Storage system, method, electronic device, storage medium and program product

Abstract

The embodiments of the present application provide a storage system, method, electronic device, storage medium and program product. The system includes: a data storage system obtains a storage request sent by application software, performs a list verification on the application software, and when it is determined that the list verification of the application software has passed, sends an encryption request to the key storage system, so that when the key storage system determines that the list verification of the data storage system has passed, it obtains an encryption key by accessing the key security partition, transmits the encryption key to the data storage system through a secure channel, and the data storage system encrypts the data requested for storage according to the encryption key, obtains encrypted data and stores it in the data security partition. When the data storage system receives a read request, it decrypts the encrypted data corresponding to the read request, obtains the target data and sends it to the application software. This method improves the security of user privacy data and enhances the reliability and stability of storing user privacy data.

Description

Technical Field

[0001] The present application relates to storage technology, and in particular to a storage system, method, electronic device, storage medium and program product. Background Art

[0002] At present, cars generate user privacy data during use, such as facial information, fingerprints, passwords, and certificates. When user privacy data is leaked, it will cause inconvenience to users.

[0003] Existing technologies store user privacy data in the TEE (Trusted Execution Environment) of the car cockpit platform to ensure the security of the storage environment.

[0004] However, the storage space of the trusted execution environment is limited, making it difficult to effectively store users' growing privacy information, which affects the reliability and stability of storing user privacy data, and further affects the security of user privacy data. Summary of the Invention

[0005] Embodiments of the present application provide a storage system, method, electronic device, storage medium, and program product to improve the security of user privacy data and enhance the reliability and stability of storing user privacy data.

[0006] In a first aspect, an embodiment of the present application provides a storage system, including:

[0007] The data storage system is configured to obtain storage requests sent by application software, perform roster verification on the application software based on the storage request, and send an encryption request to the key storage system when the application software passes the roster verification. The data storage system is a system in a virtualized environment for processing data, and the key storage system is a system in a virtualized environment for processing keys.

[0008] The key storage system is used to verify the list of the data storage system according to the encryption request. When the list of the data storage system passes the verification, the encryption key in the key security partition is sent to the data storage system through an encrypted channel. The key security partition is a hard disk partition mounted in the key storage system.

[0009] The data storage system is also used to encrypt the target data sent by the application software according to the encryption key, and store the encrypted data in the data security partition, which is the hard disk partition mounted in the data storage system; when a read request is received, the encrypted data corresponding to the read request is decrypted, and the target data is obtained and sent to the application software.

[0010] Optionally, the data storage system decrypts the encrypted data corresponding to the read request, including:

[0011] Determine the application software corresponding to the read request, perform a list verification on the application software, and when the list verification of the application software passes, read the encrypted data corresponding to the request from the data security partition of the data storage system;

[0012] Authenticate the application software. If the application software passes the authentication, it sends a decryption request to the key storage system to obtain the decryption key fed back by the key storage system.

[0013] Decrypt the encrypted data according to the decryption key.

[0014] Optionally, the data storage system performs list verification on the application software, including:

[0015] Determining whether the tag information of the application software is in the application software whitelist based on the read request, and if it is determined to be in the application software whitelist, determining whether the application software has read permission based on the application software whitelist;

[0016] When it is determined that the read permission is granted, it is determined that the list verification of the application software has passed; otherwise, it is determined that the list verification of the application software has failed;

[0017] The data storage system is also used for:

[0018] When the list verification of the application software fails, a list verification failure indication is sent to the application software.

[0019] Optionally, the data storage system stores the encrypted data in a data security partition, including:

[0020] The encrypted data is identified according to the tag information of the application software, and the identified encrypted data is stored in the data security partition of the data storage system.

[0021] Optionally, the data storage system authenticates the application software, including:

[0022] Based on the tag information of the application software, determining whether the identifier corresponding to the encrypted data is consistent;

[0023] If the identifier is consistent with the encrypted data, it is determined that the identity authentication of the application software has passed; otherwise, it is determined that the identity authentication of the application software has failed;

[0024] The data storage system is also used for:

[0025] When the identity authentication of the application software fails, an identity authentication failure indication is sent to the application software.

[0026] Optionally, the key storage system is further configured to:

[0027] receiving a decryption request sent by the data storage system, and performing a list verification on the data storage system based on the decryption request;

[0028] When the list verification of the data storage system is passed, the decryption key corresponding to the decryption request is read from the key security partition of the key storage system, and the decryption key is sent to the data storage system.

[0029] In a second aspect, an embodiment of the present application provides a storage method, applied to a data storage system, comprising:

[0030] Obtaining a storage request sent by the application software, and performing a list verification on the application software based on the storage request;

[0031] When the list verification of the application software passes, an encryption request is sent to the key storage system, so that the key storage system performs list verification on the data storage system according to the encryption request. When the list verification of the data storage system passes, the encryption key in the key security partition is sent to the data storage system through an encrypted channel; wherein the data storage system is a system in a virtualized environment for processing data, the key storage system is a system in a virtualized environment for processing keys, and the key security partition is a hard disk partition mounted in the key storage system;

[0032] Encrypt the target data sent by the application software according to the encryption key and store the encrypted data in the data security partition, which is the hard disk partition mounted in the data storage system;

[0033] When a read request is received, the encrypted data corresponding to the read request is decrypted to obtain the target data and send it to the application software.

