Dynamic key management method and device based on fuse transparent encryption process

Abstract

The invention discloses a dynamic key management method and device based on a fuse transparent encryption process. The dynamic key management method comprises the following steps: initializing an FSI and initiating a login operation to an FMS to obtain a call permission; the FSI performs analysis in response to the file writing or file reading request to obtain a to-be-operated file path and a read-write operation parameter, and performs calculation based on the read-write operation parameter to obtain a to-be-operated data block number; the FSI calls a key interface of the FMS and sends an encryption and decryption request at least comprising encryption and decryption parameters to the FMS; the FMS judges whether the FSI carries out local encryption on the file according to the encryption and decryption request, and if the FSI carries out local encryption, the FSI extracts a key and carries out encryption and decryption on the to-be-operated data block based on returned local encryption operation so as to complete encryption write-in or decryption read operation of the file; otherwise, the FSI calls an encryption and decryption request data interface of the FMS to perform remote file encryption and decryption. In the transparent encryption process of fuse, each file is encrypted and decrypted through the dynamic key.

Description

Technical Field

[0001] The present invention relates to the field of file encryption, and in particular to a dynamic key management method and device based on a fuse transparent encryption process. Background Art

[0002] Linux FUSE (Filesystem in Userspace) is a mechanism that allows users to create file systems in user space. It enables users to create user-defined file systems without editing and compiling kernel code. Its core idea is to transfer file system operations from kernel space to user space, thereby simplifying file system development and improving flexibility. The file encryption system implemented based on fuse does not require any changes to the upper-layer application system. It only needs to specify the data directory to the virtual directory bound to fuse, and then it can write to the file like operating a normal file system file to achieve transparent encryption of its file data, or read the file to achieve transparent decryption of the file data. Therefore, fuse layer encryption has become a common solution for implementing Linux transparent file encryption technology with its unique flexibility and convenience.

[0003] At present, the common fuse-based transparent file encryption system solutions (hereinafter referred to as "fuse encryption service") are to directly generate a random key locally (or generate it by specifying parameters through slow hash algorithms such as scrypt) or obtain a key from an independent password management system during initialization, and then store it appropriately in the configuration file so that the previously obtained key can be read when the fuse encryption service is restarted later. This key is used as the root key of the fuse encryption system. Whenever a file needs to be encrypted or decrypted, a subkey for the file will be derived from the root key, and then the subkey will be used to complete the encryption and decryption operations on the file to be encrypted or decrypted.

[0004] For example, in the open source project gocryptfs on GITHUB, the key generation method used by the encrypted file system is as follows: Figure 1 and Figure 2 As shown, the system generates a random master key during initialization, and then uses the HKDF key divergence algorithm based on the master key to generate encryption keys for the file body and file name. Then a random IV (Initialization Vector, a randomly generated value used to enhance data security in certain encryption algorithms) is generated for each file block.

[0005] Although the encryption scheme achieves encryption randomness for each block through different block IVs, it is still essentially a static key, which has the following problems: 1. It is impossible to achieve one password for one document. In fact, a fuse encryption system has only one key (master key), not one password for one document; 2. Limited encryption algorithm or mode: Although random IV is used to enhance the randomness of encryption, the encryption algorithm or algorithm mode is also limited. It must be an encryption algorithm or algorithm mode that supports IV. 3. Keys cannot be rotated: Since keys are globally shared, once created, they are difficult to change. Therefore, it is not possible to flexibly rotate keys for files. 4. Key compliance storage: The key is stored locally in the fuse encryption system, in the same or similar location as the encrypted data, which does not meet the key management requirements. At the same time, after the fuse encryption system decrypts the master key after startup, the master key may reside in the memory (the same key needs to be used repeatedly during encryption and decryption), which can be easily captured by memory analysis tools. Summary of the invention

[0006] In order to overcome the shortcomings of the above technologies, the present invention proposes a dynamic key management method and device based on the fuse transparent encryption process. By dynamically calling the fuse encryption management service during the fuse transparent encryption process, the specific key and other encryption parameters of each file are obtained before encryption and decryption of each file, thereby completing local or remote encryption and decryption of the file content.

