Data processing method, encryption card device and readable storage medium

Abstract

The invention provides a data processing method, an encryption card device and a readable storage medium, and the method is applied to the encryption card device, and comprises the steps: creating a plurality of tenant block devices according to the number of communication channels, initializing an encryption file system in each tenant block device, distributing a target tenant block device according to request information, the storage area corresponding to the target tenant block device comprises an adjacent effective storage area and an isolation area with a random length, and randomly generated data is stored in the isolation area, obtaining original tenant data, generating encrypted target tenant data according to the original tenant data, and sending the encrypted target tenant data to the target tenant block device. And storing the target tenant data into an effective storage area of the target tenant block device. According to the application, the independent encrypted file system is established for each tenant block device, the tenants cannot access data across the encrypted file system, and the length and the filling content of the isolation region between the storage regions corresponding to each tenant block device are random, so that the anti-cracking capability is improved, and the data security of the tenants in the card is protected.

Description

Technical Field

[0001] The present application relates to the technical field of data processing, and in particular to a data processing method, an encryption card device and a readable storage medium. Background Art

[0002] In recent years, with the rapid development of information technology, users have paid more and more attention to information security. As a high-performance encryption device, hardware encryption cards have demonstrated their unique value in cloud computing, financial services, communication security, and data protection. Such devices are usually integrated into computing systems in the form of high-speed bus standards (Peripheral Component Interconnect Express, PCIe) cards or Universal Serial Bus (USB) peripherals, providing significantly enhanced security and computing efficiency compared to software encryption solutions. In particular, by introducing virtual function (Virtual Function, VF) technology, a single physical encryption card can be virtualized into multiple independently operating logical devices, which not only optimizes resource allocation, but also enhances the flexibility and efficiency of services, providing strong support for complex and changing application scenarios. As the cornerstone of defending data security and privacy, data isolation technology is crucial to ensuring the independence of data between different tenants and preventing unauthorized access and data leakage.

[0003] However, with the popularization and application of cloud environments, high virtualization, support for multi-tenancy and resource elasticity management have become new technical requirements for encryption cards. In actual deployment, especially under the condition of limited hardware resources, the traditional data management mechanism lacks effective isolation, there is a risk of multi-tenant data coexistence, shared protection keys, poor security, and the file system of data management occupies too much storage space and computing resources, affecting the overall system efficiency. Summary of the invention

[0004] The purpose of this application is to provide a data processing method, an encryption card device and a readable storage medium to address the deficiencies in the above-mentioned prior art, so as to solve the problem that the data management mechanism in the prior art lacks effective isolation.

[0005] To achieve the above objectives, the technical solutions adopted in this application are as follows:

[0006] In a first aspect, the present application provides a data processing method, which is applied to an encryption card device, and the method includes:

[0007] Creating a plurality of tenant block devices according to the number of communication channels of the encryption card device, each of the tenant block devices deploying an encrypted file system;

[0008] Initialize each encrypted file system;

[0009] Allocate a target tenant block device for the tenant from the plurality of tenant block devices according to the tenant's request information, wherein the storage area corresponding to the initialized target tenant block device includes an adjacent valid storage area in the storage space of the encryption card device and an isolation area of ​​random length, and the isolation area stores randomly generated data;

[0010] The original tenant data of the tenant is obtained, and encrypted target tenant data is generated according to the original tenant data, and the target tenant data is stored in the valid storage area of ​​the target tenant block device.

[0011] Optionally, the step of creating a plurality of tenant block devices according to the number of communication channels of the encryption card device includes:

[0012] Creating a tenant block device structure corresponding to each communication channel of the encryption card device;

[0013] Generating an identifier of each of the tenant block device structures according to an identifier of the communication channel;

[0014] Create an encrypted file system structure corresponding to the tenant block device structure, and determine the hardware algorithm queue mapping address and index storage address;

[0015] The tenant block device structure is filled according to the identifier of the tenant block device structure, the encrypted file system structure, the hardware algorithm queue mapping address and the index storage address to obtain the tenant block device.

[0016] Optionally, the step of creating an encrypted file system structure corresponding to the tenant block device structure includes:

[0017] Bind the interface file and fill the random number block handle, and set the physical start address and the offset corresponding to each tenant block device;

[0018] According to the physical start address and the offset corresponding to each tenant block device, calling the filling random number block handle to fill the isolation area corresponding to the tenant block device, determining the storage start address and storage end address of the valid storage area corresponding to each encrypted file system, and saving the storage start address and storage end address of each encrypted file system in the security chip in the encryption card device;

[0019] An encrypted file system instance is created according to the storage start address and storage end address of each encrypted file system.

[0020] Optionally, initializing each encrypted file system includes:

[0021] According to the storage start address and the storage end address in the storage space corresponding to the encrypted file system of the tenant block device, data between the storage start address and the storage end address is erased.

