Disk data encryption and decryption method and device, equipment and storage medium

Abstract

The invention discloses a disk data encryption and decryption method and device, equipment and a storage medium, and relates to the technical field of information security, and the disk data encryption and decryption method comprises the following steps: sending a first key to a volume encryption application component through a virtual computing node controller program by using a virtual encryption volume constructed based on a created virtual machine mirror image; triggering an encryption and decryption thread handle pool creation process by using an encrypted second key obtained based on the first key through the volume encryption application component; when encryption task information is received through the password management component, determining a first target password computing resource chain table based on an encryption and decryption thread handle pool corresponding to the encryption task information, and performing data encryption by using a resource chain table scheduling rule and the first target password computing resource chain table to complete disk data writing; when decryption task information is received through the password management component, the resource chain table scheduling rule and the second target password are used for computing the resource chain table for decryption, and data reading is completed. And the encryption and decryption efficiency is effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a disk data encryption and decryption method, device, equipment and storage medium. Background Art

[0002] In the virtualization technology system, it is particularly important to ensure the security isolation, confidentiality and integrity of virtual machine images. However, in the existing methods, (1) the use of password cards requires adaptation to various server platforms. User servers may not have free slots to insert password cards, which lacks flexibility; (2) when using external cryptographic machines and other devices and cryptographic services, network performance is limited, and the corresponding encryption and decryption keys need to be imported into the cryptographic module and device, and then the data is encrypted and decrypted. After the encryption and decryption is completed, the encryption and decryption keys are released. As a result, the frequent import and release of encryption and decryption keys reduces the overall performance and greatly increases the cost of use. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide an information security technology method, device, equipment and storage medium, which can achieve logical isolation and confidentiality protection of virtual machine images without adding external password-related equipment, reduce the frequency of key import and export, improve the utilization rate of cryptographic computing resources and the efficiency and accuracy of data encryption / decryption, thereby improving applicability and reducing usage costs. The specific scheme is as follows:

[0004] In a first aspect, the present application provides a disk data encryption and decryption method, comprising:

[0005] Obtaining a first key based on the virtual machine identification information through a virtualized computing node controller program, and sending the first key to a volume encryption application component using a virtual encrypted volume constructed based on the created virtual machine image;

[0006] The volume encryption application component uses the first key to encrypt and store the second key, and calls a preset function of the password management component by using the encrypted second key to trigger the creation process of the encryption and decryption thread handle pool corresponding to the virtual encrypted volume, so as to complete the initialization operation;

[0007] When the encryption task information sent by the volume encryption application component is received through the password management component, a first target cryptographic computing resource linked list is determined based on the encryption and decryption thread handle pool corresponding to the encryption task information, and data is encrypted using a preset business management thread, a resource linked list scheduling rule, the first target cryptographic computing resource linked list, and the encryption task information, so that the encryption result is written to the disk through the volume encryption application component;

[0008] When the decryption task information sent by the volume encryption application component is received through the password management component, the second target cryptographic computing resource list is determined based on the encryption and decryption thread handle pool corresponding to the decryption task information, and the preset business management thread, the resource list scheduling rules, the second target cryptographic computing resource list and the decryption task information are used to perform data decryption, so as to complete the disk data reading through the volume encryption application component and using the obtained decryption result.

[0009] Optionally, before obtaining the first key based on the virtual machine identification information by the virtualized computing node controller program, the method further includes:

[0010] When starting the operating system of the host machine, multiple cryptographic computing resources pre-configured in the physical host are checked to obtain corresponding check results;

[0011] If the inspection result indicates that each of the cryptographic computing resources meets the preset conditions, the number of encryption and decryption threads and performance parameters corresponding to each of the cryptographic computing resources are initialized to complete the corresponding first data initialization operation and obtain a first data initialization result.

[0012] Optionally, the process of calling a preset function of a password management component by using the encrypted second key to trigger a creation process of an encryption and decryption thread handle pool corresponding to the virtual encrypted volume includes:

[0013] Creating an encryption and decryption thread handle pool corresponding to the virtual encrypted volume based on the preset function and the encrypted second key through the password management component, and configuring a corresponding linked list for each of the password computing resources in the encryption and decryption thread handle pool;

[0014] Initializing the number of available encryption and decryption threads, the number of idle encryption and decryption threads, and the total number of encryption and decryption threads corresponding to the plurality of cryptographic computing resources in the encryption and decryption thread handle pool to complete a corresponding second data initialization operation and obtain a second data initialization result;

[0015] Determine whether the current loop identifier is greater than a preset loop threshold, and if not, update the loop identifier and trigger a corresponding encryption / decryption thread handle pool addition operation;

[0016] After the encryption / decryption thread handle pool adding operation is completed, determining whether the preset encryption / decryption thread handle pool creation batch number is greater than the total number of target encryption / decryption threads in the second data initialization result, so as to obtain a corresponding first determination result;

[0017] If the first judgment result indicates that it is greater than, triggering a corresponding scheduling strategy optimization operation based on the resource chain table scheduling rule;

[0018] After the scheduling strategy optimization operation is completed, it is determined whether the total number of current target encryption and decryption threads meets the preset number condition, and if so, it is jumped again to the step of determining whether the current loop identifier is greater than the preset loop threshold to complete the initialization operation.

[0019] Optionally, determining a first target cryptographic computing resource linked list based on the encryption and decryption thread handle pool corresponding to the encryption task information, and performing data encryption using a preset business management thread, a resource linked list scheduling rule, the first target cryptographic computing resource linked list, and the encryption task information, includes:

[0020] After receiving the encryption task information, the password management component sends a corresponding task processing notification to its own preset business management thread;

[0021] Determining the corresponding number of data blocks to be encrypted based on the list of data blocks to be encrypted in the encryption task information by the preset business management thread;

[0022] Using the preset business management thread to use the first resource linked list in the encryption and decryption thread handle pool corresponding to the encryption task information as the first target cryptographic computing resource linked list;

[0023] Through the preset business management thread, and based on the current number of data blocks to be encrypted, the first target performance parameter corresponding to the first target cryptographic computing resource linked list, and the number of idle encryption threads, a first number of linked list nodes are taken out from the first target cryptographic computing resource linked list, and the number of idle encryption threads is updated based on the first number to obtain an updated number of idle encryption threads;

[0024] By using the preset business management thread and based on the first number of linked list nodes, each data block to be encrypted in the list of data blocks to be encrypted is respectively encrypted by calling a preset cryptographic computing resource interface to encrypt the data block to be encrypted by using a commercial cryptographic algorithm to obtain corresponding encrypted data;

[0025] During the data encryption process, the current number of data blocks to be encrypted is updated through the preset business management thread. If the current number of data blocks to be encrypted is greater than zero and the cryptographic computing resource lists in the encryption and decryption thread handle pool corresponding to the encryption task information are not in an available state, then after completing the corresponding scheduling strategy optimization operation based on the resource list scheduling rules, the corresponding encryption and decryption thread handle pool addition operation is triggered until the encryption result corresponding to the encryption task information is obtained.