[0007] The technical solution adopted by the present invention to overcome its technical problems is as follows: the first aspect of the present invention proposes a dynamic key management method in a fuse transparent encryption process, including initializing a fuse encryption service instance and initiating a login operation to the fuse encryption management system to obtain a calling authority; the fuse encryption service instance responds to a file writing or file reading request, parses to obtain a file path to be operated and a read / write operation parameter, and calculates a data block number to be operated based on the read / write operation parameter; the fuse encryption service instance calls a key interface of the fuse encryption management system and sends an encryption / decryption request including at least encryption / decryption parameters to the fuse encryption management system; the fuse encryption management system determines whether the fuse encryption service instance performs local encryption on the file according to the encryption / decryption request, if local encryption is performed, the fuse encryption management system returns a local encryption operation and corresponding key parameters, the fuse encryption service instance extracts a key based on the returned local encryption operation and performs encryption / decryption on the data block to be operated, thereby completing the encryption writing or encryption reading operation of the file; if local encryption is not performed, the fuse encryption management system returns a remote encryption operation, and the fuse encryption service instance calls a request encryption / decryption data interface of the fuse encryption management system based on the returned remote encryption operation to perform remote file encryption / decryption.

[0008] Flexible choice of encryption process, choose local encryption or remote encryption. The key is managed by the fuse encryption management system, which is effectively separated from the encrypted data managed by the fuse encryption service instance.

[0009] Furthermore, the fuse encryption service responds to a write or read request, parses to obtain the path of the file to be operated and the read-write operation parameters, and calculates the data block number to be operated based on the read-write operation parameters, specifically including: the fuse encryption service receives a write encryption request or a read encryption request, and parses to obtain the path of the file to be operated and the read-write operation parameters from the attributes of the request event; if a write encryption request is received, if the encrypted file exists, the file ID is read from the file header of the existing encrypted file, and if the encrypted file does not exist, a random file ID is generated; if a read encryption request is received, the file ID is read from the header of the existing encrypted file; the read-write position is calculated according to the read-write operation parameters; the block number of the data block to be operated is calculated based on the read-write position and the length of the file to be operated.

[0010] The file content is divided into blocks, which increases the friendliness of using the group encryption algorithm and facilitates the control of the amount of data in a single call of the encryption API. The key distribution strategy of the fuse encryption management system supports one key per file or even one key per block.

[0011] Furthermore, the encryption and decryption parameters include at least a file path, a file ID, a block number list, a list of locally supported encryption algorithms, and an operation type.

[0012] Furthermore, the fuse encryption service instance calls the request encryption and decryption data interface of the fuse encryption management system to perform remote file encryption and decryption based on the returned remote encryption operation, specifically including: the fuse encryption service instance sends at least request parameters including the data block to be operated to the fuse encryption management system; the fuse encryption management system encrypts or decrypts the received block data based on the received file path and the preset encryption strategy, and returns the encrypted or decrypted block data list accordingly.

[0013] Furthermore, if the request encryption data interface of the fuse encryption management system is called, the request parameters include at least the file path, file ID, block data list and operation type; if the request decryption data interface of the fuse encryption management system is called, the request parameters include at least the file path, file ID and encrypted block data list.

[0014] The encryption or decryption operation is completed remotely by calling the encryption or decryption interface of the fuse encryption management system.

[0015] Furthermore, if the fuse encryption service instance encrypts or decrypts the file name, the file name encryption interface or file name decryption interface of the fuse encryption management system is called; the fuse encryption management system directly encrypts or decrypts the file name and returns the encryption or decryption result, or the fuse encryption management system returns the encryption key or decryption key, so that the fuse encryption service instance performs file name encryption or file name decryption operations locally.

[0016] Furthermore, it also includes the fuse encryption service instance calling the periodic heartbeat interface of the fuse encryption management system, thereby at least implementing one or more of the tasks of fuse encryption service instance health check task, actively querying key rotation task from the fuse encryption management system, and reporting the execution progress of active rotation task to the fuse encryption management system.

