Data interaction method and system based on user mode and kernel mode

Abstract

The invention relates to a data interaction method and system based on a user mode and a kernel mode, and relates to the technical field of data processing. The system comprises a user terminal and a data processing system, wherein the user terminal comprises a user layer and a kernel layer; the user layer of the user terminal is in communication connection with the kernel layer of the user terminal; and the data processing system is in communication connection with the kernel layer. In the management process of key use and key data acquisition, function division is carried out on a user layer and a kernel layer of a client, after the kernel layer receives data, data processing is carried out on the kernel layer, and result feedback is carried out on the user layer. And safe and stable operation of the database in key application and management scenes is ensured.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data interaction method and system based on user mode and kernel mode. Background Art

[0002] With the rapid development of information technology, data security has become a key issue in computer system design. Traditionally, file encryption, decryption, and permission management are usually handled independently by user mode and kernel mode, which has certain security and management efficiency limitations. In addition, there are also some challenges in key management, including key generation, storage, and distribution.

[0003] Existing encrypted file systems often require users to manually manage keys.

[0004] The encryption file system in the related art lacks automation and flexibility and cannot achieve efficient key management. In addition, since encryption and decryption operations usually occur in kernel mode, users cannot directly control and monitor these operations, which affects the security and manageability of the system. Summary of the invention

[0005] The present application is about a data interaction method and system based on user state and kernel state, which improves the security and manageability of system use. The technical solution is as follows: On the one hand, a data interaction method based on user state and kernel state is provided, and the method is applied to a data interaction system based on user state and kernel state, wherein the data interaction system based on user state and kernel state comprises a user terminal and a data processing system, and the user terminal comprises a user layer and a kernel layer; A communication connection between a user layer of the user terminal and a kernel layer of the user terminal; The data processing system is communicatively connected with the kernel layer; The method comprises: The user layer obtains a user request; and sends the user request to the kernel layer; The kernel layer receives a user request; generates an action instruction based on the user request; and sends the action instruction to the data processing system in response to associating the action instruction with a key application action; The data processing system receives the action instruction; generates a key action processing result based on the action instruction; and feeds back the key action processing result to the kernel layer; The kernel layer receives the key action processing result; generates a key action feedback result based on the key action processing result; and sends the user action feedback result to the user layer.

[0006] In an optional embodiment, the terminal device is connected to an external device, and before the user layer obtains the user request, the following steps are included: The user layer performs the authentication process with the external device; In response to the authentication process passing, get the user request.

[0007] In an optional embodiment, the user layer sends the user request to the kernel layer, including: The user layer sends the user request to the kernel layer based on the remote procedure call protocol.

[0008] In an optional embodiment, the kernel layer generates an action instruction based on the user request, including: In response to receiving the user request, the kernel layer matches the user request with an authorization process; and determines a user instruction corresponding to the user request based on a matching result of the authorization process.

[0009] In an optional embodiment, after the kernel layer determines the user instruction corresponding to the user request based on the matching result of the authorization process, the following steps are included: Based on the user instruction, the kernel layer mounts the encrypted directory corresponding to the user instruction; and configures the audit log corresponding to the user instruction.

[0010] In an optional embodiment, the method further includes: the data processing system includes a key generation module, a key storage module and a key lifecycle management module.

[0011] In an optional embodiment, the action instruction is associated with a key acquisition action; The key action processing result includes key data, and the key data is used to uniquely indicate the key.

[0012] In an optional embodiment, the method further includes: The kernel layer receives the key action processing result; stores the key data corresponding to the key action processing result; and generates the key feedback action result based on the key data.

[0013] In an optional embodiment, the action instruction key audit is associated with the hole action; The key action processing result includes key audit data, and the key audit data is used to indicate the key management process of the data processing system.

[0014] In an optional embodiment, the method further includes: The kernel layer receives the key action processing result; stores the key audit result corresponding to the key audit data; generates visual log data corresponding to the key audit result based on the key audit result; and sends the visual log data to the user layer.