[0026] Optionally, determining a second target cryptographic computing resource linked list based on the encryption and decryption thread handle pool corresponding to the decryption task information, and using the preset business management thread, the resource linked list scheduling rule, the second target cryptographic computing resource linked list and the decryption task information to perform data decryption includes:

[0027] After receiving the decryption task information, the password management component sends a corresponding task processing notification to its own preset business management thread;

[0028] Determining the corresponding number of data blocks to be decrypted based on the list of data blocks to be decrypted in the decryption task information by the preset business management thread;

[0029] Using the preset business management thread to use the first resource linked list in the encryption and decryption thread handle pool corresponding to the decryption task information as the second target cryptographic calculation resource linked list;

[0030] Taking out a second number of linked list nodes from the second target cryptographic computing resource linked list through the preset business management thread based on the current number of data blocks to be decrypted, the second target performance parameter corresponding to the second target cryptographic computing resource linked list, and the number of idle decryption threads, and updating the number of idle decryption threads based on the second number to obtain an updated number of idle decryption threads;

[0031] By using the preset business management thread and based on the second number of linked list nodes, respectively decrypting the data blocks to be decrypted in the list of data blocks to be decrypted by calling a preset cryptographic computing resource interface, so as to use a commercial cryptographic algorithm to decrypt the data blocks to be decrypted, so as to obtain corresponding decrypted data;

[0032] During the data decryption process, the current number of data blocks to be decrypted is updated through the preset business management thread. If the current number of data blocks to be decrypted is greater than zero and the cryptographic computing resource lists in the encryption and decryption thread handle pool corresponding to the decryption task information are not in an available state, then after completing the corresponding scheduling strategy optimization operation based on the resource list scheduling rules, the corresponding encryption and decryption thread handle pool addition operation is triggered until the decryption result corresponding to the decryption task information is obtained.

[0033] Optionally, after completing the corresponding scheduling strategy optimization operation based on the resource linked list scheduling rule, triggering the corresponding encryption and decryption thread handle pool addition operation includes:

[0034] Sorting each of the encryption and decryption thread handle pools based on performance parameters corresponding to each of the cryptographic computing resources, and triggering a corresponding first target cryptographic computing resource linked list update operation according to the obtained sorting result, so as to obtain an updated first target cryptographic computing resource linked list;

[0035] For the updated first target cryptographic computing resource chain table, calculating the difference between the corresponding number of created encryption threads and the expected number of encryption threads corresponding to the encryption task information, and determining whether the obtained difference satisfies a first preset condition, so as to obtain a corresponding second determination result;

[0036] If the second judgment result indicates that it is not satisfied, determining the target parameter based on the difference and the preset task threshold corresponding to the updated first target cryptographic computing resource linked list;

[0037] If the target parameter is not greater than zero, then create the target parameter encryption and decryption threads and linked list nodes, and for each of the created encryption and decryption threads, import the encrypted second key into the corresponding encryption and decryption thread handle pool.

[0038] Optionally, after obtaining the corresponding encrypted data, the method further includes:

[0039] If the current mode is asynchronous, sending the encrypted data to the volume encryption application component based on a preset asynchronous processing callback function;

[0040] If the current mode is synchronous, the encrypted data will be saved in the encryption and decryption return table in the encryption task information until the encrypted data corresponding to each data block to be encrypted is obtained and saved, and then the encryption and decryption return table that saves the encryption result will be sent to the volume encryption application component so that the encryption result can be written to the disk through the volume encryption application component.

[0041] In a second aspect, the present application provides a disk data encryption and decryption device, comprising:

[0042] A first key acquisition module, used to acquire a first key based on virtual machine identification information through a virtualized computing node controller program, and send the first key to a volume encryption application component using a virtual encrypted volume constructed based on a created virtual machine image;

[0043] An initialization completion module, configured to encrypt and store a second key using the first key through the volume encryption application component, and to call a preset function of the password management component using the encrypted second key to trigger a creation process of an encryption and decryption thread handle pool corresponding to the virtual encrypted volume, so as to complete the initialization operation;

[0044] a data encryption module, configured to, when receiving encryption task information sent by the volume encryption application component through the password management component, determine a first target cryptographic computing resource linked list based on the encryption and decryption thread handle pool corresponding to the encryption task information, and perform data encryption using a preset business management thread, a resource linked list scheduling rule, the first target cryptographic computing resource linked list, and the encryption task information, so as to write the obtained encryption result to a disk through the volume encryption application component;

[0045] A data decryption module is used to determine a second target cryptographic computing resource list based on an encryption and decryption thread handle pool corresponding to the decryption task information when receiving decryption task information sent by the volume encryption application component through the password management component, and to perform data decryption using the preset business management thread, the resource list scheduling rules, the second target cryptographic computing resource list and the decryption task information, so as to complete disk data reading through the volume encryption application component and using the obtained decryption result.

[0046] In a third aspect, the present application provides an electronic device, including:

[0047] Memory, used to store computer programs;

[0048] The processor is used to execute the computer program to implement the steps of the aforementioned disk data encryption and decryption method.

[0049] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, which implements the steps of the aforementioned disk data encryption and decryption method when executed by a processor.

