Full-disk encryption storage method and device transparent to upper layer

Abstract

The invention discloses a full-disk encryption storage method and device transparent to an upper layer. The method comprises the following steps: verifying user permission through a set program; after the permission verification is passed, setting a first encryption key; generating a second encryption key according to the first encryption key; obtaining a secret key input by a user, and verifying the input secret key; when a user sends a write request, copying the write request and the original data; encrypting the original data to obtain encrypted data, and writing the encrypted data into a disk; when a user sends a read request, reading the encrypted data from the disk; decrypting the encrypted data to obtain decrypted data, and returning the decrypted data to the user; and when the system is damaged, decrypting the encrypted data in the disk to obtain original data and returning the original data to a user. According to the method, the overhead in the aspects of system configuration and application migration caused by intrusion to an upper layer is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of disk encryption processing, and in particular to a full disk encryption storage method and device which is transparent to an upper layer. Background Art

[0002] The existing full-disk encryption storage method under Linux is based on device-mapper. Device-mapper creates virtual block devices based on the original block devices for users to use. This virtual device layer is responsible for handling all data read and write operations, and performs encryption and decryption operations during data transmission to ensure the security of data on the storage medium. Specifically, device-mapper uses the "crypt mapping" function to transparently insert data encryption operations into the data access path, so that users do not need to perceive the details of the encryption process when using encrypted storage.

[0003] The principle of this method is to map the read and write requests of the physical disk to an encryption layer, and perform necessary encryption and decryption operations in the encryption layer to ensure that the data is encrypted before writing to the disk and decrypted when reading. The virtual block device acts as a "mediator" for the data, providing encryption services between the physical device and the file system.

[0004] However, this full disk encryption storage solution also has some disadvantages. First, the original device files of the system will be replaced with new encrypted device files, which requires users and applications to adjust to use the new device files, which brings additional management burden. Any misoperation of the device files may cause data to be inaccessible and even cause system failure.

[0005] Secondly, along with the replacement of device files, system configuration files also need to be changed accordingly, involving the update of configurations such as mount points and startup scripts. Such configuration changes increase system complexity and may cause compatibility issues, especially during maintenance and upgrades, which can easily cause system instability.

[0006] Therefore, how to invent a full disk encryption method that is completely transparent to the upper layer and reduce the overhead in system configuration and application migration caused by intrusion into the upper layer in the prior art has become an urgent problem to be solved. Summary of the invention

[0007] To this end, the present invention provides a full-disk encryption storage method and device that is transparent to the upper layer. The upper layer can migrate applications to the encrypted storage solution completely transparently and imperceptibly without changing the operation mode of the application, thereby reducing the overhead in system configuration and application migration caused by intrusion into the upper layer.

[0008] In order to achieve the above object, the present invention provides the following technical solution: a full disk encryption storage method transparent to the upper layer, comprising:

[0009] Verify user permissions through set procedures;

[0010] After passing the authority verification, a first encryption key is set; a second encryption key is generated according to the first encryption key, and the second encryption key is associated with the disk check block to complete the disk check block initialization processing;

[0011] Obtaining a key input by a user, verifying the input key through the disk verification block, and performing corresponding processing according to the verification result;

[0012] When a user issues a write request, the write request and the original data are copied; the original data is encrypted to obtain encrypted data, and the encrypted data is written to the disk;

[0013] When a user issues a read request, the encrypted data is read from the disk; the encrypted data is decrypted to obtain decrypted data, and the decrypted data is returned to the user;

[0014] When system damage occurs, the encrypted data in the disk is decrypted to obtain the original data, and the original data is returned to the user.

[0015] As a preferred solution for a full-disk encryption storage method that is transparent to the upper layer, during the process of verifying user permissions through the setting program, if the user's permissions are insufficient, the system rejects the user's request; if the user's permissions meet the requirements, the system authorizes subsequent data operation processing.

[0016] As a preferred solution for a full-disk encryption storage method that is transparent to the upper layer, during the process of verifying the input key through the disk check block and performing corresponding processing based on the verification result, if the input key is consistent with the first encryption key, subsequent data operation processing is performed; if the input key is inconsistent with the first encryption key, the user request is rejected.

