126] Step S14: acquiring the target key information through the second data transmission channel, creating target image information corresponding to the hard disk data to be encrypted in the bare metal cloud hard disk data encryption request based on the verification result of the key attribute in the target key information, and storing the target image information in the target encrypted cloud hard disk;

[0127] Step S15: Generate a corresponding bare metal instance according to the bare metal cloud hard disk data encryption request, and perform a distributed mounting operation on the target encrypted cloud hard disk to the bare metal instance to complete the encryption of the bare metal hard disk data.

[0128] For the specific implementation process of the above steps, please refer to the aforementioned disclosed embodiment content, which will not be repeated here.

[0129] It can be seen that the present application receives a bare metal cloud hard disk data encryption request sent by the client through a first data transmission channel connected to the client, and parses the bare metal cloud hard disk data encryption request to obtain encryption requirement information, and generates a corresponding encrypted volume creation requirement according to the encryption requirement information; obtains the encrypted volume creation requirement through a key creation interface, triggers an encryption algorithm selection operation to determine a target national encryption algorithm, and creates and manages a target key and a target key ID corresponding to the encrypted volume creation requirement based on the target national encryption algorithm; obtains target key information including the target key ID through a key query interface to define an encrypted volume type based on the target key information, and creates and verifies a target encrypted cloud hard disk based on the encrypted volume type; obtains the target key information through a second data transmission channel to create a target image information corresponding to the hard disk data to be encrypted in the bare metal cloud hard disk data encryption request based on the verification result of the key attribute in the target key information, and stores the target image information in the target encrypted cloud hard disk; generates a corresponding bare metal instance according to the bare metal cloud hard disk data encryption request, and performs a distributed mount operation of mounting the target encrypted cloud hard disk to the bare metal instance to complete the encryption of the bare metal hard disk data. It can be seen that by combining bare metal servers and the application of national encryption algorithms in data storage security, the bare metal cloud hard disk can use national encryption to effectively protect the security of user data during transmission and storage, ensure that data is not easily stolen and decrypted, improve data security and controllability, and meet users' needs for data security. Using national encryption algorithms to encrypt can avoid the risk of relying on imported technology and improve the independent controllability of information security.

[0130] Furthermore, the present application also discloses an electronic device. Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0131] Figure 5 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the bare metal cloud hard disk data encryption method based on the national encryption algorithm disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0132] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0133] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0134] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0135] Among them, the operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, so as to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the bare metal cloud hard disk data encryption method based on the national secret algorithm executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks. In addition to data transmitted by an external device received by the electronic device, the data 223 can also include data collected by its own input and output interface 25, etc.

[0136] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned method for encrypting data of a bare metal cloud hard disk based on a national encryption algorithm is implemented. For the specific steps of the method, reference can be made to the corresponding contents disclosed in the aforementioned embodiments, and no further description will be given here.

[0137] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0138] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. The steps of the method or algorithm described in conjunction with the embodiments disclosed herein can be implemented directly with hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory RAM (Random Access Memory), memory, read-only memory ROM (Read Only Memory), electrically programmable EPROM (Electrically Programmable Read Only Memory), electrically erasable programmable EEPROM (ElectricErasable Programmable Read Only Memory), register, hard disk, removable disk, CD-ROM (CompactDisc-Read Only Memory), or any other form of storage medium known in the technical field.

[0139] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0140] The scheme provided by the present invention is introduced in detail above. Specific examples are used in this article to illustrate the principle and implementation mode of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A bare metal cloud hard disk data encryption device based on a national secret algorithm, characterized in that: include: Block storage management module, key management module, storage encryption module, bare metal product module, among which, The block storage management module is used to receive a bare metal cloud hard disk data encryption request sent by the client through a first data transmission channel connected to the client, parse the bare metal cloud hard disk data encryption request to obtain encryption requirement information, and generate a corresponding encrypted volume creation requirement according to the encryption requirement information; The key management module is used to obtain the encrypted volume creation requirement through the key creation interface connected to the block storage management module, trigger the encryption algorithm selection operation to determine the target national encryption algorithm, and create and manage the target key and target key ID corresponding to the encrypted volume creation requirement based on the target national encryption algorithm; The block storage management module is used to obtain the target key information including the target key ID through the key query interface of the key management module, to define the encrypted volume type based on the target key information, and to create and verify the target encrypted cloud hard disk based on the encrypted volume type, and then send the target key information to the storage encryption module through the second data transmission channel connected to the storage encryption module; The storage encryption module is used to create target image information corresponding to the hard disk data to be encrypted in the bare metal cloud hard disk data encryption request based on the verification result of the key attribute in the target key information, and store the target image information in the target encrypted cloud hard disk; The bare metal product module is used to generate a corresponding bare metal instance according to the bare metal cloud hard disk data encryption request, and perform a distributed mounting operation on the target encrypted cloud hard disk to the bare metal instance to complete the encryption of the bare metal hard disk data.