[0050] It can be seen that in the present application, a first key is obtained based on the virtual machine identification information through a virtualized computing node controller program, and the first key is sent to a volume encryption application component using a virtual encryption volume constructed based on a created virtual machine image; the second key is encrypted and stored by the volume encryption application component using the first key, and a preset function of a password management component is called by using the encrypted second key to trigger the creation process of an encryption and decryption thread handle pool corresponding to the virtual encryption volume, so as to complete the initialization operation; when the encryption task information sent by the volume encryption application component is received through the password management component, the first target password calculation thread handle pool is determined based on the encryption and decryption thread handle pool corresponding to the encryption task information. Resource chain table, and use the preset business management thread, resource chain table scheduling rules, the first target cryptographic computing resource chain table and the encryption task information to encrypt data, so that the encrypted result is written to the disk through the volume encryption application component; when the decryption task information sent by the volume encryption application component is received through the password management component, the second target cryptographic computing resource chain table is determined based on the encryption and decryption thread handle pool corresponding to the decryption task information, and the preset business management thread, the resource chain table scheduling rules, the second target cryptographic computing resource chain table and the decryption task information are used to decrypt data, so that the disk data reading is completed by the volume encryption application component and the decryption result obtained. In this embodiment, the first key is first obtained through the virtualization computing node controller program to complete the initialization operation. In the subsequent encryption / decryption process, the corresponding first / second target cryptographic computing resource chain table is determined by the password management component and the received encryption / decryption task information, and the initialized encryption / decryption thread handle pool obtained based on the virtual machine image, and the corresponding cryptographic computing resource scheduling is performed according to the resource chain table scheduling rules during encryption / decryption to complete data encryption / decryption. In this way, without adding new external cryptographic-related equipment, it is possible to achieve logical isolation and confidentiality protection of virtual machine images, reduce the frequency of key import and export, improve the utilization rate of cryptographic computing resources and the efficiency and accuracy of data encryption / decryption, thereby improving applicability and reducing usage costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0052] Figure 1 A flow chart of a disk data encryption and decryption method provided by this application;

[0053] Figure 2 A schematic diagram of a specific disk data encryption and decryption method provided in this application;

[0054] Figure 3 A specific disk data encryption process diagram provided for this application;

[0055] Figure 4 A schematic diagram of the process of adding an encryption and decryption thread handle pool provided by this application;

[0056] Figure 5 A schematic diagram of the structure of a disk data encryption and decryption device provided by this application;

[0057] Figure 6 A structural diagram of an electronic device provided for this application. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0059] However, in the existing methods, (1) the use of password cards requires adaptation to various server platforms, and the user server may not have a free slot to insert the password card, which lacks flexibility; (2) when using external cryptographic machines and other devices and cryptographic services, it is limited by network performance, and it is necessary to import the corresponding encryption and decryption keys into the cryptographic module and device, and then encrypt and decrypt the data. After the encryption and decryption is completed, the encryption and decryption keys are released. In this way, the frequent import and release of encryption and decryption keys reduces the overall performance and greatly increases the cost of use. To this end, the present application provides a disk data encryption and decryption solution that can achieve logical isolation and confidentiality protection of virtual machine images without adding external password-related devices, and effectively improve the encryption and decryption performance.

[0060] See also Figure 1 As shown, an embodiment of the present invention discloses a disk data encryption and decryption method, comprising:

[0061] Step S11: obtaining a first key based on virtual machine identification information through a virtualized computing node controller program, and sending the first key to a volume encryption application component using a virtual encrypted volume constructed based on a created virtual machine image.

[0062] Combination Figure 1As shown, it should be understood that in this embodiment, some configuration and preprocessing are required to complete initialization before use. Specifically, the configurations that need to be configured include: encryption performance priority option or decryption performance priority option, encryption and decryption thread handle pool (i.e. Figure 1 The encryption and decryption business thread handle pool in the creation batch number (i.e., cnfpatch), the encryption and decryption thread expiration time (i.e., cnfouttime), the maximum number of tasks for each cryptographic computing resource (i.e., cnfmaxths, ≥2*cnfpatch), the number of cryptographic computing resources N, and the corresponding cryptographic computing resource interface, and confirm the consistency and interoperability of the algorithms provided by each cryptographic computing resource. Among them, cryptographic computing resources include different types of computing resources such as soft cryptographic modules based on soft algorithms, embedded algorithm cryptographic acceleration chips (such as CPU (Central Processing Unit), motherboard, etc.), and cryptographic cards. Afterwards, when the host machine's operating system is started, multiple cryptographic computing resources pre-configured in the physical host are checked to obtain corresponding inspection results; if the inspection results show that each cryptographic computing resource meets the preset conditions, that is, they are all normal, then all encryption and decryption threads created by each cryptographic computing resource are initialized to g_totalths_src[1...N]=0, and the performance parameters of each cryptographic computing resource are initialized to g_perf_src[0]=1, g_perf_src[1..N]=0, so as to complete the corresponding first data initialization operation and obtain the first data initialization result.

[0063] Furthermore, in this embodiment, when creating a virtual machine encrypted image (ie, a virtual machine image), the virtualization computing node controller program (ie, Figure 1 The computing node controller agent in the virtual machine (i.e., the virtual machine identification information) applies for the first key PK from the key management system or the controller with key management capability according to the assigned virtual machine unique identifier (i.e., the virtual machine identification information). It should be understood that the virtualized computing node controller program in this embodiment is used to implement docking with the key management system, obtain the required key, and call the command interface to implement operations such as creation and loading of virtual machine encrypted volumes.

[0064] Step S12: The volume encryption application component uses the first key to encrypt and store the second key, and calls the preset function of the password management component by using the encrypted second key to trigger the creation process of the encryption and decryption thread handle pool corresponding to the virtual encrypted volume to complete the initialization operation.

[0065] Combination Figure 1 As shown, in this embodiment, after obtaining the first key PK, the data encryption key WK (i.e., the second key) is obtained by the volume encryption application component (i.e. Figure 1The volume encryption application module in the PK is randomly generated and stored with PK protection. When loading the virtual machine encrypted image, the password management component (i.e. Figure 1 The preset function of the password calculation management module in the password management module, namely the set_key function, passes WK to the password management component for corresponding initialization. It should be understood that the password management component in this embodiment is used to provide a variety of commercial cryptographic algorithms, support asynchronous and synchronous processing, and is used to perform thread pool management on multiple cryptographic computing resources, perform encryption and decryption, hashing and other operations on data blocks read and written to the disk, provide standardized interfaces, and provide encryption and decryption support for different applications. That is, the specific steps of the initialization process are as follows:

[0066] 1): The virtualized computing node controller program loads the virtual machine image to form a virtual encrypted volume, passes the PK to the volume encryption application component, and the volume encryption application component uses the PK to encrypt and protect the WK according to its own key system, and then calls the password management component to perform the set_key operation. The main parameters of set_key include ctx, WK, etc., where ctx can be the virtual encrypted volume instance context or the context structure data of the current request;

[0067] 2): The password management component creates an encryption and decryption volume business thread handle pool thpool under the current ctx. Each password computing resource in thpool generates an empty linked list, initializes the number of encryption and decryption threads for each password computing resource in thpool, that is, the number of available encryption and decryption threads currths_src[1...N]=0, initializes the number of idle encryption and decryption threads for each password computing resource in thpool idleths_src[1...N]=0, initializes the total number of encryption and decryption threads of the password computing resources in thpool totalths_ctx=0, cycleid (i.e. cycle identifier)=0;

[0068] 3): If cycleid>preset cycle threshold (can be set to 2, or based on actual needs), return and wait for the next trigger; otherwise continue to execute, update cycleid=cycleid+1, execute the "add encryption and decryption thread handle pool" process through the password management component, and pass in parameters thpool, addnum (indicating the expected number of threads)=cnfpatch and WK, and wait for the execution to complete before executing step 4;

[0069] 4): Compare totalths_ctx and cnfpatch values. If the first judgment result shows that totalths_ctx ≥ cnfpatch, return; otherwise, calculate the current thpool's o_total = totalths_ctx, perform scheduling strategy optimization, that is, the "strategy optimization timed task" process, pass in parameters freenums = cnfpatch-totalths_ctx and thpool, and wait for the execution to complete before executing step 5;

[0070] 5): Determine whether o_total>totalths_ctx. If the condition is met, it means there is a release, and continue to step 3, otherwise return.