[0034] Optionally, determining the application software corresponding to the read request, performing a list verification on the application software, and when the list verification of the application software passes, reading the encrypted data corresponding to the request from the data security partition of the data storage system;

[0035] Authenticate the application software, and when the application software passes the authentication, send a decryption request to the key storage system to obtain the decryption key fed back by the key storage system; wherein the decryption key is read from the key security partition when the key storage system determines that the list of data storage systems has passed the authentication based on the decryption request;

[0036] Decrypt the encrypted data according to the decryption key.

[0037] Optionally, determining whether the tag information of the application software is in an application software whitelist based on the read request, and if it is determined to be in the application software whitelist, determining whether the application software has read permission based on the application software whitelist;

[0038] When it is determined that the read permission is granted, it is determined that the list verification of the application software has passed; otherwise, it is determined that the list verification of the application software has failed;

[0039] When the list verification of the application software fails, a list verification failure indication is sent to the application software.

[0040] Optionally, an identifier is added to the encrypted data according to the tag information of the application software, and the encrypted data with the identifier is stored in a data security partition of the data storage system.

[0041] Optionally, based on the tag information of the application software, determining whether the identifier corresponding to the encrypted data is consistent;

[0042] If the identifier is consistent with the encrypted data, it is determined that the identity authentication of the application software has passed; otherwise, it is determined that the identity authentication of the application software has failed;

[0043] When the identity authentication of the application software fails, an identity authentication failure indication is sent to the application software.

[0044] In a third aspect, an embodiment of the present application provides a storage method, applied to a key storage system, comprising:

[0045] receiving an encryption request, and performing a list verification on the data storage system based on the encryption request, wherein the encryption request is performed by the data storage system on the application software based on the storage request, and is sent to the key storage system when the application software passes the list verification, wherein the storage request is sent by the application software, the data storage system is a system in a virtualized environment for processing data, and the key storage system is a system in a virtualized environment for processing keys;

[0046] When the list verification of the data storage system is passed, the encryption key in the key security partition is sent to the data storage system through an encrypted channel, so that the data storage system encrypts the target data sent by the application software according to the encryption key, and stores the encrypted data in the data security partition. The key security partition is the hard disk partition mounted in the key storage system, and the data security partition is the hard disk partition mounted in the data storage system.

[0047] Optionally, a decryption request sent by the data storage system is received, and a list verification is performed on the data storage system based on the decryption request; wherein the decryption request is sent by the data storage system when it determines that the list verification of the application software has passed based on the read request, and when it determines that the identity verification of the application software has passed; determining that the list verification of the application software has passed is obtained when the data storage system determines that the tag information of the application software is in the application software whitelist based on the read request, and when it determines that the application software has read permission; determining that the identity verification of the application software has passed is obtained when the data storage system determines that the tag information of the application software is consistent with an identifier corresponding to the encrypted data, and the identifier corresponding to the encrypted data is added to the encrypted data by the data storage system based on the tag information of the application software;

[0048] When the list verification of the data storage system is passed, the decryption key corresponding to the decryption request is read from the key security partition of the key storage system, and the decryption key is sent to the data storage system.

[0049] In a fourth aspect, an embodiment of the present application provides a storage device, applied to a data storage system, comprising:

[0050] An acquisition module, configured to acquire a storage request sent by the application software and perform list verification on the application software based on the storage request;

[0051] A first processing module is configured to, when the application software passes the list verification, send an encryption request to the key storage system, so that the key storage system performs the list verification on the data storage system according to the encryption request, and when the data storage system passes the list verification, send the encryption key in the key security partition to the data storage system via an encrypted channel; wherein the data storage system is a system in a virtualized environment for processing data, the key storage system is a system in a virtualized environment for processing keys, and the key security partition is a hard disk partition mounted in the key storage system;

[0052] The first processing module is further configured to encrypt the target data sent by the application software according to the encryption key and store the encrypted data in a data security partition, which is a hard disk partition mounted in the data storage system;

[0053] The first processing module is further configured to, upon receiving a read request, decrypt the encrypted data corresponding to the read request, obtain target data, and send the target data to the application software.

[0054] Optionally, the first processing module is further configured to determine the application software corresponding to the read request, perform a list verification on the application software, and read the encrypted data corresponding to the request from the data security partition of the data storage system when the list verification of the application software passes;

[0055] Authenticate the application software, and when the application software passes the authentication, send a decryption request to the key storage system to obtain the decryption key fed back by the key storage system; wherein the decryption key is read from the key security partition when the key storage system determines that the list of data storage systems has passed the authentication based on the decryption request;

[0056] Decrypt the encrypted data according to the decryption key.

[0057] Optionally, the first processing module is further configured to determine whether the tag information of the application software is in an application software whitelist based on the read request, and if it is determined to be in the application software whitelist, determine whether the application software has read permission based on the application software whitelist;

[0058] When it is determined that the read permission is granted, it is determined that the list verification of the application software has passed; otherwise, it is determined that the list verification of the application software has failed;

[0059] When the list verification of the application software fails, a list verification failure indication is sent to the application software.

[0060] Optionally, the first processing module is further configured to add a tag to the encrypted data according to the tag information of the application software, and store the encrypted data with the tag added in a data security partition of the data storage system.