[0017] As a preferred solution of a full disk encryption storage method that is transparent to the upper layer, after the encrypted data is written to the disk, if the disk is physically accessed, the original data cannot be directly read.

[0018] As a preferred solution of a full disk encryption storage method transparent to the upper layer, in the process of encrypting the original data, the original data is encrypted by using the XTS (AES)-128 encryption algorithm.

[0019] The present invention also provides a full disk encryption storage device transparent to the upper layer, based on the above full disk encryption storage method transparent to the upper layer, comprising:

[0020] The permission verification module is used to verify the user's permission through the setting program;

[0021] An encryption key setting module is used to set a first encryption key after passing the authority verification; generate a second encryption key according to the first encryption key, and associate the second encryption key with the disk check block to complete the disk check block initialization processing;

[0022] The key verification module is used to obtain the key input by the user, verify the input key through the disk verification block, and perform corresponding processing according to the verification result;

[0023] A write request processing module, used for copying the write request and original data when a user issues a write request; encrypting the original data to obtain encrypted data, and writing the encrypted data to a disk;

[0024] A read request processing module, used for reading the encrypted data from the disk when a user issues a read request; decrypting the encrypted data to obtain decrypted data, and returning the decrypted data to the user;

[0025] The system damage processing module is used to decrypt the encrypted data in the disk to obtain the original data when system damage occurs, and return the original data to the user.

[0026] As a preferred solution for a full-disk encryption storage device that is transparent to the upper layer, in the permission verification module, during the process of verifying user permissions through the setting program, if the user's permissions are insufficient, the system rejects the user's request; if the user's permissions meet the requirements, the system authorizes subsequent data operation processing.

[0027] As a preferred solution for a full-disk encryption storage device that is transparent to the upper layer, in the key verification module, during the process of verifying the input key through the disk verification block and performing corresponding processing based on the verification result, if the input key is consistent with the first encryption key, subsequent data operation processing is performed; if the input key is inconsistent with the first encryption key, the user request is rejected.

[0028] As a preferred solution for a full disk encryption storage device that is transparent to an upper layer, in the write request processing module, after the encrypted data is written to the disk, if the disk is physically accessed, the original data cannot be directly read.

[0029] As a preferred solution for a full-disk encryption storage device that is transparent to an upper layer, in the write request processing module, during the process of encrypting the original data, the original data is encrypted using an XTS (AES)-128 encryption algorithm.

[0030] The present invention has the following advantages: verifying user authority through setting program; setting a first encryption key after authority verification; generating a second encryption key according to the first encryption key, and associating the second encryption key with a disk check block to complete the disk check block initialization processing; obtaining the key input by the user, verifying the input key through the disk check block, and performing corresponding processing according to the verification result; when the user issues a write request, copying the write request and the original data; encrypting the original data to obtain the encrypted data, and writing the encrypted data to the disk; when the user issues a read request, reading the encrypted data from the disk; decrypting the encrypted data to obtain the decrypted data, and returning the decrypted data to the user; when the system is damaged, decrypting the encrypted data in the disk to obtain the original data, and returning the original data to the user. The full disk encryption storage method provided by the present invention allows the upper layer to migrate the application to the encryption storage solution completely transparently and imperceptibly, and will not change the operation mode of the application. Users and applications can operate the file system normally as if using unencrypted data, without modifying the existing software or system configuration. This makes the encryption process transparent to users and applications, reducing operational complexity. The present invention utilizes hardware to accelerate the encryption and decryption process, which can effectively improve encryption and decryption performance. By transferring encryption tasks to hardware, the CPU load can be effectively reduced and the efficiency of the overall system can be improved. Hardware acceleration makes the encryption and decryption process closer to real-time processing, reducing delays to user operations. The present invention integrates the encryption and decryption process into existing drivers (such as bcache drivers), eliminating the virtual device layer in the general device-mapper, effectively reducing the cost of application migration and reducing complex configuration and management costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0032] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment of size shall still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0033] Figure 1 It is a flowchart of a full disk encryption storage method transparent to an upper layer provided in Embodiment 1 of the present invention;