[0071] Step S13: When the encryption task information sent by the volume encryption application component is received through the password management component, the first target cryptographic computing resource list is determined based on the encryption and decryption thread handle pool corresponding to the encryption task information, and data is encrypted using the preset business management thread, resource list scheduling rules, the first target cryptographic computing resource list and the encryption task information, so that the encryption result can be written to the disk through the volume encryption application component.

[0072] In this embodiment, when encrypting, the volume encryption application component calls the encrypt function of the password management component. If it is in asynchronous mode, the encrypted data is received through the callback function of the volume encryption application component. If it is in synchronous mode, the encrypted data is directly returned through the encrypt function. Then the volume encryption application component writes the received encrypted data to the disk. The password management component first starts the encryption and decryption thread according to an optimal performance strategy to perform encryption operations, and performs encryption task detection at the same time. If there are remaining encryption tasks, it attempts to create and obtain more encryption and decryption threads to perform encryption operations. Combined with Figure 3 The specific encryption steps are as follows:

[0073] 1): When a higher-level caller (such as a file system, virtual machine monitor, etc.) requests to write data to the read / write request module of the volume encryption application component, the volume encryption application component calls the encrypt operation of the password management component and passes in the encryption task information, including the parameter ctx (here refers to the context structure data of the data encryption task corresponding to the current data write request), the list of data blocks to be encrypted, the encryption / decryption return table, the asynchronous processing callback function, etc.;

[0074] 2): The password management component calculates the encryption request task T, puts it into a task table, and notifies the business management thread, that is, the preset business management thread processes it. At the same time, if the password management component is in asynchronous mode, it directly returns the result to the volume encryption application component. If it is in synchronous mode, it waits for the encryption and decryption return table to receive all encrypted data blocks and then returns to the volume encryption application component;

[0075] 3): When the business management thread receives the notification message, it starts the task processing and calculates the number of blocks in the list of data blocks to be encrypted in T to obtain the number of data blocks to be encrypted, i.e., waittasks;

[0076] 4): Set the current cryptographic computing resource list S, that is, the first target cryptographic computing resource list, as the first list in the encryption and decryption volume thread handle pool of the corresponding ctx, numbered i; set the number of threads that have been taken out of the current task to run, popths = 0;

[0077] 5): The business management thread calculates the weight mul of the number of threads that should be taken out of the current linked list numbered i, and the number of threads that should be taken out of the current linked list i, popfactor:

[0078] ;

[0079] popfactor=min(waittaks-popths*mul, idleths_src[i]);

[0080] 6): The business management thread takes out popths=min(popfactor, idleths_src[i]) from S, that is, the first number of linked list nodes node, and then updates idleths_src[i]=idleths_src[i]-popths, and executes the encryption and decryption thread of the taken out node (it should be noted that the operations of updating g_totalths_src, totalths_ctx, currths_src, and idleths_src in this embodiment are all atomic operations);

[0081] 7): The business management thread recalculates waittasks = min (waittasks-popths, the number of data blocks to be encrypted in T). If the current waittasks>0 and the next available cryptographic computing resource exists in the corresponding ctx encryption and decryption volume thread handle pool, set S = the next cryptographic computing resource list, numbered i, and continue to step 5;

[0082] 8): The business management thread determines that if the current waittasks>0 and the corresponding ctx encryption and decryption volume thread handle pool does not have the next available cryptographic computing resource, it executes the "Policy Optimization Scheduled Task" process, then executes the "Encryption and Decryption Thread Handle Pool Addition" process, and then determines whether the corresponding ctx satisfies >0, if yes, continue to step 4, otherwise wait for a short time and continue to step 4;

[0083] 9): If waittasks<=0, the business management thread is suspended and processing stops.

[0084] Furthermore, the following steps 10 to 12 are the processes executed by each encryption and decryption thread taken out in step 6.

[0085] 10): Let the encryption and decryption thread be runthreads. Runthreads takes out a data block to be encrypted from the head of the list of data blocks to be encrypted in T. If the retrieval is successful, continue to step 11; otherwise, the thread is suspended, the activity time in the linked list node node of the thread is updated, and node is put back into the corresponding cryptographic computing resource linked list;

[0086] 11): runthreads calls the corresponding preset password computing resource interface to use the commercial encryption algorithm to encrypt the encrypted data block to obtain the corresponding encrypted data. If the encryption policy priority configuration is set, the most recent single task processing time is recorded and updated to the corresponding node;

[0087] 12): If it is asynchronous mode, runthreads calls the preset asynchronous processing callback function of the volume encryption application component to return the encrypted data. If it is synchronous mode, runthreads stores the encrypted data in the encryption and decryption return table saved by the password management component. Continue step 10 until the encrypted data corresponding to all the data blocks to be encrypted is obtained, so that all the encrypted data can be written to the disk through the volume encryption application component.