[0061] Optionally, the first processing module is further configured to determine, based on the tag information of the application software, whether the identifier corresponding to the encrypted data is consistent;

[0062] If the identifier is consistent with the encrypted data, it is determined that the identity authentication of the application software has passed; otherwise, it is determined that the identity authentication of the application software has failed;

[0063] When the identity authentication of the application software fails, an identity authentication failure indication is sent to the application software.

[0064] In a fifth aspect, an embodiment of the present application provides a storage device, applied to a key storage system, comprising:

[0065] a receiving module, configured to receive an encryption request and perform a list verification on the data storage system based on the encryption request, wherein the encryption request is performed by the data storage system on the application software based on the storage request and is sent to the key storage system when the application software passes the list verification, wherein the storage request is sent by the application software, the data storage system is a system in a virtualized environment for processing data, and the key storage system is a system in a virtualized environment for processing keys;

[0066] The second processing module is used to send the encryption key in the key security partition to the data storage system through an encrypted channel when the list verification of the data storage system is passed, so that the data storage system encrypts the target data sent by the application software according to the encryption key, and stores the encrypted data in the data security partition. The key security partition is a hard disk partition mounted in the key storage system, and the data security partition is a hard disk partition mounted in the data storage system.

[0067] Optionally, the receiving module is further configured to receive a decryption request sent by the data storage system, and perform list verification on the data storage system based on the decryption request; wherein the decryption request is sent by the data storage system when it determines that the list verification of the application software has passed based on the read request, and that the identity verification of the application software has passed; determining that the list verification of the application software has passed is obtained when the data storage system determines that the tag information of the application software is in the application software whitelist based on the read request, and that the application software has read permission; determining that the identity verification of the application software has passed is obtained when the data storage system determines that the tag information of the application software is consistent with an identifier corresponding to the encrypted data, and the identifier corresponding to the encrypted data is added to the encrypted data by the data storage system based on the tag information of the application software;

[0068] When the list verification of the data storage system is passed, the decryption key corresponding to the decryption request is read from the key security partition of the key storage system, and the decryption key is sent to the data storage system.

[0069] In a sixth aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor;

[0070] Memory stores computer-executable instructions;

[0071] The processor executes the computer-executable instructions stored in the memory, so that the processor executes various possible implementations of the second aspect and / or the third aspect as described above.

[0072] In the seventh aspect, an embodiment of the present application provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by a processor, they are used to implement various possible implementation methods of the second aspect and / or the third aspect as described above.

[0073] In an eighth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements various possible implementations of the second aspect and / or the third aspect above.

[0074] The storage system, method, electronic device, storage medium and program product provided by the embodiments of the present application obtain a storage request sent by the application software through a data storage system in a virtualized environment for processing data, perform a list verification on the application software, and when it is determined that the list verification of the application software has passed, send an encryption request to the key storage system in a virtualized environment for processing keys. After the key storage system receives the encryption request, it performs a list verification on the data storage system. When it is determined that the list verification of the data storage system has passed, it obtains the encryption key by accessing the key security partition mounted on the key storage system, transmits the encryption key to the data storage system through a secure channel, and the data storage system encrypts the data requested for storage according to the encryption key, and obtains the encrypted data stored in the data security partition mounted on the data storage system. When the data storage system receives a read request, it decrypts the encrypted data corresponding to the read request, obtains the target data and sends it to the application software. The present application improves the security of user privacy data and enhances the reliability and stability of storing user privacy data. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0076] Figure 1 A schematic diagram of the prior art scenario provided for this application;

[0077] Figure 2 A schematic diagram of the storage system provided in this application;

[0078] Figure 3 A schematic diagram of the storage system provided in this application;

[0079] Figure 4 A schematic diagram of the storage method provided in this application;

[0080] Figure 5 Schematic diagram of the structure of the storage device provided in this application Figure 1 ;

[0081] Figure 6 Schematic diagram of the structure of the storage device provided in this application Figure 2 ;

[0082] Figure 7 This is a schematic diagram of the structure of the electronic device provided in this application.

[0083] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0084] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0085] With the development of technology, the smart cockpit platform of the car provides users with a variety of application software. When using the application software, users will generate user privacy data, such as facial information, fingerprints and passwords. During the use of the car, the above user privacy data needs to be protected to avoid losses caused by data leakage.

[0086] Figure 1 The schematic diagram of the prior art provided in this application is as follows: Figure 1 As shown, the prior art scenario includes a cockpit platform 10, which includes an application software unit 11 and a trusted execution environment 12. The application software unit includes application software 1, application software 2, and so on, where n is a positive integer. When a user operates an application software, the application software generates user privacy data, which is stored in the trusted execution environment to ensure a secure storage environment for user privacy data. However, the storage space of the trusted execution environment is limited, making it difficult to effectively store and protect user privacy data.

[0087] In addition, in order to increase the space for secure storage of user privacy data, the existing technology adds a storage module to the smart cockpit platform to expand the storage space, but adding a storage module increases the storage cost.