[0034] Figure 2 A schematic diagram of a write request processing flow in a possible embodiment provided in Embodiment 1 of the present invention;

[0035] Figure 3 A schematic diagram of a read request processing flow in a possible embodiment provided in Embodiment 1 of the present invention;

[0036] Figure 4 This is a schematic diagram of the architecture of a full-disk encryption storage device that is transparent to the upper layer provided in Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0037] The following is a description of the implementation of the present invention by specific embodiments. People familiar with the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] Example 1

[0039] See also Figure 1 Embodiment 1 of the present invention provides a full disk encryption storage method transparent to an upper layer, comprising the following steps:

[0040] S1. Verify user permissions by setting procedures;

[0041] S2. After passing the authority verification, set a first encryption key; generate a second encryption key according to the first encryption key, and associate the second encryption key with the disk check block to complete the disk check block initialization process;

[0042] S3, obtaining the key input by the user, verifying the input key through the disk verification block, and performing corresponding processing according to the verification result;

[0043] S4. When the user issues a write request, the write request and the original data are copied; the original data is encrypted to obtain encrypted data, and the encrypted data is written to the disk;

[0044] S5. When the user issues a read request, the encrypted data is read from the disk; the encrypted data is decrypted to obtain decrypted data, and the decrypted data is returned to the user;

[0045] S6. When system damage occurs, the encrypted data in the disk is decrypted to obtain the original data, and the original data is returned to the user.

[0046] In this embodiment, in step S1, the user authority is verified by setting a program;

[0047] Specifically, before any operation begins, the system verifies the user's permissions. If the user's permissions are insufficient, the system will deny all requests. This step ensures that only authorized users can perform encryption and decryption operations, ensuring data security and access control. For example, if an unauthorized user attempts to set a key or decrypt, their request will be denied.

[0048] In this embodiment, in step S2, after passing the authority verification, a first encryption key is set; a second encryption key is generated according to the first encryption key, and the second encryption key is associated with the disk check block to complete the disk check block initialization process;

[0049] Specifically, the user sets an encryption key and uses the key to regenerate an encryption key and initialize a disk check block. This step involves generating a security key and associating it with a check block on the disk for subsequent key verification and data encryption. For example, if the user sets the key to 01234567, the system will regenerate an encryption key based on this key and initialize a disk block.

[0050] In this embodiment, in step S3, the key input by the user is obtained, the input key is verified by the disk verification block, and corresponding processing is performed according to the verification result;

[0051] Specifically, the user enters the key, and the system uses the disk check block to verify the correctness of the key. This step ensures that the key entered by the user is consistent with the key set during initialization. Only the key that passes the verification is allowed to perform data operations. For example: the user sets the key to 01234567, but enters the key as 12345678. The key verification fails, and the request is rejected.

[0052] In this embodiment, in step S4, when the user issues a write request, the write request and the original data are copied; the original data is encrypted to obtain encrypted data, and the encrypted data is written to the disk;

[0053] Specifically, for a write request from a user, the system will copy the original request and data and encrypt the data. The encrypted data will then be written to the disk. This ensures that the data written to the disk is encrypted, and even if the disk is physically accessed, the original data cannot be directly read. For example: if a user writes the character 'A', it may be encrypted into the binary number '0xF8' and written to the disk.

[0054] Among them, the encryption algorithm used in this embodiment is the XTS (AES)-128 algorithm, which is a symmetric encryption algorithm commonly used in scenarios such as disk encryption. It combines the AES (Advanced Encryption Standard) encryption algorithm and the XTS (XOR-Encrypt-XOR Tweakable Block Cipher) mode. The AES algorithm uses block encryption to divide the data into blocks of fixed size (usually 128 bits) for encryption. XTS is an encryption mode specially designed for storage encryption. It is based on a pseudo-random function and uses two different keys: one for block encryption and the other for generating a value called "tweak" to prevent the same data block from being encrypted into the same ciphertext at different locations. The algorithm is not easy to break, so it can provide strong encryption protection for data.