[0088] Combination Figure 4 As shown, in this embodiment, the policy optimization timing task is completed based on the policy optimization processing module of the password management component itself, and the specific steps are as follows:

[0089] 1): Calculate g_perf_src for each cryptographic computing resource: Estimate the performance mean g_perf_src[idx] = (∑each recent single task processing time) / number of encryption and decryption threads with single task processing time greater than 0, where idx is the number of each cryptographic computing resource;

[0090] 2): Sort the encryption and decryption thread handle pool from small to large according to the g_perf_src value to get the sorting result;

[0091] 3): Set realnum (indicates the number of handle pools that have been released (cannot process encryption and decryption tasks)) = 0, node is the first linked list node in the first linked list of the first ctx (which can be the context structure data of the virtual encrypted volume instance or the current write / read request), and execute:

[0092] 3-1): If node is empty, execute step 4; otherwise, continue and get the current time t, determine that the instance corresponding to node is ctx, and set the encryption and decryption thread handle pool corresponding to node to thp2, the resource list corresponding to node to S, and the list number corresponding to node to id;

[0093] 3-2): If the activity time recorded by t-node is greater than cnfouttime, the encryption and decryption thread, encryption and decryption handle pool and node are released, and S's g_totalths_src[id]=g_totalths_src[id]-1, realnum=realnum+1, ctx's totalths_ctx=totalths_ctx-1, currths_src[id]=currths_src[id]-1, and idleths_src[id]=idleths_src[id]-1 are updated, thus completing the update operation of the first target cryptographic computing resource linked list;

[0094] 3-3): Let node = next node. If node is empty, node is the first linked list node of the next resource linked list. And execute step 3-1;

[0095] 4): If the parameters freenums and thpool are received, calculate freenums = freenums-realnum. If freenums is greater than 0, execute:

[0096] 4-1): Calculate the maximum number of encryption and decryption threads that can be created cancreated= (cnfmaxths[i]-g_totalths_src[i]), and update freenums=freenums-cancreated. If freenums is greater than 0, proceed to the next step;

[0097] 4-2): Find the five cryptographic computing resource encryption and decryption thread lists with the largest currths_src numbers under all ctx except thpool, record them as top_5, set id to be the number of the first cryptographic computing resource encryption and decryption thread list S in top_5, corresponding to instance ctx;

[0098] 4-3): If S is empty or freenums≤0, return to the beginning of step 4, otherwise continue to the next step;

[0099] 4-4): Release realnum=min(idleths_src[id], freenums) encryption and decryption threads and encryption and decryption handles in S, update g_totalths_src[id]=g_totalths_src[id]-realnum, update totalths_ctx=totalths_ctx-realnum of the corresponding ctx, update currths_src[id]=currths_src[id]-realnum of the corresponding S, update idleths_src[id]=idleths_src[id]-realnum of the corresponding S, freenums=freenums-realnum;

[0100] 4-5): S=the next cryptographic computing resource list in top_5, S is numbered as id, corresponding to instance ctx, and executes step 4-3.

[0101] That is to say, this embodiment automatically adjusts the encryption and decryption thread handle pool to be used according to the performance of each cryptographic computing resource, thereby realizing automatic optimization of the parallel scheduling strategy and improving the encryption and decryption processing performance of a large number of data blocks such as virtual volumes and physical volumes.

[0102] It is further to be understood that, in this embodiment, regarding the operation of adding the encryption and decryption thread handle pool, the specific steps are as follows:

[0103] 1): Set tmpa (indicating the number of created threads) = 0, and set the current cryptographic computing resource list S to be the first cryptographic computing resource list in thpool, numbered i;

[0104] 2): Calculate the difference between the number of corresponding created encryption threads and the expected number of encryption threads corresponding to the encryption task information, that is, calculate b=addnum-tmpa, and determine whether the obtained difference b meets the first preset condition, that is, determine whether b<1 or S is empty. If the second judgment result is yes, return tmpa;

[0105] 3): If the second judgment result is no, calculate the target parameter a=min(b, cnfmaxths[i]-g_totalths_src[i]). If a is greater than 0, proceed to step 4 below, otherwise directly execute step 5;

[0106] 4): Create a encryption and decryption threads and nodes. In each newly created encryption and decryption thread, import WK into the corresponding password computing resource to obtain the encryption and decryption handle. Put the thread number, encryption and decryption handle and other information into node, put node into the tail of S, and set S's g_totalths_src[i]=g_totalths_src[i]+a, thpool's totalths_ctx=totalths_ctx+a, S's currths_src[i]=currths_src[i]+a, S's idleths_src[i]=idleths_src[i]+a, tmpa=tmpa+a;

[0107] 5): S = the next cryptographic computing resource list in thpool, and continue with step 2.

[0108] Step S14: When the decryption task information sent by the volume encryption application component is received through the password management component, the second target cryptographic computing resource list is determined based on the encryption and decryption thread handle pool corresponding to the decryption task information, and the preset business management thread, the resource list scheduling rule, the second target cryptographic computing resource list and the decryption task information are used to perform data decryption, so as to complete the disk data reading through the volume encryption application component and using the obtained decryption result.

[0109] In this embodiment, Figure 1 As shown, during decryption, the volume encryption application component calls the decrypt function of the password management component. During reading, the password management component can directly return data to a higher-level caller (such as a file system, virtual machine monitor, etc.). The password management component first starts the encryption and decryption thread according to an optimal performance strategy for decryption operations, and performs decryption task detection at the same time. If there are remaining tasks to be decrypted, it attempts to create and obtain more encryption and decryption threads for decryption operations. For the specific decryption steps, please refer to the implementation process of the encryption step in S13. The decryption steps are as follows:

[0110] 1): When a higher-level caller (such as a file system, virtual machine monitor, etc.) requests to write data, the higher-level caller requests the read-write request module of the volume encryption application component to read disk data. The volume encryption application component calls the decrypt operation of the password management component and passes in the decryption task information, including the parameter ctx (here refers to the context structure data of the data decryption task corresponding to the current data read request), the list of data blocks to be decrypted, the encryption and decryption return table, the asynchronous processing callback function, etc. Among them, the encryption and decryption return table can be passed in by the higher-level caller to support the direct return of decrypted data to the higher-level caller;

[0111] 2): The password management component calculates the decryption request task T, puts it into a task table, and notifies the business management thread to process it. At the same time, if the password management component is in asynchronous mode, it directly returns the result to the volume encryption application component. If it is in synchronous mode, it waits for the encryption and decryption return table to receive all the decrypted data blocks and then returns to the volume encryption application component;

[0112] 3): When the business management thread receives the notification message, it starts the task processing and calculates the number of blocks in the list of data blocks to be decrypted in T to obtain the number of data blocks to be decrypted, i.e., waittasks;

[0113] 4): Set the current cryptographic computing resource list S, that is, the second target cryptographic computing resource list, as the first list in the encryption and decryption volume thread handle pool of the corresponding ctx, numbered i; set the number of threads that have been taken out of the current task to run, popths = 0;

[0114] 5): The business management thread calculates the weight mul of the number of threads that should be taken out of the current linked list numbered i, and the number of threads that should be taken out of the current linked list i, popfactor:

[0115] ;

[0116] popfactor=min(waittaks-popths*mul, idleths_src[i]);

[0117] 6): The business management thread takes out popths=min(popfactor, idleths_src[i]) from S, that is, the second number of linked list nodes node, and then updates idleths_src[i]=idleths_src[i]-popths, and executes the encryption and decryption thread of the taken node;

[0118] 7): The business management thread recalculates waittasks = min (waittasks-popths, the number of data blocks to be decrypted in T). If the current waittasks>0 and the next available cryptographic computing resource exists in the corresponding ctx encryption and decryption volume thread handle pool, set S = the next cryptographic computing resource list, numbered i, and continue to step 5;

[0119] 8): The business management thread determines that if the current waittasks>0 and the corresponding ctx encryption and decryption volume thread handle pool does not have the next available cryptographic computing resource, it executes the "Policy Optimization Scheduled Task" process, then executes the "Encryption and Decryption Thread Handle Pool Addition" process, and then determines whether the corresponding ctx satisfies >0, if yes, continue to step 4, otherwise wait for a short time and continue to step 4;

[0120] 9): If waittasks<=0, the business management thread is suspended and processing stops.