[0017] The fuse encryption management system only needs to control the response key for passive rotation, or through active key rotation, so that even if the file has no external read and write operations, the key rotation can be actively completed, thereby facilitating key rotation.

[0018] Furthermore, the fuse encryption service instance responds to the active key rotation task, traverses the number and total size of files in the directory that requires key rotation, calls the request encryption data interface of the fuse encryption management system, and performs key rotation operations on each file in turn.

[0019] Furthermore, the preset encryption strategy is to use different levels of encryption algorithms and algorithm parameters for files in the encryption directory based on at least different encryption directories.

[0020] The second aspect of the present invention also proposes a dynamic key management device based on the fuse transparent encryption process, which at least includes a fuse encryption service system and a fuse encryption management system. The fuse encryption service system runs a fuse encryption service instance, and the fuse encryption management system provides a management configuration operation WEB interface to configure different encryption strategies based on different directories; the fuse encryption service instance calls the interface of the fuse encryption management system to implement file encryption or decryption based on dynamic keys, encryption or decryption of file names and key rotation based on encryption strategies.

[0021] The beneficial effects of the present invention are: 1. The fuse encryption service calls the fuse encryption management system, configures the key logic in the fuse encryption management system, specifies different passwords, different algorithms or different encryption methods for different files, or rotates the file passwords according to the encryption management requirements, thus realizing the dynamic key management function of the fuse encryption service instance; 2. Through the key distribution strategy of the fuse encryption management system, it is possible to support one key per file or even one key per block. Block means dividing the file content into several data blocks of fixed size, such as one block of 4096 bytes; 3. Apply more flexible cryptographic algorithms, including cryptographic modes corresponding to cryptographic algorithms. On the basis of one document and one password, one document and one specific encryption algorithm (including encryption algorithm mode) can be used according to management needs; 4. Convenient key rotation. Each operation requires a key request. The fuse encryption management system only needs to control the response key for passive rotation, or through active key rotation, so that even if there is no external read and write operation on the file, the key rotation can be actively completed; 5. Separate keys from data. Keys are managed by the fuse encryption management system, which is effectively separated from the encrypted data managed by the fuse encryption service instance, further improving the security of the system. When using local encryption and decryption, each time the encryption and decryption temporary key for the specified file data block is obtained from the fuse encryption management system, after the encryption and decryption operation of the data is completed, the temporary key will become invalid in the memory and will not reside in the memory; 6. Flexible encryption process, by choosing local encryption or remote encryption. You can use the key and algorithm specified by the fuse encryption management system to encrypt locally on the fuse encryption service instance, or you can call the fuse encryption management system encryption or decryption interface to complete the encryption or decryption operation remotely. During the implementation process, you can flexibly configure according to compliance requirements; 7. Splitting the file content into blocks increases the friendliness of using the block encryption algorithm and facilitates the control of the amount of data in a single call of the encryption API. Each file block is divided into a block header and block data. The block header includes encryption-related parameter information such as IV, key ID, authentication code, etc. The block data is the encrypted data of the plaintext block; 8. Add a fixed file header to the encrypted file header and predefine the file version number and file ID to help implement file encryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A schematic diagram of the relationship between the master key and the file body key in the prior art; Figure 2 This is a schematic diagram of encrypting a file block locally using a file body key in the prior art; Figure 3 A schematic diagram of a flow chart of a dynamic key management method in a fuse transparent encryption process according to an embodiment of the present invention; Figure 4 This is a schematic diagram of a fuse encryption service instance dynamically calling a fuse encryption management system service in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] First, some abbreviations and key terms mentioned in the present invention are explained.

[0024] / dev / urandom: It is a special device file in Linux and Unix-like systems for generating pseudo-random numbers. / dev / urandom generates pseudo-random numbers based on the entropy pool, but unlike / dev / random, it does not block the process when entropy is insufficient, which means that even if the system's entropy pool is exhausted, it will still provide data, although the randomness of this data may be slightly reduced.