[0022] Optionally, generating encrypted target tenant data according to the original tenant data, and storing the target tenant data in the valid storage area of ​​the target tenant block device includes:

[0023] Determine the key index corresponding to the original tenant data;

[0024] The original tenant data is stored in a hardware algorithm queue corresponding to a hardware algorithm queue mapping address corresponding to the target tenant block device in the security chip of the encryption card device, and the key index is stored in an index storage address corresponding to the target tenant block device in the security chip;

[0025] The encryption module of the encryption card device encrypts the original tenant data according to the original tenant data and the key index stored in the hardware algorithm queue to obtain the target tenant data, and stores the target tenant data in the hardware algorithm queue corresponding to the target tenant block device;

[0026] The encrypted file system of the target tenant block device reads the target tenant data from the hardware algorithm queue corresponding to the target tenant block device, and stores the target tenant data in the valid storage area corresponding to the target tenant block device according to the storage start address and offset of the valid storage area corresponding to the target tenant block device.

[0027] Optionally, encrypting the original tenant data according to the original tenant data and the key index stored in the hardware algorithm queue to obtain the target tenant data includes:

[0028] Reading the original tenant data from the hardware algorithm queue corresponding to the target tenant block device, and reading the key index from the index storage address corresponding to the target tenant block device;

[0029] According to the key index, obtaining a target key indicated by the key index from a key module of the encryption card device;

[0030] The original tenant data is encrypted using the target key to obtain the target tenant data.

[0031] Optionally, determining the key index corresponding to the original tenant data includes:

[0032] Determine whether the target tenant block device currently has a key index;

[0033] If not, a key index is randomly generated and stored in a security chip in the encryption card device.

[0034] Optionally, the method further comprises:

[0035] According to the data read request of the tenant for the target tenant block device, the target tenant data is read from the valid storage area corresponding to the target tenant block device through the encrypted file system of the target tenant block device, and the target tenant data is stored in the hardware algorithm queue corresponding to the target tenant block device;

[0036] The encryption module of the encryption card device reads the target tenant data from the hardware algorithm queue, reads the key index from the index storage address corresponding to the target tenant block device in the security chip, and generates and outputs the decrypted original tenant data according to the target tenant data and the key index.

[0037] Optionally, generating and outputting decrypted original tenant data according to the target tenant data and the key index includes:

[0038] According to the key index, obtaining a target key indicated by the key index from a key module of the encryption card device;

[0039] Decrypt the target tenant data using the target key to obtain original tenant data, and store the original tenant data in a hardware algorithm queue corresponding to the target tenant block device;

[0040] The encrypted file system of the target tenant block device reads the original tenant data from the hardware algorithm queue corresponding to the target tenant block device, and outputs the original tenant data.

[0041] Optionally, the method further comprises:

[0042] According to the tenant's deregistration request for the target tenant block device, obtaining a storage start address and an offset of a valid storage area of ​​the target tenant block device;

[0043] According to the storage start address and offset, calling the fill random number block handle to fill the valid storage area of ​​the target tenant block device;

[0044] Clear the key index in the index storage address.

[0045] In a second aspect, the present application provides an encryption card device, which is used to perform data processing based on the steps of the data processing method as described in the first aspect.

[0046] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the above-mentioned data processing method are executed.

[0047] The beneficial effects of the present application are: creating multiple tenant block devices, initializing the encrypted file system corresponding to each tenant block device, and then allocating the target tenant device to the tenant according to the tenant's request information. Among them, the storage area corresponding to the target tenant block device includes adjacent valid storage areas and isolation areas. The isolation area stores randomly generated data, thereby streamlining the structure of logical isolation, and each tenant block device deploys an encrypted file system, so it is suitable for data isolation of encryption card devices with limited resources, and each tenant cannot access the data of other tenants across the encrypted file system. Since the isolation area stores randomly generated data, and the length of the isolation area is also random, there is no need to use a partition table and directory structure, which improves the anti-cracking capability. Then the original tenant data of the tenant is obtained and the encrypted target tenant data is generated, and the target tenant data is stored in the valid storage area of ​​the target tenant block device. This embodiment uses a storage space with logical isolation protection to store encrypted tenant data, thereby realizing multi-tenant data isolation under the condition of low-configuration hardware resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 It is a flowchart of a data processing method provided in an embodiment of the present application;

[0050] Figure 2 It is a structural diagram of a tenant block device provided in an embodiment of the present application;

[0051] Figure 3 It is a schematic diagram of a block device state transition provided by an embodiment of the present application;

[0052] Figure 4 It is a flowchart of a method for creating a tenant block device provided by an embodiment of the present application;

[0053] Figure 5 It is a flowchart of a method for creating an encrypted file system structure provided by an embodiment of the present application;

[0054] Figure 6is a structural schematic diagram of a storage device provided in an embodiment of the present application;

[0055] Figure 7 This is a flow chart of a method for generating and storing target tenant data proposed in an embodiment of the present application;

[0056] Figure 8 This is a flow chart of a method for obtaining target tenant data provided by an embodiment of the present application;

[0057] Fig. 9 This is a schematic diagram of a process for encrypting and storing tenant data provided by an embodiment of the present application;

[0058] Fig.10 It is a flowchart of a method for generating and outputting decrypted original tenant data provided by an embodiment of the present application;

[0059] Fig.11 This is a schematic diagram of a process for reading and decrypting tenant data provided by an embodiment of the present application;

[0060] Fig.12 It is a flowchart of another data processing method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0062] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0063] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0064] The traditional data management mechanism lacks effective isolation measures. The data of different tenants are stored in the same storage space, and each tenant shares the same protection key, which has poor security. In addition, the file system for data management is not tailored, which takes up too much storage space and computing resources, affecting the overall system efficiency.