[0121] Furthermore, the following steps 10 to 12 are the processes executed by each encryption and decryption thread taken out in step 6.

[0122] 10): Let the encryption and decryption thread be runthreads. Runthreads takes a data block to be decrypted from the head of the list of data blocks to be decrypted in T. If the data block is taken out successfully, it continues to step 11; otherwise, the thread is suspended, the activity time in the linked list node node of the thread is updated, and node is put back into the corresponding cryptographic computing resource linked list;

[0123] 11): runthreads calls the corresponding preset cryptographic computing resource interface to use the commercial cryptographic algorithm to decrypt the data block to be decrypted and obtain the corresponding decrypted data. If the decryption policy priority configuration is set, the most recent single task processing time is recorded and updated to the corresponding node;

[0124] 12): If it is asynchronous mode, runthreads calls the preset asynchronous processing callback function of the volume encryption application component to return the decrypted data. If it is synchronous mode, runthreads stores the decrypted data in the encryption and decryption return table saved by the password management component. Continue step 10 until the decrypted data corresponding to all the data blocks to be decrypted are obtained, so that all the decrypted data can be returned to the upper-level caller through the volume encryption application component to complete the disk data reading.

[0125] In summary, in this embodiment, different cryptographic computing resources such as soft cryptographic modules, cryptographic cards, and cryptographic acceleration chips deployed in virtualized computing nodes are integrated, combined with encryption and decryption threads and encryption and decryption handles integrated pool management methods, and automatically call corresponding cryptographic computing resources according to performance priority scheduling strategies to achieve high-performance parallel encryption and decryption processing of a large number of data blocks such as disks. The cryptographic computing management module provides a standardized interface, and the upper-layer key system is managed according to its own business to support high-performance encryption and decryption processing of different block storage devices in different application scenarios. That is, in this embodiment, multiple cryptographic computing resources configured by the physical host are fully utilized, and high-performance cryptographic computing resources are given priority, which can reduce the frequency of importing and exporting encryption and decryption keys, improve the utilization rate of cryptographic computing resources, and enhance the high-performance concurrent processing capabilities of a large number of data blocks such as virtual volumes and physical disk partitions, and effectively improve the encryption and decryption performance; at the same time, commercial cryptographic algorithms are used in each module to ensure the security and compliance of key use and cryptographic application.

[0126] It can be seen that in this embodiment, the first key is first obtained through the virtualization computing node controller program to complete the initialization operation. In the subsequent encryption / decryption process, the corresponding first / second target cryptographic computing resource list is determined by the cryptographic management component and the received encryption / decryption task information, and the initialized encryption / decryption thread handle pool obtained based on the virtual machine image, and the corresponding cryptographic computing resource scheduling is performed according to the resource list scheduling rules during encryption / decryption to complete data encryption / decryption. In this way, the logical isolation and confidentiality protection of the virtual machine image can be achieved without adding external cryptographic related equipment, the frequency of key import and export can be reduced, the utilization rate of cryptographic computing resources and the efficiency and accuracy of data encryption / decryption can be improved, thereby improving applicability and reducing usage costs.

[0127] See also Figure 5 As shown, the embodiment of the present application also discloses a disk data encryption and decryption device, including:

[0128] A first key acquisition module 11 is used to acquire a first key based on virtual machine identification information through a virtualized computing node controller program, and send the first key to a volume encryption application component using a virtual encrypted volume constructed based on a created virtual machine image;

[0129] The initialization completion module 12 is used to encrypt and store the second key using the first key through the volume encryption application component, and call the preset function of the password management component by using the encrypted second key to trigger the encryption and decryption thread handle pool creation process corresponding to the virtual encrypted volume, so as to complete the initialization operation;

[0130] The data encryption module 13 is used to determine the first target cryptographic computing resource linked list based on the encryption and decryption thread handle pool corresponding to the encryption task information when the encryption task information sent by the volume encryption application component is received through the password management component, and to perform data encryption by using the preset business management thread, resource linked list scheduling rules, the first target cryptographic computing resource linked list and the encryption task information, so as to write the obtained encryption result to the disk through the volume encryption application component;

[0131] The data decryption module 14 is used to determine the second target cryptographic computing resource list based on the encryption and decryption thread handle pool corresponding to the decryption task information when the decryption task information sent by the volume encryption application component is received through the password management component, and use the preset business management thread, the resource list scheduling rules, the second target cryptographic computing resource list and the decryption task information to perform data decryption, so as to complete the disk data reading through the volume encryption application component and using the obtained decryption result.

[0132] Among them, for more specific working processes of the above-mentioned modules, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0133] It can be seen that in this embodiment, the first key is first obtained through the virtualization computing node controller program to complete the initialization operation. In the subsequent encryption / decryption process, the corresponding first / second target cryptographic computing resource list is determined by the cryptographic management component and the received encryption / decryption task information, and the initialized encryption / decryption thread handle pool obtained based on the virtual machine image, and the corresponding cryptographic computing resource scheduling is performed according to the resource list scheduling rules during encryption / decryption to complete data encryption / decryption. In this way, the logical isolation and confidentiality protection of the virtual machine image can be achieved without adding external cryptographic related equipment, the frequency of key import and export can be reduced, the utilization rate of cryptographic computing resources and the efficiency and accuracy of data encryption / decryption can be improved, thereby improving applicability and reducing usage costs.

[0134] In some specific embodiments, the disk data encryption and decryption device may further include:

[0135] A computing resource checking unit, used to check a plurality of cryptographic computing resources pre-configured in the physical host when starting the operating system of the host machine, so as to obtain corresponding checking results;

[0136] The first data initialization unit is used to initialize the number of encryption and decryption threads and performance parameters corresponding to each of the cryptographic computing resources if the inspection result shows that each of the cryptographic computing resources meets the preset conditions, so as to complete the corresponding first data initialization operation and obtain the first data initialization result.