[0055] In this embodiment, in step S5, when the user issues a read request, the encrypted data is read from the disk; the encrypted data is decrypted to obtain decrypted data, and the decrypted data is returned to the user;

[0056] Specifically, for a read request from a user, the system will read the encrypted data from the disk, decrypt it, and then return the decrypted data to the user. This ensures that the user can get the decrypted original data when reading the data, without having to directly process the encrypted content. For example: the disk data is the binary number '0xF8', which is decrypted into the character 'A' after being read from the disk and returned to the user.

[0057] In this embodiment, in step S6, when system damage occurs, the encrypted data in the disk is decrypted to obtain the original data, and the original data is returned to the user.

[0058] Specifically, after a disaster (such as file system damage), the system can decrypt the encrypted data in the hard disk into the original data. This ensures that during the disaster recovery process, the data can be restored to its original state to avoid data loss. For example: Disk A is damaged, and the binary number '0xF8' in it is restored to a readable character 'A'.

[0059] In a possible embodiment, Figure 2 As shown, the steps to provide a user write request example are as follows:

[0060] T1. The user sends a write request;

[0061] T2, original data written and sent by the user: write_bio;

[0062] T3. Copy the bio sent by the user to copy_bio;

[0063] T4, encrypt a bio;

[0064] T5, determine whether all bio encryption is completed, if yes, proceed to the next step; if not, repeat step T4 until all bio encryption is completed;

[0065] T6. Download the encrypted data to disk;

[0066] T7. Return the original data to the upper layer.

[0067] In a possible embodiment, Figure 3 As shown, the steps to provide a user read request example are as follows:

[0068] M1. The user sends a read request;

[0069] M2, read data from disk to read_bio;

[0070] M3, decrypt one of the bios;

[0071] M4, determine whether all decryption is completed, if yes, proceed to the next step; if not, repeat step M3 until all decryption is completed;

[0072] M5. Return the decrypted data to the user.

[0073] In a possible embodiment, the overall process of full disk encryption storage transparent to the upper layer is as follows:

[0074] N1. User authority verification: Before any operation begins, the system verifies the user's authority. If the user's authority is insufficient, the system will deny all requests. This step ensures that only authorized users can perform encryption and decryption operations, ensuring data security and access control. For example, if an unauthorized user attempts to set a key or decrypt, their request will be denied.

[0075] N2. Key setting and initialization: The user sets the encryption key and uses the key to regenerate the encryption key and initialize a disk check block. This step involves generating a security key and associating it with the check block on the disk for subsequent key verification and data encryption. For example, if the user sets the key to 01234567, the system will regenerate the encryption key based on this key and initialize a disk block.

[0076] N3. Key verification: The user enters the key, and the system uses the disk check block to verify the correctness of the key. This step ensures that the key entered by the user is consistent with the key set during initialization. Only the key that passes the verification is allowed to perform data operations. For example: the user sets the key to 01234567, but enters the key as 12345678. The key verification fails and the request is rejected.

[0077] N4. Write request processing: For write requests issued by users, the system will copy the original request and data and encrypt the data. The encrypted data will then be written to the disk. This ensures that the data written to the disk is encrypted, and even if the disk is physically accessed, the original data cannot be directly read. For example: If a user writes the character 'A', it may be encrypted into the binary number '0xF8' and written to the disk.

[0078] N5. Read request processing: For a read request from a user, the system will read the encrypted data from the disk and decrypt it. The decrypted data will then be returned to the user. This ensures that the user can get the decrypted original data when reading the data without having to directly process the encrypted content. For example: the disk data is the binary number '0xF8', which is decrypted into the character 'A' after being read from the disk and returned to the user.

[0079] N6. Disaster recovery: After a disaster (such as file system damage), the system can decrypt the encrypted data in the hard disk into the original data. This ensures that during the disaster recovery process, the data can be restored to its original state to avoid data loss. For example: if disk A is damaged, the binary number '0xF8' in it can be restored to the readable character 'A'.