[0065] Based on this, the present application proposes a data processing method, which is applied to an encryption card device. First, multiple tenant block devices are created, and an encrypted file system is deployed in each tenant block device, so that tenants cannot access across the encrypted file system. After that, each encrypted file system is initialized first, and then a target tenant block device is allocated to the tenant from multiple tenant block devices according to the tenant's request information. The storage area corresponding to the target tenant block device includes adjacent valid storage areas and isolation areas in the storage space of the encryption card device. By allocating valid storage areas and isolation areas corresponding to the target tenant block device to the tenant, data isolation protection between multiple tenants is achieved. And the length of the isolation area is random, and it is filled with randomly generated data, so the storage area corresponding to each tenant block device has isolation protection. Then the original tenant data of the tenant is obtained, and the encrypted target tenant data is generated according to the original tenant data and stored in the valid storage area in the storage space. This method does not use the partition table and directory results, improves the anti-cracking ability, and is suitable for encryption card devices with limited resources.

[0066] Figure 1 is a flow chart of a data processing method provided by an embodiment of the present application. Figure 1 The data processing method in the method is introduced, wherein the data processing method is applied in an encryption card device.

[0067] S101. Create multiple tenant block devices according to the number of communication channels of the encryption card device, and deploy an encrypted file system on each tenant block device.

[0068] The communication channel of the encryption card device may be a virtual file system (VF) channel. The VF channel is a logical interface that allows an external reference program to access data in the card and perform security operations through a standardized command set. The encryption card device may have multiple communication channels, and tenant block devices are created according to the number of communication channels. As an optional implementation, the number of tenant block devices created is the same as the number of communication channels of the encryption card device.

[0069] Optionally, the tenant block device is a logical structure that implements tenant data processing, and can run in a security chip and storage device in an encryption card device. After creating the tenant block device, each tenant block device is bound to a corresponding communication channel of the encryption card device. For example, Figure 2 Schematic diagram of the structure of a tenant block device provided in an embodiment of the present application. Figure 2 In it, communication channel 1, communication channel 2 and communication channel N correspond to tenant block device 1, tenant block device 2 and tenant block device N respectively. The tenant block device mainly includes the following contents: device identification, mapping address, encrypted file system, index storage address, hardware algorithm queue mapping address and block device status.

[0070] Each tenant block device has a unique device identifier, and the mapping address may be a target buffer address, that is, a specific address assigned by the computer to each tenant block device. Exemplarily, the device identifier may be a 32-bit hash value.

[0071] The Encrypting File System (EFS) is used to store and manage tenant data of tenants. The parameters for configuring the encrypted file system may include the storage start address, offset, interface file, and random number block handle of the valid storage area corresponding to the storage area, and establish logical isolation in the storage area, so as to encrypt and protect the tenant data. Among them, the storage start address is the entry address of the valid storage area in the storage area corresponding to the encrypted file system. The offset is the space that the tenant block device can use to store tenant data, and the offset can be adjusted according to user settings. Exemplarily, the offset range can be 64 kilobytes to 4 megabytes, and the user can adjust the offset by increasing or decreasing an integer multiple of 4 kilobytes. The interface file is a file input and output interface handle, so that data transmission is realized by calling the input and output interface. The file can set the input and output encapsulation of the corresponding storage area of ​​the access encryption card device, and the interface file can be set and adjusted according to the type of storage device where the storage area is located. The interface file can set an interface for page read operations facing the storage device, an interface for page write operations facing the storage device, and an interface for erasing a specified page of the storage device. The padding random number block handle is a unique identifier of a code block that handles random number generation. The code block is used to write a random number of random length within a preset random number length threshold range in the isolation area when the tenant block device is initialized, and is used as isolation padding between encrypted file systems to prevent tenant data from being accessed across boundaries. The preset random number length threshold range can be, for example, 4 kilobytes to 32 kilobytes.

[0072] The index storage address is used to store the key index, which is the index information of each key in the key model. The key module includes a 128-bit symmetric key stored in the on-chip non-volatile memory (Flash) in the security chip in the encryption card device.

[0073] The hardware algorithm queue mapping address is the address of the hardware algorithm queue in the mapped memory, and is used to access the memory mapping of the encryption module of the encryption card device.

[0074] The block device status is used to mark the current block device status. Specifically, the block device status may include: unmapped status, initializing, in use, and allocated status. Among them, the unmapped status indicates that the tenant block device has not been used. In the unmapped state, the encrypted file system is not mapped or is empty, and no key index is generated. Initializing indicates that the tenant block device is currently initializing the encrypted file system. In use indicates that the tenant block device is in use, such as reading data or writing data. The allocated state indicates that the tenant block device has been bound to the tenant, and the configuration is completed and waiting for use.

[0075] Figure 3 Schematic diagram of a block device state transition provided by an embodiment of the present application. Figure 3 As shown in the figure, before a tenant binds a tenant block device, the tenant block device is initialized first, and the status indicator is changed from unmapped to initializing. After formatting is completed, it is bound to the tenant, and the status of the tenant block device is changed to allocated. When the tenant block device reads or writes data, the status is changed to in use, and the in use status is maintained until the tenant logs out, then the content of the storage space is erased and the status is changed to unmapped.