[0137] In some specific embodiments, the initialization completion module 12 may specifically include:

[0138] An encryption and decryption thread handle pool creation unit, used to create an encryption and decryption thread handle pool corresponding to the virtual encrypted volume through the password management component and based on the preset function and the encrypted second key, and configure a corresponding linked list for each of the cryptographic computing resources in the encryption and decryption thread handle pool;

[0139] A second data initialization unit, used to initialize the number of available encryption and decryption threads, the number of idle encryption and decryption threads, and the total number of encryption and decryption threads corresponding to the plurality of cryptographic computing resources in the encryption and decryption thread handle pool, so as to complete a corresponding second data initialization operation and obtain a second data initialization result;

[0140] The encryption and decryption thread handle pool adding unit is used to determine whether the current cycle identifier is greater than a preset cycle threshold, and when it is not satisfied, update the cycle identifier and trigger the corresponding encryption and decryption thread handle pool adding operation;

[0141] A first judgment unit is used to judge whether the preset encryption and decryption thread handle pool creation batch number is greater than the target total number of encryption and decryption threads in the second data initialization result after the encryption and decryption thread handle pool addition operation is completed, so as to obtain a corresponding first judgment result;

[0142] A scheduling strategy optimization unit, configured to trigger a corresponding scheduling strategy optimization operation based on a resource chain table scheduling rule if the first judgment result indicates that it is greater than;

[0143] The step jump unit is used to determine whether the current total number of target encryption and decryption threads meets the preset number condition after the scheduling strategy optimization operation is completed, and when it is met, jump again to the step of determining whether the current loop identifier is greater than the preset loop threshold to complete the initialization operation.

[0144] In some specific embodiments, the data encryption module 13 may specifically include:

[0145] A first notification sending unit is used to send a corresponding task processing notification to its own preset business management thread through the password management component after receiving the encryption task information;

[0146] a unit for determining the number of data blocks to be encrypted, configured to determine the corresponding number of data blocks to be encrypted based on the list of data blocks to be encrypted in the encryption task information through the preset service management thread;

[0147] A first target cryptographic computing resource linked list determining unit, configured to use the preset service management thread to use the first resource linked list in the encryption and decryption thread handle pool corresponding to the encryption task information as the first target cryptographic computing resource linked list;

[0148] A first linked list node extraction unit is used to take out a first number of linked list nodes from the first target cryptographic computing resource linked list through the preset business management thread based on the current number of data blocks to be encrypted, the first target performance parameter corresponding to the first target cryptographic computing resource linked list, and the number of idle encryption threads, and update the number of idle encryption threads based on the first number to obtain the updated number of idle encryption threads;

[0149] a data encryption unit, configured to encrypt the data blocks to be encrypted in the list of data blocks to be encrypted by using a commercial cryptographic algorithm through the preset business management thread and based on the first number of linked list nodes, so as to obtain corresponding encrypted data;

[0150] The encryption result acquisition unit is used to update the current number of data blocks to be encrypted through the preset business management thread during the data encryption process. If the current number of data blocks to be encrypted is greater than zero and the cryptographic computing resource lists in the encryption and decryption thread handle pool corresponding to the encryption task information are not in an available state, then after completing the corresponding scheduling strategy optimization operation based on the resource list scheduling rule, the corresponding encryption and decryption thread handle pool addition operation is triggered until the encryption result corresponding to the encryption task information is obtained.

[0151] In some specific embodiments, the data decryption module 14 may specifically include:

[0152] A second notification sending unit is used to send a corresponding task processing notification to its own preset business management thread through the password management component after receiving the decryption task information;

[0153] A unit for determining the number of data blocks to be decrypted, configured to determine the corresponding number of data blocks to be decrypted based on the list of data blocks to be decrypted in the decryption task information through the preset service management thread;

[0154] A second target cryptographic computing resource linked list determining unit, configured to use the first resource linked list in the encryption and decryption thread handle pool corresponding to the decryption task information as the second target cryptographic computing resource linked list through the preset business management thread;

[0155] A second linked list node extraction unit is used to take out a second number of linked list nodes from the second target cryptographic computing resource linked list through the preset business management thread based on the current number of data blocks to be decrypted, the second target performance parameter corresponding to the second target cryptographic computing resource linked list, and the number of idle decryption threads, and update the number of idle decryption threads based on the second number to obtain the updated number of idle decryption threads;

[0156] a data decryption unit, configured to decrypt the data blocks to be decrypted in the list of data blocks to be decrypted by using the preset business management thread and based on the second number of linked list nodes, by calling a preset cryptographic computing resource interface to decrypt the data blocks to be decrypted by using a commercial cryptographic algorithm to obtain corresponding decrypted data;

[0157] The decryption result acquisition unit is used to update the current number of data blocks to be decrypted through the preset business management thread during the data decryption process. If the current number of data blocks to be decrypted is greater than zero and the cryptographic computing resource lists in the encryption and decryption thread handle pool corresponding to the decryption task information are not in an available state, then after completing the corresponding scheduling strategy optimization operation based on the resource list scheduling rule, the corresponding encryption and decryption thread handle pool addition operation is triggered until the decryption result corresponding to the decryption task information is obtained.

[0158] In some specific embodiments, the encryption result obtaining unit may specifically include:

[0159] A first target cryptographic computing resource linked list updating subunit is used to sort each of the encryption and decryption thread handle pools based on performance parameters corresponding to each of the cryptographic computing resources, and trigger a corresponding first target cryptographic computing resource linked list update operation according to the obtained sorting result to obtain an updated first target cryptographic computing resource linked list;

[0160] A second judgment subunit is used to calculate the difference between the number of created encryption threads and the expected number of encryption threads corresponding to the encryption task information for the updated first target cryptographic computing resource chain table, and judge whether the obtained difference meets the first preset condition to obtain a corresponding second judgment result;

[0161] a target parameter determination subunit, configured to determine a target parameter based on the difference and a preset task threshold value corresponding to the updated first target cryptographic computing resource linked list if the second judgment result indicates that the target parameter is not satisfied;

[0162] The thread creation subunit is used to create the target parameter encryption and decryption threads and linked list nodes if the target parameter is not greater than zero, and for each created encryption and decryption thread, import the encrypted second key into the corresponding encryption and decryption thread handle pool.

[0163] In some specific embodiments, the disk data encryption and decryption device may further include:

[0164] an asynchronous processing unit, configured to send the encrypted data to the volume encryption application component based on a preset asynchronous processing callback function if the current mode is asynchronous;

[0165] A synchronization processing unit is used to save the encrypted data into the encryption and decryption return table in the encryption task information if the current mode is synchronization, until the encrypted data corresponding to each of the data blocks to be encrypted is obtained and saved, and then the encryption and decryption return table storing the encryption result is sent to the volume encryption application component so that the encryption result can be written to the disk through the volume encryption application component.