[0015] On the other hand, a data interaction system based on user state and kernel state is provided, the system comprising a user terminal and a data processing system, the user terminal comprising a user layer and a kernel layer; A communication connection between a user layer of the user terminal and a kernel layer of the user terminal; The data processing system is communicatively connected with the kernel layer; The system is used for any of the above data interaction methods based on user state and kernel state.

[0016] The technical effects of each embodiment of the present application include at least: In the process of managing key usage and key data collection, the user layer and kernel layer of the client are functionally divided. After the kernel layer receives the data, it processes the data and feeds back the results to the user layer, thereby ensuring the safe and stable operation of the database in the key application and management scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A structural block diagram of a data interaction system based on user state and kernel state provided by an exemplary embodiment of the present application is shown.

[0019] Figure 2 A flow chart of a data interaction method based on user state and kernel state provided by an exemplary embodiment of the present application is shown.

[0020] Figure 3 A modular block diagram of a data interaction system based on user state and kernel state provided by an exemplary embodiment of the present application is shown.

[0021] Figure 4 A process diagram of a data interaction method based on user state and kernel state provided by an exemplary embodiment of the present application is shown. DETAILED DESCRIPTION

[0022] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0023] Figure 1 FIG. 1 shows a structural block diagram of a data interaction system based on user state and kernel state provided by an exemplary embodiment of the present application. Please refer to FIG. Figure 1 The system includes a user terminal 110 and a data processing system 120, wherein the user terminal 110 includes a user layer 111 and a kernel layer 112, and the user layer and the kernel layer of the user terminal are communicatively connected.

[0024] In an embodiment of the present application, the data storage system is implemented in the form of a database, and the data storage system is used to store and manage data. In an embodiment of the present application, the data processing system can be implemented as a key management system. Optionally, the key management system can perform different processes in the key life cycle such as key generation, storage, distribution, update, and destruction. In different embodiments of the present application, the data storage system is configured with a physical server, or the data storage system is correspondingly configured with a cloud server, or the data management system is implemented as a server cluster. This application does not limit the physical form of the data storage.

[0025] In the embodiment of the present application, the user terminal can be implemented as a terminal device such as a mobile phone, a personal computer, and a wearable device. In the application process of the above devices, the file encryption and decryption permissions are usually interactively processed by the user layer and the kernel layer.

[0026] It should be noted that in the embodiment of the present application, the user layer and the kernel layer are two operating environments in the operating system architecture, the user layer corresponds to the user state operating environment, and the kernel layer corresponds to the kernel state operating environment.

[0027] The user layer is the interface layer provided to users and applications in the operating system. It includes the user interface, application program interface (API), and runtime library, etc. Its main purpose is to provide users with an easy-to-use and understand environment while hiding the complexity of the operating system. Programs running in the user layer are called user programs or user processes, and they are usually executed in user mode. Programs cannot directly access hardware resources, and they must request services from the kernel layer through system calls.

[0028] It should be noted that in the embodiment of the present application, the user layer configuration uses a user state file system, which can support different types of algorithm policy configurations. In one example, the user state file system configured at the user layer supports SM1, SM4, and AES encryption algorithms for backing up the encryption and decryption database.

[0029] Correspondingly, the kernel layer is the core part of the operating system, responsible for managing system resources, such as CPU time, memory, file system, and I / O devices, etc. It provides a set of system call interfaces to allow user layer programs to request operating system services, such as file operations, process management, network communication, etc. The kernel layer runs in kernel mode and has direct access to hardware and system resources. It is responsible for scheduling user processes, handling interrupts and exceptions, and implementing security and protection mechanisms.