[0076] It is worth noting that each tenant block device corresponds to an encrypted file system, and tenants cannot access data across encrypted file systems.

[0077] S102: Initialize each encrypted file system.

[0078] Optionally, the encrypted file system corresponding to each tenant block device may be initialized by determining the storage entry address and offset of the encrypted file system of each tenant block device.

[0079] The purpose of initializing the encrypted file system corresponding to each tenant block device is to clear the data in the valid storage area in the storage space corresponding to the tenant block device in advance, so as to receive and write the tenant's data in the valid storage area.

[0080] S103. Allocate a target tenant block device for the tenant from a plurality of tenant block devices according to the tenant's request information, wherein the storage area corresponding to the initialized target tenant block device includes an adjacent valid storage area in the storage space of the encryption card device and an isolation area of ​​random length, and the isolation area stores randomly generated data.

[0081] Specifically, each tenant block device has a device identifier, and the target tenant block device is allocated according to the tenant's request information and the device identifier of the tenant block device. The tenant's request information is used to request binding of the tenant block device.

[0082] Optionally, the storage area is a storage device with flash memory function outside the security chip in the encryption card device. The effective storage area in the storage area is used to store tenant data, the length of the isolation area is random, and the stored data is randomly generated, which is used to isolate the encrypted file system of each tenant block device.

[0083] It is worth noting that the order of initializing each encrypted file system and allocating a target tenant block device to each tenant is not limited and can be set according to the actual needs of the user.

[0084] S104: Acquire the original tenant data of the tenant, generate encrypted target tenant data according to the original tenant data, and store the target tenant data in a valid storage area of ​​the target tenant block device.

[0085] Specifically, the original tenant data of the tenant can be obtained by calling the Portable Operating System Interface (POSIX) application programming interface.

[0086] As an example, the original tenant data of the tenant may include critical security parameters (CSP) and security data. Among them, CSP may include the device signature key pair, encryption key pair and key protection key of the encryption card device, and the security data may include the tenant's honey key pair, password hash and public key certificate.

[0087] As an optional implementation, the original tenant data is encrypted according to the key index and the hardware algorithm queue mapping address corresponding to the original tenant data to generate encrypted target tenant data.

[0088] In this embodiment, multiple tenant block devices are created, and the encrypted file system corresponding to each tenant block device is initialized, and then the target tenant device is allocated to the tenant according to the tenant's request information. Among them, the storage area corresponding to the target tenant block device includes adjacent valid storage areas and isolation areas. The isolation area stores randomly generated data, thereby streamlining the structure of logical isolation, and each tenant block device deploys an encrypted file system, so it is suitable for data isolation of encryption card devices with limited resources, and each tenant cannot access the data of other tenants across the encrypted file system. Since the isolation area stores randomly generated data and the length of the isolation area is also random, there is no need to use a partition table and directory structure, which improves the anti-cracking capability. Then the original tenant data of the tenant is obtained and the encrypted target tenant data is generated, and the target tenant data is stored in the valid storage area of ​​the target tenant block device. This embodiment uses a storage space with logical isolation protection to store encrypted tenant data, thereby realizing multi-tenant data isolation under the condition of low-configuration hardware resources.

[0089] Based on the above data processing method, Figure 4 The method for creating multiple tenant block devices in step S101 is introduced. Figure 4 It is a flowchart of a method for creating a tenant block device provided in an embodiment of the present application.

[0090] S401: Create a tenant block device structure corresponding to each communication channel of the encryption card device.

[0091] As an optional implementation, after the encryption card device is powered on for the first time, a tenant block device structure may be created according to the maximum number of communication channels corresponding to the encryption card device, wherein the tenant block device structure is bound to the target buffer address corresponding to the corresponding communication channel.

[0092] S402: Generate an identifier of each tenant block device structure according to an identifier of the communication channel.

[0093] As an optional implementation, the identifier of the tenant block device structure is the device identifier, which can be determined by the serial number of the encryption card device, the security chip identifier in the encryption card device, and the identifier of the communication channel.

[0094] S403: Create an encrypted file system structure corresponding to the tenant block device structure, and determine a hardware algorithm queue mapping address and an index storage address.

[0095] Optionally, the hardware algorithm queue mapping address may be called by the encryption file system when encrypting tenant data, and the original tenant data and the target tenant data are stored in the hardware algorithm queue corresponding to the hardware algorithm queue mapping address.

[0096] Optionally, the index storage address is used to store the key index. As an optional implementation, the key index is randomly generated.

[0097] Optionally, the hardware algorithm queue mapping address and the index storage address are stored in a RAM in a security chip in the encryption card device.

[0098] S404: fill in the tenant block device structure according to the structure identifier of the tenant block device, the encrypted file system structure, the hardware algorithm queue mapping address and the index storage address to obtain the tenant block device.

[0099] As an optional implementation, a block device status structure may also be created to store the block device status. The tenant block device structure is filled according to the structure identifier of the tenant block device, the encrypted file system structure, the hardware algorithm queue mapping address, the index storage address and the block device status structure to obtain the tenant block device.

[0100] During the process of creating a tenant block device, it can be indicated that the fast device state of the tenant block device is in an unmapped state.