[0088] The storage system provided in the present application includes a data storage system (a system in a virtualized environment that processes data) and a key storage system (a system in a virtualized environment that processes keys). The data storage system obtains a storage request sent by the application software, performs a list verification on the application software according to the storage request, and determines that the label information of the application software is in the application software whitelist and has storage permission. Then, it is determined that the list verification of the application software has passed, and an encryption request is sent to the key storage system. After receiving the encryption request, the key storage system performs a list verification on the data storage system that sent the encryption request, and determines that the label information of the data storage system is in the storage whitelist and has encryption permission. Then, it is determined that the list verification of the data storage system has passed, and the encryption key is extracted from the key security partition (the hard disk partition mounted by the key storage system) and sent to the data storage system through a secure channel. The data storage system stores the data requested to be stored by the application software according to the encryption key, obtains the encrypted data, and stores it in the data security partition (the hard disk partition mounted by the data storage system). In addition, when a user reads encrypted data, the data storage system determines that the application software's list verification has passed based on the read request received, then requests a decryption key from the key storage system. After obtaining the decryption key, the encrypted data is decrypted and sent to the application software for use by the application software. This application improves the security of user privacy data by authenticating the application software and the data storage system. Separately storing data and keys in hardware partitions mounted by systems in different virtualized environments reduces the possibility of encryption and / or decryption keys being stolen, further enhancing the reliability and stability of storing user privacy data.

[0089] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0090] Figure 2 A schematic diagram of the storage system provided in this application, such as Figure 2 As shown, storage system 20 includes a data storage system 21, a key storage system 22, and a virtualization base (hypervisor) 23. The data storage system includes application software 1, application software 2, ..., application software n, and a data security partition, and the key operating system includes a key security partition. The data storage system is a system within a virtualized hardware environment generated by the virtualization base based on virtualization technology for data processing, while the key operating system is a system within a virtualized hardware environment generated by the virtualization base based on virtualization technology for key processing.

[0091] Optionally, the data storage system is used to obtain a storage request sent by the application software, perform a list verification on the application software based on the storage request, and send an encryption request to the key storage system when the list verification of the application software passes. The data storage system is a system in a virtualized environment for processing data, and the key storage system is a system in a virtualized environment for processing keys; the key storage system is used to perform a list verification on the data storage system according to the encryption request, and when the list verification of the data storage system passes, send the encryption key in the key security partition to the data storage system through an encrypted channel. The key security partition is a hard disk partition mounted in the key storage system; the data storage system is also used to encrypt the target data sent by the application software according to the encryption key, and store the encrypted data in the data security partition. The data security partition is a hard disk partition mounted in the data storage system; when a read request is received, the encrypted data corresponding to the read request is decrypted to obtain the target data and send it to the application software.

[0092] Optionally, the data security partition in the data storage system is created by mounting partition A on the target hard disk to a system in a virtualized data processing hardware environment. Programs in the data storage system can directly access the data security partition, while programs in other storage systems (e.g., the key storage system) cannot access the data security partition.

[0093] Optionally, the secure key partition in the key storage system is partition B on the target hard drive mounted to a system within a virtualized hardware environment that processes keys. Programs in the key storage system can directly access the secure key partition, while programs in other storage systems (e.g., data storage systems) cannot. Partitions A and B on the target hard drive are independent partitions.

[0094] In a possible embodiment, the virtualization base starts the data storage system and the key storage system, and monitors and transmits data to the data storage system and the key storage system to obtain the operating status of the data storage system and the key storage system, thereby improving the operating stability of the storage system.

[0095] In one possible embodiment, Figure 3As shown, the virtualization base uses virtualization technology to establish an Android system within a virtualized environment for processing data and a Dom0 system within a virtualized environment for processing keys. The Android system and Dom0 system are then activated through the virtualization base. The Android system receives a storage request sent by application software 1 and determines whether the list verification of application software 1 has passed based on the storage request. If the list verification of application software 1 has passed, an encryption request is generated and data is exchanged with the storage service in the Dom0 system through the secure storage service in the Android system. Specifically, the encryption request is sent to the storage service in the Dom0 system so that the storage service in the Dom0 system determines the tag information of the Android system sending the encryption request and whether the tag information of the Android system is in the system whitelist in the Dom0 system. If the tag information is in the system whitelist in the Dom0 system, the tag information is further determined based on the system whitelist to have encryption permission. If the tag information is determined to have encryption permission, the list verification of the Android system is determined to have passed. If the Dom0 system determines that the Android system's identity authentication has passed, it accesses the key security partition based on the storage service to retrieve the stored encryption key and feeds the obtained encryption key back to the secure storage service in the Android system via an encrypted channel. In this embodiment, the data storage system performs a list verification on the application software that initiates the encryption request, and only sends an encryption request to the key storage system after the verification is passed. When the key storage system determines that the list verification of the data storage system has passed, it obtains the encryption key from the key security partition mounted by the key storage system and transmits it through an encrypted channel, thereby improving the security of the encryption key and reducing the probability of encryption key leakage. The encryption key is used to encrypt user privacy data, further enhancing the security of user privacy data.

[0096] Optionally, an identifier is added to the encrypted data according to the tag information of the application software, and the encrypted data with the identifier is stored in a data security partition of the data storage system.

[0097] In one possible embodiment, the data storage system's secure storage service encrypts the data requested for storage by application software 1 using an encryption key. The encrypted data is then labeled with application software 1's tag information and stored in the secure data partition. This embodiment adds a tag based on the application software's tag information to the encrypted data, facilitating verification of the legitimacy of the application software storing the encrypted data.