[0025] AAD: Additional Authenticated Data, in AES-GCM (Advanced Encryption Standard - Galois / Counter Mode) encryption mode, AAD refers to data that is not encrypted during the encryption process but needs to be authenticated. AAD allows you to include certain data in the authentication process, but the data itself will not be encrypted.

[0026] CAT: concatenate, which means connecting multiple contents together in sequence.

[0027] In order to facilitate those skilled in the art to better understand the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The following is only exemplary and does not limit the protection scope of the present invention.

[0028] like Figure 3 As shown, a flow chart of a dynamic key management method in a fuse transparent encryption process described in this embodiment is shown, and the dynamic key management method includes the following process.

[0029] S1, initialize the fuse encryption service instance and initiate a login operation to the fuse encryption management system to obtain calling permissions.

[0030] In one embodiment of the present invention, when a fuse encryption service instance (hereinafter referred to as FSI) is started and initialized, a login operation is initiated to a fuse encryption management system (hereinafter referred to as FMS) to obtain a subsequent call session Token.

[0031] like Figure 4 As shown, when the fuse encryption service instance initiates a login operation to the fuse encryption management system, the request parameters include at least the system ID, login token, and encryption root directory. The fuse encryption management system returns the call session token to the fuse encryption service instance. In the subsequent call to the fuse encryption management system, the fuse encryption service instance carries the session token for identity and authority verification.

[0032] The method of calling the API of the fuse encryption management system can adopt a suitable method that can complete the inter-process call through HTTP, gRPC, unixSocket, etc.

[0033] S2, the fuse encryption service instance responds to the write file or read file request, parses the file path to be operated and the read / write operation parameters, and calculates the data block number to be operated based on the read / write operation parameters.

[0034] S21, the Fuse encryption service receives a write encryption request or a read encryption request, and parses the attributes of the request event to obtain the file path to be operated and the read and write operation parameters.

[0035] In one embodiment of the present invention, the complete file path to be written (encrypted) or read (encrypted) is parsed from the fuse event attributes.

[0036] S22. If a write encryption request is received, if the encrypted file exists, the file ID is read from the file header of the existing encrypted file. If the encrypted file does not exist, a random file ID is generated. If a read encryption request is received, the file ID is read from the header of the existing encrypted file.

[0037] The file ID is one of the attributes of the file header created by the fuse encryption service instance for each encrypted file. The file header also includes other information such as the version number.

[0038] S23, calculating the read / write position according to the read / write operation parameters, and calculating the block number of the data block to be operated based on the read / write position and the length of the file to be operated.

[0039] In the file read and write operation parameters, the position and length to be read and written are calculated, and based on the position and length, the data block number to be encrypted or decrypted is calculated.

[0040] In one embodiment of the present invention, in order to facilitate the encryption and decryption of files, the fuse encryption service instance divides the file content into blocks of 4096 bytes and assigns block numbers in the order of the blocks. The subsequent encryption and decryption of data are all performed in units of data blocks. The design of data blocks is to make it more convenient to use standard block encryption algorithms such as SM2 / AES. The file block size of 4096 is only used as an example, which is generally an integer multiple of 128. For example, 1024, 8192, etc. can also be used as the block size.

[0041] S3, the fuse encryption service instance calls the key interface of the fuse encryption management system and sends an encryption and decryption request including at least encryption and decryption parameters to the fuse encryption management system.

[0042] like Figure 4 As shown in the figure, the fuse encryption service instance calls the / key key interface of FMS to request encryption key or decryption key. The request parameters include file path, file ID, block number list, local supported algorithm list, operation type (encryption or decryption), etc. The locally supported algorithm list in the request parameter may provide a list of algorithms supported by the local encryption of the fuse encryption service instance, which is used for support by the fuse encryption management system.

[0043] S4, the fuse encryption management system determines whether the fuse encryption service instance locally encrypts the file based on the encryption and decryption request.