[0101] In this embodiment, by creating a tenant block device structure, generating an identifier of the tenant block device structure, creating an encrypted file system structure, determining the hardware algorithm queue mapping address and index storage address, and thus obtaining a tenant block device by filling in the tenant block device structure, the isolation of each tenant's data is completed, thereby improving the security of the tenant's data.

[0102] Further, refer to Figure 5 The encrypted file system structure corresponding to the tenant block device structure created in step S403 is introduced. Figure 5 It is a flowchart of a method for creating an encrypted file system structure provided in an embodiment of the present application.

[0103] S501, bind the interface file and fill the random number block handle, and set the physical start address and the offset corresponding to each tenant block device.

[0104] Optionally, the interface file and random number block fill handle of each tenant block device may be the same.

[0105] As an optional implementation, the larger the storage space of the storage device, the larger the offset of each tenant block device.

[0106] The physical start address is the start address where the storage device can start storing data, and there is only one physical start address in the storage device.

[0107] S502. According to the physical start address and the offset corresponding to each tenant block device, call the fill random number block handle to fill the isolation area corresponding to the tenant block device, determine the storage start address and storage end address of the valid storage area corresponding to each encrypted file system, and save the storage start address and storage end address of each encrypted file system in the security chip in the encryption card device.

[0108] Specifically, first, the physical start address is used as the storage start address of the valid storage area in the storage space corresponding to the first tenant block device, and the isolation start address of the isolation area of ​​the first tenant block device is determined according to the physical start address and the offset corresponding to the first tenant block device, and the filling random number block handle is called to fill the isolation area corresponding to the first tenant block device, and the isolation end address of the isolation area is used as the storage start address of the valid storage area in the storage space corresponding to the second tenant block device, and then the isolation end address of the isolation area of ​​the second tenant block device is determined according to the storage start address and offset of the second tenant block device, and so on, until the isolation end address of the isolation area of ​​the last tenant block device is determined, and the isolation end address is used as the physical end address of the storage space.

[0109] As an optional implementation, the physical end address of the storage space may be stored in a security chip in the encryption card device.

[0110] Specifically, the storage start address and storage end address of each encrypted file system are stored in an on-chip random access memory (RAM) in a security chip in the encryption card device.

[0111] S503: Create an encrypted file system instance according to the storage start address and storage end address of each encrypted file system.

[0112] Optionally, the encrypted file system instance may include an intermediate layer, which is used to connect with the POSIX API to transmit original tenant data. The intermediate layer can also interact with the storage device through an interface file.

[0113] In this embodiment, by binding the interface file and filling the random number block handle, setting the physical start address and the offset corresponding to each tenant block device, filling the isolation area corresponding to each tenant block device, determining and storing the storage start address and storage end address of the valid storage area corresponding to each encrypted file system, an encrypted file instance is created. In this process, the length of the isolation area corresponding to each tenant block device is different, so that the valid storage area corresponding to each encrypted file system is irregular, thereby ensuring the security of the tenant data of each tenant.

[0114] As an example, Figure 6is a schematic diagram of the structure of a storage device provided in an embodiment of the present application. Figure 6 , the encrypted file system of each tenant block device can be set corresponding to each valid storage area and each isolation area in the storage space of the storage device, and the original tenant data can be encrypted respectively through the key index in the key storage address, and the encrypted target tenant data is stored in the valid storage area. Among them, the storage start address of the valid storage area of ​​tenant block device 1 can be the physical start address of the storage device, the storage end address can be the isolation start address, and the isolation end address of tenant block device N can be the physical end address. The size of the valid storage area and the isolation area corresponding to each tenant block device can be different. The data of each tenant block device is stored between the physical start address and the physical end address of the storage device.

[0115] As an optional implementation, the steps of initializing each encrypted file system in the above step S102 are as follows:

[0116] Optionally, according to the storage start address and the storage end address in the storage space corresponding to the encrypted file system of the tenant block device, the data between the storage start address and the storage end address are erased.

[0117] As an optional implementation, before erasing the data between the storage start address and the storage end address, the block device state can be set to initializing. After erasing the data between the storage start address and the storage end address, the block device state can be set to allocated.

[0118] Next, refer to Figure 7 The step of generating encrypted target tenant data according to the original tenant data in step S104 and storing the target tenant data in the valid storage area of ​​the target tenant block device is introduced. Figure 7 It is a flowchart of a method for generating and storing target tenant data proposed in an embodiment of the present application.

[0119] S701. Determine the key index corresponding to the original tenant data.

[0120] Optionally, the key index corresponding to the original tenant data may be determined based on whether the target tenant block device currently has a key index.

[0121] As an optional implementation, before determining the key index corresponding to the original tenant data, the block device status of the tenant block device may be marked as in use.

[0122] It is worth noting that in the same encryption card device, the key indexes corresponding to different tenant block devices are different.

[0123] S702. Store the original tenant data in the hardware algorithm queue corresponding to the hardware algorithm queue mapping address corresponding to the target tenant block device in the security chip of the encryption card device, and store the key index in the index storage address corresponding to the target tenant block device in the security chip.

[0124] Specifically, the original tenant data is read using a read pointer, and the original tenant data is sequentially mapped to the hardware algorithm queue indicated by the hardware algorithm queue mapping address.