[0098] Optionally, when the data storage system receives a read request, it determines the application software corresponding to the read request, performs a list verification on the application software, and when the list verification of the application software passes, reads the encrypted data corresponding to the request from the data security partition of the data storage system; authenticates the application software, and when the identity verification of the application software passes, sends a decryption request to the key storage system to obtain the decryption key fed back by the key storage system; and decrypts the encrypted data according to the decryption key. In this embodiment, when the data storage system receives a read request, it re-performs a list verification on the application software that initiated the read request, and when the list verification passes, accesses the data security partition to read the requested encrypted data. After obtaining the encrypted data, it authenticates the application software again, and after determining that the identity verification passes, sends a decryption request to the key storage system to access the key security partition to obtain the decryption key. When the key storage system determines that the list verification of the data storage system passes, it accesses the key security partition to obtain the decryption key, thereby reducing the probability of the decryption key being leaked, improving the security of the decryption key, and further enhancing the security of user privacy data.

[0099] Optionally, the data storage system determines whether the tag information of the application software is in the application software whitelist based on the read request. If it is determined that the application software is in the application software whitelist, it determines whether the application software has read permission based on the application software whitelist; when it is determined that the application software has read permission, it determines that the list verification of the application software has passed; otherwise, it determines that the list verification of the application software has failed.

[0100] Exemplarily, when the data storage system determines that an application has failed list verification, it sends a list verification failure indication to the application. This embodiment, after determining that the application is on the application whitelist, determines whether the application has read permission, thereby enhancing verification of the application and improving the reliability of the verification results. This avoids feeding back user privacy data to applications that are on the application whitelist but do not have read permission, thereby enhancing the security of user privacy data.

[0101] Optionally, when the data storage system determines that the list verification of the application software has passed, it determines whether the identifier corresponding to the encrypted data is consistent based on the tag information of the application software; if it is consistent with the identifier corresponding to the encrypted data, it is determined that the identity authentication of the application software has passed; otherwise, it is determined that the identity authentication of the application software has failed.

[0102] Exemplarily, when the data storage system determines that the identity authentication of the application software has failed, it sends an identity authentication failure indication to the application software.

[0103] For example, when the data storage system determines that the application software has passed authentication, it sends a decryption request to the key storage system. This embodiment determines whether the application software's tag information is consistent with the identifier on the encrypted data. If they are consistent, it determines that the application software's reading of the encrypted data is legal, thereby preventing data from being sent to illegal applications and improving data security.

[0104] Optionally, the key storage system receives a decryption request from the data storage system and performs a list verification on the data storage system based on the decryption request. If the list verification on the data storage system passes, the key storage system reads the decryption key corresponding to the decryption request from the key security partition of the key storage system and sends the decryption key to the data storage system. This embodiment, through the key storage system, performs list verification on the data storage system, thereby preventing losses caused by erroneous data transmission and enhancing the security and reliability of the data transmission process.

[0105] In a possible embodiment, the encryption channel includes but is not limited to TLS (Transport Layer Security) and an internal Ethernet communication network. Transmitting encryption keys and decryption keys based on the encryption channel reduces the possibility of key leakage and enhances data security.

[0106] Optionally, after receiving the decryption request, the data storage system decrypts the encrypted data according to the decryption key, obtains the decrypted target data, and sends it to the application software for use by the application software.

[0107] Figure 4 A flow chart of the storage method provided in this application is as follows: Figure 4 As shown, this embodiment Figure 2 Based on the embodiment, the storage method is described in detail, and the method includes:

[0108] S401: The data storage system obtains a storage request.

[0109] More specifically, the data storage system obtains a storage request sent by the application software. The data storage system is a system in a virtualized environment for processing data.

[0110] S402: The data storage system verifies the list of the application software that initiates the storage request.

[0111] More specifically, the data storage system identifies the application software initiating the storage request and the tag information of the application software, determines whether the tag information of the application software is in the application software whitelist, and if it is determined to be in the application software whitelist, determines whether the application software has storage permission based on the application software whitelist. If it is determined that the application software has storage permission, it is determined that the application software list verification has passed.

[0112] Optionally, when it is determined that the application software does not have the storage permission, it is determined that the list verification of the application software has failed, and an indication of the list verification failure is fed back to the application software.

[0113] Optionally, when it is determined that the tag information of the application software is not in the application software whitelist, it is determined that the list verification of the application software has failed, and an indication of the failure of the list verification is fed back to the application software.

[0114] S403: When the data storage system determines that the list of application software has passed the verification, it sends an encryption request to the key storage system, wherein the data storage system is a system in a virtualized environment for processing keys.

[0115] S404: The key storage system verifies the list of the data storage system that initiated the encryption request.

[0116] More specifically, the key storage system receives an encryption request, determines the tag information of the data storage system that initiated the encryption request, and determines whether the tag information of the data storage system is in the system whitelist. If not, it is determined that the data storage system has failed the list verification.

[0117] Optionally, if it is determined that the data storage system is on the system whitelist, then determining whether the data storage system has encryption permission based on the system whitelist. If it is determined that the data storage system has encryption permission, then determining that the data storage system list verification has passed. If it is determined that the data storage system does not have encryption permission, then determining that the data storage system list verification has failed.