[0030] In this case, in the embodiment of the present application, the user layer of the user terminal has a communication connection relationship with the kernel layer of the user terminal. In this case, the user layer program requests the services of the kernel layer through a system call, and the kernel layer processes these requests and returns the results to the user layer program. The communication between the kernel layer and the user layer in the embodiment of the present application can be carried out based on this form.

[0031] exist Figure 1 Showing the system case, Figure 2 The flowchart of a data interaction method based on user state and kernel state provided by an exemplary embodiment of the present application is shown. Figure 1 Taking the system shown in FIG. 1 as an example, the method includes: Step 201: The user layer obtains a user request.

[0032] Optionally, the user layer is configured with an application program, and the user request acquired by the user layer is associated with the user's operation on the application program.

[0033] Step 202: The user layer sends the user request to the kernel layer.

[0034] This process is a sending process of a user request. Optionally, the sending process is sent through an interface connection between the user layer and the kernel layer.

[0035] Step 203: The kernel layer receives a user request.

[0036] Step 204: The kernel layer generates an action instruction based on the user request.

[0037] In the embodiment of the present application, the action instruction is associated with the function of the data processing system. Optionally, when the data processing system is a database storing data, the action instruction can be an action instruction for calling and previewing; when the data processing system is a key management system, the action instruction can be an instruction for processing keys.

[0038] Step 205 , the kernel layer sends the action instruction to the data processing system in response to associating the action instruction with the key application action.

[0039] In the embodiment of the present application, taking the association between an action instruction and a key application action as an example, at this time, the action instruction is used to be sent to a data processing system serving as a key management device.

[0040] Step 206: The data processing system receives an action instruction.

[0041] Step 207: The data processing system executes the database action based on the action instruction and generates a key action processing result.

[0042] Optionally, the database action may be a data retrieval, storage, or deletion action, and the present application does not limit the specific form of the database action. After the database action is executed, a corresponding data processing result is generated.

[0043] Step 208: The data processing system feeds back the key action processing result to the kernel layer.

[0044] In the embodiment of the present application, the key processing action will be sent to the terminal device and received by the kernel layer of the terminal device.

[0045] Step 209: The kernel layer receives the key action processing result.

[0046] This process is the process of receiving the key action processing results performed by the kernel layer.

[0047] Step 210: The kernel layer generates a key action feedback result based on the key action processing result.

[0048] In an embodiment of the present application, a key action feedback result is generated based on a key action processing result, and the feedback result is used to display the result on the interface of the application.

[0049] Step 211: The kernel layer sends the user action feedback result to the user layer.

[0050] To sum up, the method provided in the embodiment of the present application divides the functions of the user layer and the kernel layer of the client during the management of key usage and key data collection. After the kernel layer receives the data, the kernel layer processes the data and feeds back the results to the user layer, thereby ensuring the safe and stable operation of the database in the key application and management scenarios.

[0051] In some embodiments of this application, please refer to Figure 3, when the user terminal and the data processing system are connected, in the embodiment of the present application, the data interaction system based on the user state and the kernel state includes a database module 310, a communication interface module 320, an audit and monitoring module 330, a configuration management module 340, a backup and recovery module 350, a key management module 360 ​​and a key policy management module 370. In the embodiment of the present application, the above modules are configured in the user terminal and the data processing system based on application requirements.

[0052] Next, the functions of the above modules are explained: Database module: responsible for recording authorization process information, encrypted directory information, and audit logs. It provides a persistent storage mechanism to ensure that this information can be retained and accessed even after the system is restarted.

[0053] Communication interface module: Serves as a communication bridge between the user layer and the kernel layer. IBEfsService and the kernel IBefs module exchange information through this interface, transmitting user operation requests and processing results.

[0054] Audit and monitoring module: responsible for collecting, organizing and analyzing audit logs, and providing monitoring and tracing functions for database access and operation behaviors. Administrators can use this module to understand database usage and discover potential security risks.

[0055] Configuration management module: used to manage system configuration information, such as the selection of encryption algorithms, key storage locations, etc. This module allows administrators to flexibly configure and adjust according to actual needs.