[0125] S703: The encryption module of the encryption card device encrypts the original tenant data according to the original tenant data and the key index stored in the hardware algorithm queue to obtain the target tenant data, and stores the target tenant data in the hardware algorithm queue corresponding to the target tenant block device.

[0126] Optionally, the encryption module may be in hardware or software form, and is used to encrypt the received data according to the key index using a preset encryption algorithm. Specifically, the original tenant data is encrypted using the target key indicated by the key index.

[0127] S704. The encrypted file system of the target tenant block device reads the target tenant data from the hardware algorithm queue corresponding to the target tenant block device, and stores the target tenant data in the valid storage area corresponding to the target tenant block device according to the storage start address and offset of the valid storage area corresponding to the target tenant block device.

[0128] Specifically, the target tenant data is read from the hardware algorithm queue corresponding to the hardware algorithm queue mapping address corresponding to the target tenant block device by the interface file in the encrypted file system of the target tenant block device.

[0129] As an optional implementation, after step S704, it can also be determined whether the read pointer of the original tenant data points to the end of the original tenant data. If so, the data storage is completed. If not, continue to perform steps S702 to S704 until the read pointer of the original tenant data points to the end of the original tenant data.

[0130] In this embodiment, by determining the key index corresponding to the original tenant data, and then storing the original tenant data in the hardware algorithm queue, the encryption module encrypts the original tenant data according to the original tenant data and the key index, and obtains and stores the target tenant data in the valid storage area corresponding to the target tenant block device through the hardware algorithm queue, thereby realizing the tenant data writing action of the encryption card device. The security of the tenant data is guaranteed by the unique key index of each tenant block device.

[0131] Further, based on the method of writing tenant data, refer to Figure 8The process of encrypting the original tenant data according to the original tenant data and key index stored in the hardware algorithm queue in step S703 to obtain the target tenant data is introduced. Figure 8 It is a flowchart of a method for obtaining target tenant data provided in an embodiment of the present application.

[0132] S801. Read original tenant data from a hardware algorithm queue corresponding to a target tenant block device, and read a key index from an index storage address corresponding to the target tenant block device.

[0133] Specifically, jump to the return address of the hardware algorithm queue, and read the original tenant data in sequence based on the read pointer.

[0134] S802: According to the key index, obtain the target key indicated by the key index from the key module of the encryption card device.

[0135] Optionally, since the key index of each tenant block device is different, the target key of each tenant block device is also different, so that the tenant data of each tenant is encrypted separately. Tenants cannot obtain data of other tenants.

[0136] S803: Use the target key to encrypt the original tenant data to obtain the target tenant data.

[0137] Optionally, if the target key in the key module indicated by the key index is a symmetric key, the algorithm in the encryption module may be a symmetric algorithm.

[0138] In this embodiment, the target key is determined by using the key index, and the original tenant data is encrypted by using the target key to obtain the target tenant data, thereby protecting the tenant's data security.

[0139] As an optional implementation, Fig. 9 This is a schematic diagram of a process for encrypting and storing tenant data provided by an embodiment of the present application. Fig. 9 In the process, the encryption card device receives the original tenant data of the tenant through the POSIX API, the middle layer in the encryption file system calls the key index, and sends the key index and the original tenant data to the hardware algorithm queue in the on-chip RAM, and polls the encryption return result of the hardware algorithm queue. In this process, the key index is used to call the key from the key module and the encryption module is used to encrypt the original tenant data. All the encryption return results are used as the target tenant data, and the target tenant data is sent to the storage device for storage using the interface file.

[0140] As an optional implementation, the step of determining the key index corresponding to the original tenant data in the above step S701 may be as follows:

[0141] Optionally, determine whether the target tenant block device currently has a key index.

[0142] Specifically, it is determined whether there is a key index in the index storage address in the target tenant block device.

[0143] Optionally, before determining whether the target tenant block device currently has a key index, the block device state may also be marked as in use.

[0144] Optionally, if the key index does not currently exist, it means that the encrypted file system in the tenant block data stores the tenant data for the first time. When the tenant uses the target tenant block device to store data again, the key index will be stored in the index storage address.

[0145] Optionally, if not, a key index is randomly generated and stored in a security chip in the encryption card device.

[0146] Optionally, the key index may be randomly generated according to each key in the key module.

[0147] As an optional implementation, to ensure that tenant data can be successfully stored, after the key index is stored in the on-chip Flash in the security chip in the encryption card device, it can be determined whether the interface file is complete. If it is incomplete, the interface file is rebound.

[0148] In this embodiment, it is determined whether a key index currently exists in the target tenant block device and a key index is randomly generated. By determining whether the key index exists, it is ensured that the stored tenant data can be encrypted, and by randomly generating a key index, the security of the tenant data is ensured.

[0149] As an optional implementation, the data processing method in the present application may further include the following steps: This step is a process of reading tenant data of a tenant from a storage device corresponding to a target tenant block device.

[0150] Optionally, according to the tenant's data read request for the target tenant block device, the target tenant data is read from the valid storage area corresponding to the target tenant block device through the encrypted file system of the target tenant block device, and the target tenant data is stored in the hardware algorithm queue corresponding to the target tenant block device.

[0151] Optionally, the data read request may be obtained through a POSIX API read interface, and the data read request may include a size of the requested data.

[0152] Optionally, the target tenant data is encrypted tenant data and can be read from a storage device through an interface file in an encrypted file system.