[0080] In summary, the present invention verifies user authority by setting a program; after passing the authority verification, sets a first encryption key; generates a second encryption key according to the first encryption key, and associates the second encryption key with the disk check block to complete the disk check block initialization processing; obtains the key input by the user, verifies the input key through the disk check block, and performs corresponding processing according to the verification result; when the user issues a write request, copies the write request and the original data; encrypts the original data to obtain the encrypted data, and writes the encrypted data to the disk; when the user issues a read request, reads the encrypted data from the disk; decrypts the encrypted data to obtain the decrypted data, and returns the decrypted data to the user; when the system is damaged, decrypts the encrypted data in the disk to obtain the original data, and returns the original data to the user. The full disk encryption storage method provided by the present invention allows the upper layer to migrate the application to the encryption storage solution completely transparently and imperceptibly, and will not change the operation mode of the application. Users and applications can operate the file system normally as if using unencrypted data, without modifying the existing software or system configuration. This makes the encryption process transparent to users and applications, reducing operational complexity. The present invention utilizes hardware to accelerate the encryption and decryption process, which can effectively improve encryption and decryption performance. By transferring encryption tasks to hardware, the CPU load can be effectively reduced and the efficiency of the overall system can be improved. Hardware acceleration makes the encryption and decryption process closer to real-time processing, reducing delays to user operations. The present invention integrates the encryption and decryption process into existing drivers (such as bcache drivers), eliminating the virtual device layer in the general device-mapper, effectively reducing the cost of application migration and reducing complex configuration and management costs.

[0081] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0082] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0083] Example 2

[0084] See also Figure 4 Embodiment 2 of the present invention further provides a full disk encryption storage device transparent to an upper layer, comprising:

[0085] The authority verification module 001 is used to verify the user authority through the setting program;

[0086] The encryption key setting module 002 is used to set a first encryption key after passing the authority verification; generate a second encryption key according to the first encryption key, and associate the second encryption key with the disk check block to complete the disk check block initialization processing;

[0087] The key verification module 003 is used to obtain the key input by the user, verify the input key through the disk verification block, and perform corresponding processing according to the verification result;

[0088] The write request processing module 004 is used to copy the write request and the original data when the user issues a write request; encrypt the original data to obtain encrypted data, and write the encrypted data to the disk;

[0089] The read request processing module 005 is used to read the encrypted data from the disk when the user issues a read request; decrypt the encrypted data to obtain decrypted data, and return the decrypted data to the user;

[0090] The system damage processing module 006 is used to decrypt the encrypted data in the disk to obtain the original data when system damage occurs, and return the original data to the user.

[0091] In this embodiment, in the permission verification module 001, during the process of verifying the user's permissions through the setting program, if the user's permissions are insufficient, the system rejects the user's request; if the user's permissions meet the requirements, the system authorizes subsequent data operation processing.

[0092] In this embodiment, in the key verification module 003, during the process of verifying the input key through the disk verification block and performing corresponding processing based on the verification result, if the input key is consistent with the first encryption key, subsequent data operation processing is performed; if the input key is inconsistent with the first encryption key, the user request is rejected.

[0093] In this embodiment, in the write request processing module 004, after the encrypted data is written to the disk, if the disk is physically accessed, the original data cannot be directly read.

[0094] In this embodiment, in the write request processing module 004, during the process of encrypting the original data, the original data is encrypted by using the XTS (AES)-128 encryption algorithm.

[0095] It should be noted that the information interaction, execution process, etc. between the modules of the above-mentioned system are based on the same concept as the method embodiment in Example 1 of the present application, and the technical effects they bring are the same as those of the method embodiment of the present application. For specific contents, please refer to the description in the method embodiment shown above in the present application, and will not be repeated here.

[0096] Example 3

[0097] Embodiment 3 of the present invention provides a non-transitory computer-readable storage medium, in which a program code of a full-disk encryption storage method that is transparent to the upper layer is stored, and the program code includes instructions for executing embodiment 1 or any possible implementation method of a full-disk encryption storage method that is transparent to the upper layer.

[0098] The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0099] Example 4

[0100] Embodiment 4 of the present invention provides an electronic device, including: a memory and a processor;

[0101] The processor and the memory communicate with each other via a bus; the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute a full-disk encryption storage method that is transparent to the upper layer and is implemented in accordance with embodiment 1 or any possible implementation thereof.

[0102] Specifically, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor implemented by reading software codes stored in a memory. The memory can be integrated in the processor or can be located outside the processor and exist independently.

[0103] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable systems. The computer instructions can be stored in a computer-readable storage medium, or transmitted from a computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.