[0118] S405 . When the list of the data storage system is verified to be successful, the key storage system obtains the encryption key by accessing the key security partition.

[0119] More specifically, when the key storage system determines that the data storage system's list has passed verification, it accesses a key security partition mounted on the key storage system to obtain the encryption key stored in the key security partition. The key security partition is a hard disk partition mounted on the key storage system.

[0120] Optionally, before obtaining a storage request, the key storage system generates an encryption key and a decryption key corresponding to the data storage system for the communication connection according to the AES encryption algorithm, and stores the keys in the key security partition.

[0121] Optionally, the key storage system generates corresponding encryption and decryption keys for each application software in the communicatively connected data storage system, adds label information of the corresponding application software to the encryption and decryption keys, and stores them in the key security partition. This embodiment achieves isolated storage of data and keys by storing each encryption and decryption key in a key security partition accessible only by the key storage system, thus preventing key leakage.

[0122] S406: The key storage system sends the encryption key to the data storage system through an encrypted channel.

[0123] S407: The data storage system encrypts the data according to the encryption key and stores the data in the data security partition.

[0124] More specifically, the data storage system receives an encryption key, encrypts the storage data sent by the application software using the encryption key, adds a tag to the encrypted data based on the tag information of the application software, and stores the encrypted data with the tag added in a data security partition mounted on the data storage system. The data security partition is a hard disk partition mounted on the data storage system.

[0125] Optionally, the data security partition and the key security partition are two independent partitions on the same hard disk.

[0126] S408. When receiving the read request, the data storage system performs a list verification on the application software that initiated the read request.

[0127] More specifically, upon receiving a read request from an application, the data storage system identifies the application initiating the read request and whether the tag information of the application is on an application whitelist. If the application is on the application whitelist, the system then determines whether the application has read permission based on the application whitelist. If it is determined that the application has read permission, the application list verification is determined to have passed.

[0128] Optionally, when it is determined that the application software does not have the read permission, it is determined that the list verification of the application software has failed, and an indication of the list verification failure is fed back to the application software.

[0129] Optionally, when it is determined that the tag information of the application software is not in the application software whitelist, it is determined that the list verification of the application software has failed, and an indication of the failure of the list verification is fed back to the application software.

[0130] S409: When the list of application software passes the verification, the data storage system obtains the encrypted data and performs identity authentication on the application software.

[0131] More specifically, when the list of application software is verified, the data storage system accesses the data security partition, obtains the encrypted data read by the application software, determines the identifier on the obtained encrypted data, and determines the label information corresponding to the representation, and determines whether the label information is consistent with the label information of the application software requesting to read the data.

[0132] Exemplarily, when it is determined that the tag information is consistent with the tag information of the application software requesting to read data, it is determined that the identity authentication of the application software has passed; otherwise, it is determined that the identity authentication of the application software has failed, and an authentication failure indication is fed back to the application software.

[0133] S410 , the data storage system sends a decryption request to the key storage system when the application software passes the identity authentication.

[0134] S411 , the key storage system verifies the list of the data storage system that initiated the decryption request.

[0135] More specifically, the key storage system receives a decryption request, determines the tag information of the data storage system initiating the decryption request, and determines whether the tag information of the data storage system is on the system whitelist. If the data storage system is on the system whitelist, the key storage system determines whether the data storage system has decryption permission based on the system whitelist. If the data storage system is determined to have decryption permission, the data storage system's list verification is considered successful.

[0136] Exemplarily, if it is determined that the decryption authority is not possessed, it is determined that the list of storage systems has failed verification.

[0137] Exemplarily, if it is determined that the tag information of the data storage system is not in the system whitelist, it is determined that the list verification of the data storage system has failed.

[0138] S412: When the list of the data storage system is verified to be successful, the key storage system obtains the decryption key by accessing the key security partition.

[0139] More specifically, when the list of the data storage system is verified, the key storage system accesses the key security partition to determine the decryption key corresponding to the data storage system.

[0140] S413: The key storage system sends the decryption key to the data storage system through an encrypted channel.

[0141] S414: The key storage system decrypts the encrypted data, obtains the target data and sends it to the application software.

[0142] The storage method provided in the embodiment of the present application performs a list verification on the application software that initiates storage requests and / or read requests through the data storage system, and further authenticates the application software that passes the list verification based on the read request, thereby avoiding sending wrong data and improving the reliability and security of storing and reading data. In addition, by mounting an independent hardware partition on the data storage system to store encrypted data and mounting an independent hardware partition on the key storage system to store keys, the key security is enhanced, and the security of data storage and reading is further improved.

[0143] Figure 5Schematic diagram of the structure of the storage device provided in this application Figure 1 , applied to data storage systems, such as Figure 5 As shown, the storage device 50 provided in this embodiment includes:

[0144] The acquisition module 501 is used to acquire the storage request sent by the application software and perform a list verification on the application software based on the storage request;

[0145] The first processing module 502 is configured to, when the application software passes the list verification, send an encryption request to the key storage system, so that the key storage system performs list verification on the data storage system according to the encryption request. When the data storage system passes the list verification, the first processing module 502 is configured to send the encryption key in the key security partition to the data storage system via an encrypted channel. The data storage system is a system in a virtualized environment for processing data, the key storage system is a system in a virtualized environment for processing keys, and the key security partition is a hard disk partition mounted in the key storage system.