[0153] Optionally, the encryption module of the encryption card device reads the target tenant data from the hardware algorithm queue, reads the key index from the index storage address corresponding to the target tenant block device in the security chip, and generates and outputs the decrypted original tenant data based on the target tenant data and the key index.

[0154] It is worth noting that when encrypting and storing the tenant's tenant data, the key index is saved in the index storage address. When reading and decrypting the tenant's tenant data, the key index stored in the index storage address is obtained to decrypt the tenant data. In this process, the key used for encryption and the key used for decryption are the same, so the key index is the same.

[0155] As an optional implementation, after generating and outputting the decrypted original tenant data according to the target tenant data and the key index, it is also possible to check whether the size of the read data exceeds the size of the requested data. If it exceeds, the data before this reading is used as the decrypted original tenant data, and the tenant data reading is completed. If it does not exceed, continue to execute the steps of reading the target tenant data from the valid storage area corresponding to the target tenant block device through the encrypted file system of the target tenant block device and the subsequent steps.

[0156] In this embodiment, the target tenant data is stored in the hardware algorithm queue according to the tenant's data read request, and then the decrypted original tenant data is generated and output using the key index read from the index storage address, so that the tenant can decrypt and read the tenant data.

[0157] Fig.10 This is a flow chart of a method for generating and outputting decrypted original tenant data provided by an embodiment of the present application. Fig.10 This section describes the specific steps for generating and outputting decrypted original tenant data.

[0158] S1001. According to a key index, obtain a target key indicated by the key index from a key module of an encryption card device.

[0159] The target key is the same as the target key used by the current tenant when writing tenant data.

[0160] S1002. Decrypt the target tenant data using the target key to obtain the original tenant data, and store the original tenant data in the hardware algorithm queue corresponding to the target tenant block device.

[0161] Specifically, the target key is used to perform decryption through a decryption algorithm in an encryption module of the encryption card device, and the decryption result in the encryption module is polled.

[0162] S1003: The encrypted file system of the target tenant block device reads the original tenant data from the hardware algorithm queue corresponding to the target tenant block device, and outputs the original tenant data.

[0163] Specifically, the encrypted file system reads the original tenant data from the hardware algorithm queue corresponding to the hardware algorithm queue mapping address corresponding to the target tenant block device based on the read pointer.

[0164] In this embodiment, the target key is determined by the key index, and the target tenant data is decrypted using the target key to obtain the original tenant data, which is stored in the hardware algorithm queue and read and output from the queue to output the complete decrypted tenant data.

[0165] As an optional implementation, Fig.11 This is a flow chart of reading and decrypting tenant data provided by an embodiment of the present application. Fig.11 In the process, the encryption card device uses the interface file to read the target tenant data from the storage device, and then the encryption file system middle layer calls the key index, and sends the key index and the target tenant data to the hardware algorithm queue in the on-chip RAM, and polls the decryption return result of the hardware algorithm queue. In this process, the key is called from the key module based on the key index and the encryption module is used to decrypt the target tenant data. All the decryption return results are used as the decrypted original tenant data, and the original tenant data is output using the POSIX API.

[0166] It is worth noting that the encryption card device includes a security chip, which includes an on-chip RAM and an on-chip Flash. A storage device is provided outside the security chip inside the encryption card device to store the target tenant data of the tenant.

[0167] As an optional implementation, Fig.12 is a flow chart of another data processing method provided in an embodiment of the present application. Fig.12 As shown, the data processing method further includes the following steps. This step is performed when the tenant logs out.

[0168] S1201. According to a deregistration request of a tenant for a target tenant block device, obtain a storage start address and an offset of a valid storage area of ​​the target tenant block device.

[0169] S1202. Call the fill random number block handle to fill the valid storage area of ​​the target tenant block device according to the storage start address and offset.

[0170] Specifically, the bytes in the valid storage area corresponding to the tenant can be erased according to the storage start address and offset based on the interface file, and then the fill random number block handle is called to fill the random numbers into the valid storage area.

[0171] As an optional implementation, the storage start address and storage end address of the valid storage area of ​​the target tenant block device can be obtained, and the filling random number block handle is called according to the storage start address and offset to fill the valid storage area of ​​the target tenant block device.

[0172] S1203. Clear the key index in the index storage address.

[0173] Among them, the key index in the index storage address is cleared so that the new tenant can use the tenant block device for data storage, and the key used for encryption is different, thereby protecting the data of the tenant in the card.

[0174] In this embodiment, the storage start address and offset of the valid storage area of ​​the target tenant block device are obtained according to the tenant's deregistration request, the filling random number block handle is called to fill the valid storage area of ​​the target tenant block device, and the key index in the index storage address is cleared, thereby reclaiming the tenant block device of the deregistered tenant so that the tenant block device can be initialized and used again.

[0175] The embodiment of the present application also provides an encryption card device, which is used to perform data processing based on the above-mentioned data processing method steps.

[0176] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned data processing method are executed.

[0177] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0178] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or part of the technical solution that contributes to the prior art or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), disk or optical disk and other media that can store program code.

[0179] The above are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be covered by the protection scope of the present application.