[0044] The fuse encryption management system returns response parameters according to the pre-set configuration policy. It determines whether to encrypt the file locally, that is, the fuse encryption management system requires the fuse encryption service instance to complete encryption and decryption locally, or send the original block data to the fuse encryption management system for encryption and decryption.

[0045] S41, if local encryption is performed, the fuse encryption management system returns the local encryption operation and the corresponding key parameters. The fuse encryption service instance extracts the key based on the returned local encryption operation and encrypts and decrypts the data block to be operated to complete the encryption writing or encryption reading operation of the file.

[0046] If the fuse encryption management system determines that the file is to be encrypted locally, the returned response parameters include local encryption and decryption allowed, key, key ID, block key list and algorithm name. According to the response parameters, the fuse encryption service instance extracts the key, encrypts the block data that needs to be operated, completes the file write encryption operation, or decrypts the encrypted block data that needs to be operated, obtains the encrypted block data plaintext, completes the file read operation, etc.

[0047] In one embodiment of the present invention, the key returned in the response parameter, the fuse encryption management system can give a specific key specific to the file, or a specific key specific to different data blocks of the file according to the request parameters. The logic of the fuse encryption management system is flexibly determined by the encryption system administrator through configuration on the fuse encryption management system web interface. The key ID returned in the response parameter is the ID corresponding to the key, and the fuse encryption management system uniquely identifies the ID of each different key. The algorithm name in the response parameter specifies the encryption algorithm of the current file. For example: AES or SM4. Usually these algorithms refer to the encryption algorithms used by the fuse encryption service instance when completing encryption and decryption operations locally.

[0048] In some embodiments, the above encryption algorithms also include but are not limited to: SM4-128-GCM, SM4-128-SIV, AES-256-GCM, AES-256-SIV, XChaCha20-Poly1305, etc.

[0049] In one embodiment of the present invention, the main configuration object of the fuse encryption management system is the encryption directory. According to the confidentiality level and security requirements of the data stored in different encryption directories, different policies are configured, including but not limited to: file content encryption algorithm and key length, content encryption method (remote / local), file name encryption algorithm and key length, file name encryption method (remote / local), key cycle period and rotation method, etc.

[0050] For example, in one embodiment of the present invention, in the fuse encryption management system, the AES-GCM algorithm is used for all files under the / etc / data1 directory, and the key is a file-based 256-bit random key. Each file block uses the same key. Then, for all files under the / etc / data2 directory, the SM4-GCM algorithm is used, and the key is 128 bits. Local encryption is not used, but the remote encryption operation is completed by calling the cipher machine through the fuse encryption management system.

[0051] S42, if local encryption is not performed, the encryption management system returns "remote encryption operation is required", and the fuse encryption service instance calls the request encryption and decryption data interface of the fuse encryption management system to perform remote file encryption and decryption based on the returned remote encryption operation parameters.

[0052] If the fuse encryption management system determines that the file is to be encrypted remotely, the response parameters only include that local encryption and decryption are not allowed.

[0053] like Figure 4 As shown, based on the returned remote encryption operation, the fuse encryption service instance calls the ③ / encrypt encryption interface to perform encryption operations on file writing when encryption or decryption is required, or calls the ④ / decrypt decryption interface to perform decryption operations on file reading when decryption is required. Specifically, it includes: S421, the fuse encryption service instance sends at least request parameters including the data block to be operated to the fuse encryption management system.

[0054] If the ③ / encrypt encryption interface of the fuse encryption management system is called, the request parameters at least include the file path, file ID, block data list and operation type; If the ④ / decrypt decryption interface of the fuse encryption management system is called, the request parameters include at least the file path, file ID, and encrypted block data list.

[0055] S422, the encryption management system encrypts or decrypts the received block data according to the received file path and the preset encryption strategy, and returns a list of encrypted or decrypted block data accordingly.

[0056] S5: If the fuse encryption service instance encrypts or decrypts the file name, the file name encryption interface or the file name decryption interface of the encryption management system is called.