[0056] Backup and recovery module: used to back up key information of the encrypted database (keys, encryption policies, etc.) and restore this information when needed. This helps to quickly restore the normal operation of the database in the event of system failure or data loss.

[0057] Key management module: responsible for the management of the entire encryption system's key generation, storage, distribution, use, update, and destruction, etc. throughout its life cycle. It ensures the security, confidentiality, and integrity of the key, thus ensuring the security and reliability of database encryption and decryption operations.

[0058] Key policy management module: Defines restrictions on key usage, including key validity period, usage limit, and usage scope. Defines key rotation and update policies, and regularly updates and rotates keys to enhance system security. This policy can help prevent security issues caused by long-term use of the same key. It can be used in conjunction with access control to ensure that only authorized users or systems can use specific keys. These restrictions ensure that keys are only used when necessary and are not abused.

[0059] In this case, in an optional embodiment, the terminal device is connected to an external device, and before the user layer obtains the user request, the user layer performs an identity authentication process with the external device; in response to the identity authentication process being passed, the user request is obtained.

[0060] In accordance with this embodiment, the external device is generally implemented as an external storage device with complete interactive functions. In one example, the external device is implemented as a USB-Key. When the USB-Key is connected to the terminal device, the application of the user layer first verifies whether the USB-Key is connected. After confirming the access, the PIN code identity authentication is performed with the USB-Key. If the verification is passed, the user layer executes the function of the application.

[0061] It should be noted that the USB-Key-based authentication process can be executed in various processes of interaction between the user layer and the kernel layer, for example, the user layer sends a key modification instruction, a key receiving instruction, etc. to the kernel layer.

[0062] Optionally, in some optional embodiments, the user layer is communicatively connected with the key module, and the key module performs further identity verification during the identity authentication process between the user layer and the USB-Key to prevent identity forgery and further reduce the security risk of key leakage.

[0063] In an optional embodiment, based on the existence of the communication interface module, the user layer sends the user request to the kernel layer based on the remote procedure call protocol.

[0064] In an optional embodiment, in response to receiving the user request, the kernel layer matches the user request with an authorization process, and determines a user instruction corresponding to the user request based on the matching result of the authorization process.

[0065] In response to this situation, the kernel layer can be mounted on the encrypted directory corresponding to the user instructions based on user intelligence, and configure the audit log corresponding to the user instructions.

[0066] In an optional embodiment, the action instruction is associated with a key acquisition action; the key action processing result includes key data, and the key data is used to uniquely indicate the key.

[0067] In this case, the kernel layer receives the key action processing result, stores the key data corresponding to the key action processing result, and generates the key feedback action result based on the key data. That is, the kernel layer can independently process the key data and generate the key feedback action result.

[0068] In another optional embodiment, the action instruction is associated with a key audit action; the key action processing result includes key audit data, and the key audit data is used to indicate the key management process of the data processing system.

[0069] In response to this situation, the data processing system parses the action instruction to obtain an instruction content analysis result; in response to the instruction content analysis result indicating that the action instruction is an encryption and decryption instruction, the original data file is determined based on the original data path; the original data file is backed up in the new data path to obtain a backup data file; a mount command folder corresponding to the original data file is created; and data of the mount file is encrypting and decrypting through the mount command folder to obtain an encrypted and decrypted file.

[0070] Combined with the above description, Figure 4 A schematic diagram of a method for executing a data interaction method based on user state and kernel state provided by an exemplary embodiment of the present application is shown. Take the data processing system in the method as a key management system as an example for explanation, please refer to Figure 4 , the process includes: Step 401, initializing the key management system.

[0071] In the embodiment of the present application, when the system starts, the key management system is initialized, including operations such as generating a root key, setting a key storage location and permission policy, etc.

[0072] Step 402: The user layer receives user operations.