2. According to the data encryption device of the bare metal cloud hard disk based on the national secret algorithm of claim 1, it is characterized in that: The key management module comprises: The key creation unit is used to select a target national encryption algorithm through a pre-written multi-national encryption algorithm integration plug-in, so as to create a target key and a target key ID corresponding to the encrypted volume creation requirement based on the target national encryption algorithm.

3. The bare metal cloud hard disk data encryption device based on the national secret algorithm according to claim 1 is characterized in that: The block storage management module includes: An encrypted volume type definition unit, used to define an encrypted volume type according to the encryption type corresponding to the target national encryption algorithm, the target key ID and the key query interface URL; An encrypted cloud hard disk creation unit, configured to create a target encrypted cloud hard disk in the cloud hard disk management of the block storage management module based on the encrypted volume type; The encrypted cloud hard disk verification unit is used to obtain the encryption key according to the target key ID corresponding to the encrypted volume type and the key query interface URL, and determine that the target encrypted cloud hard disk corresponding to the successful acquisition of the encryption key has passed the verification.

4. The bare metal cloud hard disk data encryption device based on the national secret algorithm according to claim 1 is characterized in that: Also includes: The data processing module is used to perform data alignment processing on the hard disk data in the bare metal cloud hard disk data encryption request to synthesize the hard disk data to be encrypted.

5. The bare metal cloud hard disk data encryption device based on the national secret algorithm according to claim 1 is characterized in that: The storage encryption module comprises: An interface modification unit, used to modify a block device creation interface in a Ceph block device library to add current attribute information in the current block device creation interface to obtain an updated block device creation interface; The interface verification unit is used to verify the interface attributes of the updated block device creation interface based on the key attributes in the target key information. If the verification passes, the target image information corresponding to the hard disk data to be encrypted in the bare metal cloud hard disk data encryption request is created.

6. The bare metal cloud hard disk data encryption device based on the national secret algorithm according to claim 1 is characterized in that: The bare metal product module includes: The instance generation unit is used to select a target smart network card model according to the bare metal cloud hard disk data encryption request, create a bare metal instance according to the target smart network card model, and record the bare metal instance through a preset instance identifier.

7. The bare metal cloud hard disk data encryption device based on the national secret algorithm according to claim 1 is characterized in that: The bare metal product module includes: The unloading unit is used to unload the target encrypted cloud hard disk located in the bare metal instance through a preset unloading instruction when an unloading request for unloading the target encrypted cloud hard disk is detected.

8. A bare metal cloud hard disk data encryption method based on a national secret algorithm, characterized in that: include: Receiving a bare metal cloud hard disk data encryption request sent by the client through a first data transmission channel connected to the client, parsing the bare metal cloud hard disk data encryption request to obtain encryption requirement information, and generating a corresponding encrypted volume creation requirement according to the encryption requirement information; Obtain the encrypted volume creation requirement through the key creation interface, trigger the encryption algorithm selection operation to determine the target national encryption algorithm, and create and manage the target key and target key ID corresponding to the encrypted volume creation requirement based on the target national encryption algorithm; Obtain target key information including the target key ID through the key query interface, define an encrypted volume type based on the target key information, and create and verify a target encrypted cloud hard disk based on the encrypted volume type; Acquire the target key information through the second data transmission channel, create target image information corresponding to the hard disk data to be encrypted in the bare metal cloud hard disk data encryption request based on the verification result of the key attribute in the target key information, and store the target image information in the target encrypted cloud hard disk; A corresponding bare metal instance is generated according to the bare metal cloud hard disk data encryption request, and a distributed mounting operation of mounting the target encrypted cloud hard disk to the bare metal instance is performed to complete the encryption of the bare metal hard disk data.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the bare metal cloud hard disk data encryption method based on the national encryption algorithm as claimed in claim 8.

10. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein, when the computer program is executed by the processor, the steps of the bare metal cloud hard disk data encryption method based on the national secret algorithm as described in claim 8 are implemented.

Images