[0057] In some implementations, the fuse encryption service instance needs to encrypt and decrypt the file name itself. For example, after encrypting the file name " / etc / data1 / Nginx-2024-11-29.log", the file name becomes " / etc / data1 / xafdperefdafaldfl", such as Figure 4 As shown, ⑤ / filename file name encryption and decryption interface is called. Through this interface, the fuse encryption management system can directly encrypt and decrypt the file name and return the encryption and decryption result, or return the encryption and decryption key. The fuse encryption service instance completes the encryption and decryption operation of the file name locally.

[0058] S6, the fuse encryption service instance calls the periodic heartbeat interface of the encryption management system, thereby at least achieving one or more of the following tasks: proving the survival of the fuse encryption service instance, actively querying the key rotation task from the fuse encryption management system, and reporting the execution progress of the active rotation task to the fuse encryption management system.

[0059] like Figure 4 As shown in the figure, the fuse encryption service instance periodically (every minute) initiates a heartbeat call to the FMS by calling the ⑥ / heartbeat interface. This interface has at least the following functions: 1) Indicate to the FUSE encryption management system FMS that the FSI is currently working, that is, the FSI is undergoing a health check; 2) Pull the latest active key rotation task from the FUSE encryption management system FMS, including the task ID and key rotation directory; 3) Report to the fuse encryption management system FMS the execution progress of the key active rotation task, including the task ID, the number and total size of completed files, and the total number and total size of files.

[0060] like Figure 4 As shown in the figure, the request parameters for calling the ⑥ / heartbeat interface include at least the current time of the client and the progress of the active key rotation task. The response parameters include at least the current time of the server and the new active key rotation task.

[0061] S7, the fuse encryption service instance responds to the active key rotation task, traverses the number and total size of files in the directory that requires key rotation, calls the request encryption data interface of the fuse encryption management system, and performs key rotation operations on each file in turn.

[0062] When the fuse encryption service instance obtains the latest active key rotation task, the background service starts to perform active password rotation operations. The operations include: traversing the number and total size of files in the directory that requires key rotation, performing key rotation operations on each file in turn, calling the ③ / encrypt request encryption data interface shown in the figure, and the operation type of the request parameter is "active key rotation".

[0063] In some implementations, key rotation can also be configured on the fuse encryption management system. For example, key rotation is performed every three months for all encrypted files in the / etc / data1 directory. The rotation method supports passive rotation and active rotation. Passive rotation means that when a file is changed, a new rotation key is used for encryption. Active rotation means that after FSI receives a rotation request, it actively rotates and encrypts all files in the specified operation directory.

[0064] Another embodiment of the present invention also proposes a dynamic key management device for running the above-mentioned dynamic key management method based on fuse transparent encryption, which at least includes a fuse encryption service system and a fuse encryption management system. The fuse encryption service system runs a fuse encryption service instance. The fuse encryption management system provides a management configuration operation WEB interface to configure different encryption strategies based on different directories. The fuse encryption service instance calls the interface of the fuse encryption management system to implement encryption or decryption of files based on dynamic keys, encryption or decryption of file names and key rotation based on encryption strategies.

[0065] In some implementations, the encryption and decryption process is completed by calling a dedicated encryption machine through the fuse encryption management system, thereby further enhancing the security of the encryption process.

[0066] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0067] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The system and system embodiment described above are only illustrative, and some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

Claims

1. A dynamic key management method in a fuse transparent encryption process, characterized in that: include: Initialize the fuse encryption service instance and initiate a login operation to the fuse encryption management system to obtain calling permissions; The fuse encryption service instance responds to the file writing or reading request, parses the file path to be operated and the read / write operation parameters, and calculates the data block number to be operated based on the read / write operation parameters; The fuse encryption service instance calls the key interface of the fuse encryption management system and sends an encryption and decryption request including at least encryption and decryption parameters to the fuse encryption management system; The fuse encryption management system determines whether the fuse encryption service instance encrypts the file locally based on the encryption and decryption request. If local encryption is performed, the fuse encryption management system returns the local encryption operation and the corresponding key parameters. Based on the returned local encryption operation, the fuse encryption service instance extracts the key and encrypts and decrypts the data block to be operated to complete the encryption writing or encryption reading operation of the file; If local encryption is not performed, the fuse encryption management system returns the remote encryption operation. Based on the returned remote encryption operation, the fuse encryption service instance calls the request encryption and decryption data interface of the fuse encryption management system to perform remote file encryption and decryption.