[0073] The user operation layer includes a user interface for user interaction. As the main interface for user interaction with the system, the user interface provides a visual operation platform for users. Through a graphical interface or command line, users can perform a series of operations, such as requesting to add / delete authorized processes, mounting / unmounting encrypted directories, and opening / closing audit logs. In one example, the user interface is named IBEfsConsole. Corresponding to the user interface, there is a data processing end in the user layer, which is a localized application server. In one example, the localized application server is named IBEfsService.

[0074] Step 403: The application server in the user layer receives the processing request.

[0075] Optionally, IBEfsService receives an RPC call from IBEfsConsole. In this case, according to the user request, IBEfsService performs operations accordingly, such as adding / deleting authorized processes, mounting / unmounting encrypted directories, and opening / closing audit logs. It should be noted that if the encryption and decryption operations of files are involved, IBEfsService passes the corresponding request to the corresponding module of the kernel layer and calls the key management system to request the generation of the keys required for encryption and decryption. Optionally, the corresponding module of the kernel layer is the kernel IBEfs module.

[0076] Step 404: The kernel layer processes the request.

[0077] The kernel IBEfs module receives the request passed by IBEfsService and processes it. When it comes to file encryption and decryption operations, the kernel IBEfs module sends a request to the key management system to generate the key required for encryption and decryption. The key management system generates the corresponding key and returns it to the kernel IBEfs module. The kernel IBEfs module uses the obtained key to encrypt and decrypt the file. If the permissions of the process need to be verified, the kernel IBEfs module performs the corresponding permission verification operation. The kernel IBEfs module records the log of the process opening the file and sends the relevant information to the user layer for auditing and monitoring.

[0078] Step 405: The user layer processes the feedback.

[0079] During this process, IBEfsService receives the processing results of the kernel IBEfs module and passes the feedback information to IBEfsConsole. IBEfsConsole updates the user interface status based on the feedback information so that the user can understand the operation results.

[0080] In summary, the method provided in the embodiment of the present application has the following technical effects: (1) Enhanced security: This invention uses a key management system integration and a flexible permission control strategy to improve the security of the encrypted file system. The key management system ensures the full life cycle management tasks such as secure key generation, storage, distribution, update and destruction, effectively preventing the risk of key leakage and unauthorized access. At the same time, the flexible permission control strategy allows users to perform fine-grained control over file access rights according to their needs, further enhancing the security of the system.

[0081] (2) Improved manageability: The present invention realizes efficient communication and collaboration between user state and kernel state, and provides an automated key management mechanism, which greatly improves the manageability of the encrypted file system. Users can manage keys and control permissions through a unified interface, which simplifies the operation process, reduces the complexity and workload of management, and improves the management efficiency of the system.

[0082] (3) Enhanced flexibility: The present invention provides a flexible permission control strategy, and users can dynamically adjust the access rights of processes or users according to actual needs. This flexibility enables the system to adapt to the needs of different users and application scenarios, providing a more personalized data security solution. At the same time, the automation mechanism of the key management system also enhances the flexibility of the system. Users do not need to manually manage keys, which improves the efficiency and security of the system's key management.

[0083] (4) Performance optimization: The present invention designs an efficient user-mode and kernel-mode interaction mode, and realizes communication and collaboration between the user layer and the kernel layer through RPC calls and system calls. This design optimizes the performance and response speed of the system, reduces communication delays, improves the throughput and concurrency of the system, and provides users with a smoother and more stable user experience.

[0084] (5) Improved transparency: The present invention enables users to directly monitor and control the operating status of the encrypted file system by realizing efficient communication and collaboration between the user state and the kernel state, thereby improving the transparency of the system. Users can understand the encryption and decryption process of files and the permission control status in real time, reducing the uncertainty of system operation and enhancing users' trust in the system.