[0146] The first processing module 502 is further configured to encrypt the target data sent by the application software according to the encryption key and store the encrypted data in a data security partition, which is a hard disk partition mounted in the data storage system;

[0147] The first processing module 502 is further configured to, upon receiving a read request, decrypt the encrypted data corresponding to the read request, obtain target data, and send the target data to the application software.

[0148] Optionally, the first processing module 502 is further configured to determine the application software corresponding to the read request, perform a list verification on the application software, and read the encrypted data corresponding to the request from the data security partition of the data storage system when the list verification of the application software passes;

[0149] Authenticate the application software, and when the application software passes the authentication, send a decryption request to the key storage system to obtain the decryption key fed back by the key storage system; wherein the decryption key is read from the key security partition when the key storage system determines that the list of data storage systems has passed the authentication based on the decryption request;

[0150] Decrypt the encrypted data according to the decryption key.

[0151] Optionally, the first processing module 502 is further configured to determine whether the tag information of the application software is in an application software whitelist based on the read request, and if it is determined to be in the application software whitelist, determine whether the application software has read permission based on the application software whitelist;

[0152] When it is determined that the read permission is granted, it is determined that the list verification of the application software has passed; otherwise, it is determined that the list verification of the application software has failed;

[0153] When the list verification of the application software fails, a list verification failure indication is sent to the application software.

[0154] Optionally, the first processing module 502 is further configured to add a tag to the encrypted data according to the tag information of the application software, and store the encrypted data with the tag added in a data security partition of the data storage system.

[0155] Optionally, the first processing module 502 is further configured to determine, based on the tag information of the application software, whether the identifier corresponding to the encrypted data is consistent;

[0156] If the identifier is consistent with the encrypted data, it is determined that the identity authentication of the application software has passed; otherwise, it is determined that the identity authentication of the application software has failed;

[0157] When the identity authentication of the application software fails, an identity authentication failure indication is sent to the application software.

[0158] The storage device provided in this embodiment for use in a data storage system can execute the method provided in the above method embodiment. Its implementation principles and technical effects are similar and will not be described in detail in this embodiment.

[0159] Figure 6 The schematic diagram of the structure of the storage device provided in this application is applied to the key storage system, such as Figure 6 As shown, the storage device 60 provided in this embodiment includes:

[0160] Receiving module 601 is configured to receive an encryption request and perform a list verification on the data storage system based on the encryption request. The encryption request is performed by the data storage system on the application software based on the storage request and is sent to the key storage system when the application software's list verification passes. The storage request is sent by the application software. The data storage system is a system in a virtualized environment for processing data, and the key storage system is a system in a virtualized environment for processing keys.

[0161] The second processing module 602 is used to send the encryption key in the key security partition to the data storage system through an encrypted channel when the list verification in the data storage system is passed, so that the data storage system encrypts the target data sent by the application software according to the encryption key, and stores the encrypted data in the data security partition. The key security partition is a hard disk partition mounted in the key storage system, and the data security partition is a hard disk partition mounted in the data storage system.

[0162] Optionally, the receiving module 601 is further configured to receive a decryption request sent by the data storage system, and perform list verification on the data storage system based on the decryption request; wherein the decryption request is sent by the data storage system when it determines that the list verification of the application software has passed based on the read request, and that the identity verification of the application software has passed; determining that the list verification of the application software has passed is obtained when the data storage system determines that the tag information of the application software is in the application software whitelist based on the read request, and that the application software has read permission; determining that the identity verification of the application software has passed is obtained when the data storage system determines that the tag information of the application software is consistent with an identifier corresponding to the encrypted data, and the identifier corresponding to the encrypted data is added to the encrypted data by the data storage system based on the tag information of the application software;

[0163] When the list verification of the data storage system is passed, the decryption key corresponding to the decryption request is read from the key security partition of the key storage system, and the decryption key is sent to the data storage system.

[0164] The storage device provided in this embodiment for use in a key storage system can execute the method provided in the above method embodiment. Its implementation principles and technical effects are similar and will not be described in detail in this embodiment.

[0165] Figure 7 This is a schematic diagram of the structure of the electronic device provided in this application. Figure 7 As shown, the electronic device 70 provided in this embodiment includes: at least one processor 701 and a memory 702. Optionally, the device 70 further includes a communication component 703. The processor 701, the memory 702 and the communication component 703 are connected via a bus 704.

[0166] During the specific implementation process, at least one processor 701 executes the computer-executable instructions stored in the memory 702, so that the at least one processor 701 performs the above method.

[0167] The specific implementation process of the processor 701 can be found in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here in this embodiment.

[0168] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASICs), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the present invention may be directly executed by a hardware processor or by a combination of hardware and software modules within the processor.

[0169] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage.

[0170] A bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be categorized as address buses, data buses, and control buses. For ease of illustration, the buses in the drawings of this application are not limited to just one bus or just one type of bus.

[0171] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0172] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0173] The readable storage medium may be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium may be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0174] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium can be located in an application-specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0175] The division of units is merely a logical functional division; actual implementations may employ alternative divisions, such as combining or integrating multiple units or components into another system, or omitting or disabling certain features. Furthermore, any direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between devices or units, either through an interface, electrical, mechanical, or other means.