2. According to claim 1, a dynamic key management method in a fuse transparent encryption process is characterized in that: The fuse encryption service responds to the write or read request, parses to obtain the path of the file to be operated and the read / write operation parameters, and calculates the number of the data block to be operated based on the read / write operation parameters, specifically including: The fuse encryption service receives a write encryption request or a read encryption request, and parses the attributes of the request event to obtain the file path to be operated and the read and write operation parameters; If a write encryption request is received, if the encrypted file exists, the file ID is read from the file header of the existing encrypted file; if the encrypted file does not exist, a random file ID is generated; If a read encryption request is received, the file ID is read from the existing encrypted file header; Calculate the read and write positions according to the read and write operation parameters; The block number of the data block to be operated is calculated based on the read / write position and the length of the file to be operated.

3. According to a method for dynamic key management in a fuse transparent encryption process according to claim 1, it is characterized in that: The encryption and decryption parameters include at least a file path, a file ID, a block number list, a local supported encryption algorithm list and an operation type.

4. According to a method for dynamic key management in a fuse transparent encryption process according to claim 1, it is characterized in that: The fuse encryption service instance calls the request encryption and decryption data interface of the fuse encryption management system to perform remote file encryption and decryption based on the returned remote encryption operation, specifically including: The fuse encryption service instance sends at least request parameters including the data block to be operated to the fuse encryption management system; The fuse encryption management system encrypts or decrypts the received block data based on the received file path and the preset encryption strategy, and returns the encrypted or decrypted block data list accordingly.

5. A method for dynamic key management in a fuse transparent encryption process according to claim 4, characterized in that: Also includes, If the request encryption data interface of the fuse encryption management system is called, the request parameters include at least the file path, file ID, block data list and operation type; If the request decryption data interface of the fuse encryption management system is called, the request parameters include at least the file path, file ID, and encrypted block data list.

6. A method for dynamic key management in a fuse transparent encryption process according to claim 1, characterized in that: Also includes, If the fuse encryption service instance encrypts or decrypts the file name, the file name encryption interface or file name decryption interface of the fuse encryption management system is called; The fuse encryption management system directly encrypts or decrypts the file name and returns the encryption or decryption result. Or the fuse encryption management system returns an encryption key or a decryption key, so that the fuse encryption service instance performs file name encryption or file name decryption operations locally.

7. A method for dynamic key management in a fuse transparent encryption process according to claim 1, characterized in that: It also includes the fuse encryption service instance calling the periodic heartbeat interface of the fuse encryption management system, so as to at least implement one or more of the tasks of fuse encryption service instance health check task, actively querying key rotation task from the fuse encryption management system, and reporting the execution progress of active rotation task to the fuse encryption management system.

8. A method for dynamic key management in a fuse-based transparent encryption process according to claim 7, characterized in that: In response to the active key rotation task, the fuse encryption service instance traverses the number and total size of files in the directory that requires key rotation, calls the request encryption data interface of the fuse encryption management system, and performs key rotation operations on each file in turn.

9. A method for dynamic key management in a fuse transparent encryption process according to claim 4, characterized in that: The preset encryption strategy is to use different levels of encryption algorithms and algorithm parameters for files in the encryption directory based on at least different encryption directories.

10. A dynamic key management device based on fuse transparent encryption process, characterized in that: At least includes a fuse encryption service system and a fuse encryption management system. The fuse encryption service system runs a fuse encryption service instance. The fuse encryption management system provides a management configuration operation WEB interface to configure different encryption policies based on different directories; The fuse encryption service instance calls the interface of the fuse encryption management system to implement encryption or decryption of files based on dynamic keys, encryption or decryption of file names, and key rotation based on encryption policies.

Images