[0104] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing system, they can be concentrated on a single computing system, or distributed on a network composed of multiple computing systems, and optionally, they can be implemented by a program code executable by a computing system, so that they can be stored in a storage system and executed by the computing system, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0105] Although the present invention has been described in detail above by general description and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements can be made to the present invention. Therefore, these modifications or improvements made without departing from the spirit of the present invention all belong to the scope of protection claimed by the present invention.

Claims

1. A full disk encryption storage method transparent to the upper layer, characterized in that: include: Verify user permissions through set procedures; After passing the authority verification, set the first encryption key; Generate a second encryption key according to the first encryption key, and associate the second encryption key with a disk check block to complete the disk check block initialization process; Obtaining a key input by a user, verifying the input key through the disk verification block, and performing corresponding processing according to the verification result; When a user issues a write request, the write request and the original data are copied; the original data is encrypted to obtain encrypted data, and the encrypted data is written to the disk; When a user issues a read request, the encrypted data is read from the disk; the encrypted data is decrypted to obtain decrypted data, and the decrypted data is returned to the user; When system damage occurs, the encrypted data in the disk is decrypted to obtain the original data, and the original data is returned to the user.

2. The method for storing full disk encryption transparent to the upper layer according to claim 1, characterized in that: In the process of verifying the user's authority through the setting program, if the user's authority is insufficient, the system rejects the user's request; if the user's authority meets the requirements, the system authorizes subsequent data operation processing.

3. The method for storing full disk encryption transparent to the upper layer according to claim 2, characterized in that: In the process of verifying the input key by the disk check block and performing corresponding processing according to the verification result, if the input key is consistent with the first encryption key, then performing subsequent data operation processing; If the input key is inconsistent with the first encryption key, the user request is rejected.

4. The method for storing full disk encryption transparent to the upper layer according to claim 3, characterized in that: After the encrypted data is written to the disk, if the disk is physically accessed, the original data cannot be directly read.

5. The method for storing full disk encryption transparent to the upper layer according to claim 4, characterized in that: In the process of encrypting the original data, the original data is encrypted by using the XTS (AES)-128 encryption algorithm.

6. A full disk encryption storage device transparent to an upper layer, using a full disk encryption storage method transparent to an upper layer as claimed in any one of claims 1 to 5, characterized in that: include: The permission verification module is used to verify the user's permission through the setting program; An encryption key setting module is used to set a first encryption key after passing the authority verification; generate a second encryption key according to the first encryption key, and associate the second encryption key with the disk check block to complete the disk check block initialization processing; The key verification module is used to obtain the key input by the user, verify the input key through the disk verification block, and perform corresponding processing according to the verification result; A write request processing module, used for copying the write request and original data when a user issues a write request; encrypting the original data to obtain encrypted data, and writing the encrypted data to a disk; A read request processing module, used for reading the encrypted data from the disk when a user issues a read request; decrypting the encrypted data to obtain decrypted data, and returning the decrypted data to the user; The system damage processing module is used to decrypt the encrypted data in the disk to obtain the original data when system damage occurs, and return the original data to the user.

7. The full disk encryption storage device transparent to the upper layer according to claim 6, characterized in that: In the authority verification module, during the process of verifying the user's authority through the setting program, if the user's authority is insufficient, the system rejects the user's request; if the user's authority meets the requirements, the system authorizes subsequent data operation processing.

8. The full disk encryption storage device transparent to the upper layer according to claim 7, characterized in that: In the key verification module, in the process of verifying the input key through the disk verification block and performing corresponding processing according to the verification result, if the input key is consistent with the first encryption key, then subsequent data operation processing is performed; If the input key is inconsistent with the first encryption key, the user request is rejected.

9. The full disk encryption storage device transparent to the upper layer according to claim 8, characterized in that: In the write request processing module, after the encrypted data is written to the disk, if the disk is physically accessed, the original data cannot be directly read.

10. The full disk encryption storage device transparent to the upper layer according to claim 9, characterized in that: In the write request processing module, in the process of encrypting the original data, the original data is encrypted by using the XTS (AES)-128 encryption algorithm.

Images