Claims

1. A data processing method, characterized in that: The method is applied to an encryption card device, and the method comprises: Creating a plurality of tenant block devices according to the number of communication channels of the encryption card device, each of the tenant block devices deploying an encrypted file system; Initialize each encrypted file system; Allocate a target tenant block device for the tenant from the plurality of tenant block devices according to the tenant's request information, wherein the storage area corresponding to the initialized target tenant block device includes an adjacent valid storage area in the storage space of the encryption card device and an isolation area of ​​random length, and the isolation area stores randomly generated data; The original tenant data of the tenant is obtained, and encrypted target tenant data is generated according to the original tenant data, and the target tenant data is stored in the valid storage area of ​​the target tenant block device.

2. The data processing method according to claim 1, characterized in that: The step of creating a plurality of tenant block devices according to the number of communication channels of the encryption card device comprises: Creating a tenant block device structure corresponding to each communication channel of the encryption card device; Generating an identifier of each of the tenant block device structures according to an identifier of the communication channel; Create an encrypted file system structure corresponding to the tenant block device structure, and determine the hardware algorithm queue mapping address and index storage address; The tenant block device structure is filled according to the identifier of the tenant block device structure, the encrypted file system structure, the hardware algorithm queue mapping address and the index storage address to obtain the tenant block device.

3. The data processing method according to claim 2, characterized in that: The step of creating an encrypted file system structure corresponding to the tenant block device structure includes: Bind the interface file and fill the random number block handle, and set the physical start address and the offset corresponding to each tenant block device; According to the physical start address and the offset corresponding to each tenant block device, calling the filling random number block handle to fill the isolation area corresponding to the tenant block device, determining the storage start address and storage end address of the valid storage area corresponding to each encrypted file system, and saving the storage start address and storage end address of each encrypted file system in the security chip in the encryption card device; An encrypted file system instance is created according to the storage start address and storage end address of each encrypted file system.

4. The data processing method according to claim 3, characterized in that: The initializing each encrypted file system includes: According to the storage start address and the storage end address in the storage space corresponding to the encrypted file system of the tenant block device, data between the storage start address and the storage end address is erased.

5. The data processing method according to claim 1, characterized in that: The step of generating encrypted target tenant data according to the original tenant data and storing the target tenant data in the valid storage area of ​​the target tenant block device comprises: Determine the key index corresponding to the original tenant data; The original tenant data is stored in a hardware algorithm queue corresponding to a hardware algorithm queue mapping address corresponding to the target tenant block device in the security chip of the encryption card device, and the key index is stored in an index storage address corresponding to the target tenant block device in the security chip; The encryption module of the encryption card device encrypts the original tenant data according to the original tenant data and the key index stored in the hardware algorithm queue to obtain the target tenant data, and stores the target tenant data in the hardware algorithm queue corresponding to the target tenant block device; The encrypted file system of the target tenant block device reads the target tenant data from the hardware algorithm queue corresponding to the target tenant block device, and stores the target tenant data in the valid storage area corresponding to the target tenant block device according to the storage start address and offset of the valid storage area corresponding to the target tenant block device.

6. The data processing method according to claim 5, characterized in that: The encrypting the original tenant data according to the original tenant data and the key index stored in the hardware algorithm queue to obtain the target tenant data includes: Reading the original tenant data from the hardware algorithm queue corresponding to the target tenant block device, and reading the key index from the index storage address corresponding to the target tenant block device; According to the key index, obtaining a target key indicated by the key index from a key module of the encryption card device; The original tenant data is encrypted using the target key to obtain the target tenant data.

7. The data processing method according to claim 5, characterized in that: The determining the key index corresponding to the original tenant data includes: Determine whether the target tenant block device currently has a key index; If not, a key index is randomly generated and stored in a security chip in the encryption card device.

8. The data processing method according to claim 1, characterized in that: The method further comprises: According to the data read request of the tenant for the target tenant block device, the target tenant data is read from the valid storage area corresponding to the target tenant block device through the encrypted file system of the target tenant block device, and the target tenant data is stored in the hardware algorithm queue corresponding to the target tenant block device; The encryption module of the encryption card device reads the target tenant data from the hardware algorithm queue, reads the key index from the index storage address corresponding to the target tenant block device in the security chip, and generates and outputs the decrypted original tenant data according to the target tenant data and the key index.

9. The data processing method according to claim 8, characterized in that: The generating and outputting the decrypted original tenant data according to the target tenant data and the key index includes: According to the key index, obtaining a target key indicated by the key index from a key module of the encryption card device; Decrypt the target tenant data using the target key to obtain original tenant data, and store the original tenant data in a hardware algorithm queue corresponding to the target tenant block device; The encrypted file system of the target tenant block device reads the original tenant data from the hardware algorithm queue corresponding to the target tenant block device, and outputs the original tenant data.

10. The data processing method according to any one of claims 1 to 9, characterized in that: The method further comprises: According to the tenant's deregistration request for the target tenant block device, obtaining a storage start address and an offset of a valid storage area of ​​the target tenant block device; According to the storage start address and offset, calling the fill random number block handle to fill the valid storage area of ​​the target tenant block device; Clear the key index in the index storage address.

11. An encryption card device, characterized in that: The encryption card device is used to perform data processing based on the steps of the data processing method according to any one of claims 1 to 10.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data processing method according to any one of claims 1 to 10 are executed.

Images