[0085] (6) Strong scalability: Since the present invention adopts a modular design concept and separates functional modules such as key management and authority control, the system has strong scalability. Users can customize and expand the system according to actual needs, add new functional modules or replace existing modules to adapt to different application scenarios and business needs. This scalability makes the present invention have good application prospects and development potential.

[0086] The above are only optional embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A data interaction method based on user state and kernel state, characterized in that: The method is applied to a data interaction system based on user state and kernel state, wherein the data interaction system based on user state and kernel state comprises a user terminal and a data processing system, wherein the user terminal comprises a user layer and a kernel layer; A communication connection between a user layer of the user terminal and a kernel layer of the user terminal; The data processing system is communicatively connected with the kernel layer; It is used for the terminal to be connected with an external device, and the external device is realized as an external storage device with complete interactive functions; The method comprises: The user layer obtains a user request in response to executing and passing the PIN code identity authentication; and sends the user request to the kernel layer; The kernel layer receives a user request; generates an action instruction based on the user request; and sends the action instruction to the data processing system in response to associating the action instruction with a key application action; The data processing system receives the action instruction; executes the database action based on the action instruction and generates a key action processing result; and feeds back the key action processing result to the kernel layer; The kernel layer receives the key action processing result; generates a key action feedback result based on the key action processing result; and sends the user action feedback result to the user layer.

2. The data interaction method based on user state and kernel state according to claim 1 is characterized in that: The terminal device is connected to an external device, and before the user layer obtains the user request, it includes: The user layer performs an identity authentication process with the external device; In response to the authentication process passing, get the user request.

3. The data interaction method based on user state and kernel state according to claim 2 is characterized in that: The user layer sends the user request to the kernel layer, including: The user layer sends the user request to the kernel layer based on the remote procedure call protocol.

4. The data interaction method based on user state and kernel state according to claim 3 is characterized in that: The kernel layer generates an action instruction based on the user request, including: In response to receiving the user request, the kernel layer matches the user request with an authorization process; and determines a user instruction corresponding to the user request based on a matching result of the authorization process.

5. The data interaction method based on user state and kernel state according to claim 4 is characterized in that: After the kernel layer determines the user instruction corresponding to the user request based on the matching result of the authorization process, it includes: Based on the user instruction, the kernel layer mounts the encrypted directory corresponding to the user instruction; and configures the audit log corresponding to the user instruction.

6. The data interaction method based on user state and kernel state according to claim 1 is characterized in that: The method also includes: the data processing system includes a key generation module, a key storage module and a key life cycle management module.

7. The data interaction method based on user state and kernel state according to claim 6 is characterized in that: The action instruction is associated with a key acquisition action; The key action processing result includes key data, and the key data is used to uniquely indicate the key.

8. The data interaction method based on user state and kernel state according to claim 7 is characterized in that: The method further comprises: The kernel layer receives the key action processing result; stores the key data corresponding to the key action processing result; and generates the key feedback action result based on the key data.

9. The data interaction method based on user state and kernel state according to claim 6 is characterized in that: The action instruction is associated with a key audit action; The key action processing result includes key audit data, and the key audit data is used to indicate the key management process of the data processing system; The data processing system executes a database action based on the action instruction and generates a key action processing result, including: The data processing system performs instruction content analysis on the action instruction to obtain an instruction content analysis result; in response to the instruction content analysis result indicating that the action instruction is an encryption and decryption instruction, the original data file is determined based on the original data path; Backing up the original data file in the new data path to obtain a backup data file; Create a mount command folder corresponding to the original data file; The mount file is encrypted and decrypted through the mount command folder to obtain an encrypted and decrypted file.

10. A data interaction system based on user state and kernel state, characterized in that: The system includes a user terminal and a data processing system, wherein the user terminal includes a user layer and a kernel layer; A communication connection between a user layer of the user terminal and a kernel layer of the user terminal; The data processing system is communicatively connected with the kernel layer; The system is used to execute the data interaction method based on user state and kernel state as described in any one of claims 1 to 9.

Images