[0176] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0177] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0178] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the method of the present invention. The aforementioned storage medium includes various media that can store program code, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0179] Those skilled in the art will appreciate that all or part of the steps in the above-described method embodiments can be implemented using hardware associated with program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0180] Finally, it should be noted that those skilled in the art will readily identify other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art not disclosed herein. The present invention is not limited to the precise structure described above and illustrated in the accompanying drawings, and various modifications and variations may be made without departing from the scope thereof. The scope of the present invention is limited solely by the appended claims.

Claims

1. A storage system, characterized in that: include: A data storage system configured to obtain a storage request sent by application software, perform list verification on the application software based on the storage request, and send an encryption request to a key storage system when the application software passes the list verification, wherein the data storage system is a system in a virtualized environment for processing data, and the key storage system is a system in a virtualized environment for processing keys; a key storage system configured to perform a list verification on the data storage system according to the encryption request, and send the encryption key in the key security partition to the data storage system via an encrypted channel when the list verification on the data storage system passes. The key security partition is a hard disk partition mounted in the key storage system; The data storage system is also used to encrypt the target data sent by the application software according to the encryption key, and store the encrypted data in a data security partition, which is a hard disk partition mounted in the data storage system; when a read request is received, the encrypted data corresponding to the read request is decrypted to obtain the target data and send it to the application software.

2. The system according to claim 1, wherein: The data storage system decrypts the encrypted data corresponding to the read request, including: Determining the application software corresponding to the read request, performing a list verification on the application software, and reading the encrypted data corresponding to the read request from the data security partition of the data storage system when the list verification of the application software passes; authenticating the application software, and when the authentication of the application software passes, sending a decryption request to the key storage system to obtain a decryption key fed back by the key storage system; The encrypted data is decrypted according to the decryption key.

3. The system according to claim 2, characterized in that The data storage system performs list verification on the application software, including: determining whether the tag information of the application software is in an application software whitelist based on the read request, and if it is determined that the tag information of the application software is in the application software whitelist, determining whether the application software has read permission based on the application software whitelist; When it is determined that the read permission is granted, determining that the list verification of the application software has passed; otherwise, determining that the list verification of the application software has failed; The data storage system is further used for: When the list verification of the application software fails, a list verification failure indication is sent to the application software.

4. The system according to claim 2, wherein: The data storage system stores encrypted data in a data security partition, including: The encrypted data is marked according to the tag information of the application software, and the marked encrypted data is stored in a data security partition of the data storage system.

5. The system according to claim 4, characterized in that The data storage system authenticates the application software, including: Determining, based on the tag information of the application software, whether the identifier corresponding to the encrypted data is consistent; If the identifier is consistent with the identifier corresponding to the encrypted data, it is determined that the identity authentication of the application software has passed; otherwise, it is determined that the identity authentication of the application software has failed; The data storage system is further used for: When the identity authentication of the application software fails, an identity authentication failure indication is sent to the application software.

6. The system according to claim 2, wherein: The key storage system is further used for: receiving a decryption request sent by a data storage system, and performing a list verification on the data storage system based on the decryption request; When the list of the data storage system is verified to be successful, the decryption key corresponding to the decryption request is read from the key security partition of the key storage system, and the decryption key is sent to the data storage system.

7. A storage method, characterized in that: Applied to data storage systems, including: Obtaining a storage request sent by the application software, and performing a list verification on the application software based on the storage request; When the list verification of the application software passes, an encryption request is sent to the key storage system, so that the key storage system performs list verification on the data storage system according to the encryption request. When the list verification of the data storage system passes, the encryption key in the key security partition is sent to the data storage system through an encrypted channel; wherein the data storage system is a system in a virtualized environment for processing data, the key storage system is a system in a virtualized environment for processing keys, and the key security partition is a hard disk partition mounted in the key storage system; Encrypting the target data sent by the application software according to the encryption key, and storing the encrypted data in a data security partition, where the data security partition is a hard disk partition mounted in the data storage system; When a read request is received, the encrypted data corresponding to the read request is decrypted to obtain target data and send it to the application software corresponding to the read request.

8. A storage method, characterized in that: Applied to key storage systems, including: receiving an encryption request, performing a list verification on a data storage system based on the encryption request, wherein the encryption request is performed by the data storage system on the application software based on the storage request, and the encryption request is sent to the key storage system when the application software passes the list verification, wherein the storage request is sent by the application software, the data storage system is a system in a virtualized environment for processing data, and the key storage system is a system in a virtualized environment for processing keys; When the list verification of the data storage system is passed, the encryption key in the key security partition is sent to the data storage system through an encrypted channel; so that the data storage system encrypts the target data sent by the application software according to the encryption key, stores the encrypted data in the data security partition, and when a read request is received, decrypts the encrypted data corresponding to the read request, obtains the target data and sends it to the application software corresponding to the read request; the key security partition is a hard disk partition mounted in the key storage system, and the data security partition is a hard disk partition mounted in the data storage system.

9. An electronic device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to claim 7 or 8.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to claim 7 or 8 when executed by a processor.

11. A computer program product comprising a computer program, wherein when the computer program is executed by a processor, the method according to claim 7 or 8 is implemented.

Images