[0166] Furthermore, the present application also discloses an electronic device. Figure 6 This is a structural diagram of an electronic device 2 / 30 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0167] Figure 6 A schematic diagram of the structure of an electronic device 2 / 30 provided in an embodiment of the present application. The electronic device 2 / 30 may specifically include: at least one processor 2 / 31, at least one memory 2 / 32, a power supply 2 / 33, a communication interface 2 / 34, an input / output interface 2 / 35, and a communication bus 2 / 36. The memory 2 / 32 is used to store a computer program, which is loaded and executed by the processor 2 / 31 to implement the relevant steps in the disk data encryption and decryption method disclosed in any of the aforementioned embodiments. In addition, the electronic device 2 / 30 in this embodiment may specifically be an electronic computer.

[0168] In this embodiment, the power supply 2 / 33 is used to provide working voltage for each hardware device on the electronic device 2 / 30; the communication interface 2 / 34 can create a data transmission channel between the electronic device 2 / 30 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 2 / 35 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0169] In addition, the memory 2 / 32, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 2 / 321, a computer program 2 / 322, etc. The storage method can be temporary storage or permanent storage.

[0170] The operating system 2 / 321 is used to manage and control the hardware devices and computer programs 2 / 322 on the electronic device 2 / 30, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the disk data encryption and decryption method performed by the electronic device 2 / 30 disclosed in any of the aforementioned embodiments, the computer program 2 / 322 can further include a computer program that can be used to complete other specific tasks.

[0171] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the disk data encryption and decryption method disclosed above. The specific steps of the method can refer to the corresponding contents disclosed in the above embodiments, and will not be repeated here.

[0172] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0173] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0174] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0175] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0176] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A disk data encryption and decryption method, characterized in that: include: Obtaining a first key based on the virtual machine identification information through a virtualized computing node controller program, and sending the first key to a volume encryption application component using a virtual encrypted volume constructed based on the created virtual machine image; The volume encryption application component uses the first key to encrypt and store the second key, and uses the encrypted second key to call a preset function of the password management component to trigger the encryption and decryption thread handle pool creation process corresponding to the virtual encrypted volume, so as to complete the initialization operation; When the encryption task information sent by the volume encryption application component is received through the password management component, a first target cryptographic computing resource linked list is determined based on the encryption and decryption thread handle pool corresponding to the encryption task information, and data is encrypted using a preset business management thread, a resource linked list scheduling rule, the first target cryptographic computing resource linked list, and the encryption task information, so that the encryption result is written to the disk through the volume encryption application component; When the decryption task information sent by the volume encryption application component is received through the password management component, the second target cryptographic computing resource list is determined based on the encryption and decryption thread handle pool corresponding to the decryption task information, and the preset business management thread, the resource list scheduling rules, the second target cryptographic computing resource list and the decryption task information are used to perform data decryption, so as to complete the disk data reading through the volume encryption application component and using the obtained decryption result.

2. The disk data encryption and decryption method according to claim 1, characterized in that: Before obtaining the first key based on the virtual machine identification information by the virtualized computing node controller program, the method further includes: When starting the operating system of the host machine, multiple cryptographic computing resources pre-configured in the physical host are checked to obtain corresponding check results; If the inspection result indicates that each of the cryptographic computing resources meets the preset conditions, the number of encryption and decryption threads and performance parameters corresponding to each of the cryptographic computing resources are initialized to complete the corresponding first data initialization operation and obtain a first data initialization result.

3. The disk data encryption and decryption method according to claim 2, characterized in that: The process of calling a preset function of the password management component by using the encrypted second key to trigger the creation process of the encryption and decryption thread handle pool corresponding to the virtual encrypted volume includes: Creating an encryption and decryption thread handle pool corresponding to the virtual encrypted volume through the password management component based on the preset function and the encrypted second key, and configuring a corresponding linked list for each of the password computing resources in the encryption and decryption thread handle pool; Initializing the number of available encryption and decryption threads, the number of idle encryption and decryption threads, and the total number of encryption and decryption threads corresponding to the plurality of cryptographic computing resources in the encryption and decryption thread handle pool to complete a corresponding second data initialization operation and obtain a second data initialization result; Determine whether the current loop identifier is greater than a preset loop threshold, and if not, update the loop identifier and trigger a corresponding encryption / decryption thread handle pool addition operation; After the encryption / decryption thread handle pool adding operation is completed, determining whether the preset encryption / decryption thread handle pool creation batch number is greater than the total number of target encryption / decryption threads in the second data initialization result, so as to obtain a corresponding first determination result; If the first judgment result indicates that it is greater than, triggering a corresponding scheduling strategy optimization operation based on the resource chain table scheduling rule; After the scheduling strategy optimization operation is completed, it is determined whether the total number of current target encryption and decryption threads meets the preset number condition, and if so, it is jumped again to the step of determining whether the current loop identifier is greater than the preset loop threshold to complete the initialization operation.

4. The disk data encryption and decryption method according to claim 1, characterized in that: The method of determining a first target cryptographic computing resource linked list based on the encryption and decryption thread handle pool corresponding to the encryption task information, and encrypting data using a preset business management thread, a resource linked list scheduling rule, the first target cryptographic computing resource linked list, and the encryption task information includes: After receiving the encryption task information, the password management component sends a corresponding task processing notification to its own preset business management thread; Determining the corresponding number of data blocks to be encrypted based on the list of data blocks to be encrypted in the encryption task information by the preset business management thread; Using the preset business management thread to use the first resource linked list in the encryption and decryption thread handle pool corresponding to the encryption task information as the first target cryptographic computing resource linked list; Through the preset business management thread, and based on the current number of data blocks to be encrypted, the first target performance parameter corresponding to the first target cryptographic computing resource linked list, and the number of idle encryption threads, a first number of linked list nodes are taken out from the first target cryptographic computing resource linked list, and the number of idle encryption threads is updated based on the first number to obtain an updated number of idle encryption threads; By using the preset business management thread and based on the first number of linked list nodes, each data block to be encrypted in the list of data blocks to be encrypted is respectively encrypted by calling a preset cryptographic computing resource interface to encrypt the data block to be encrypted by using a commercial cryptographic algorithm to obtain corresponding encrypted data; During the data encryption process, the current number of data blocks to be encrypted is updated through the preset business management thread. If the current number of data blocks to be encrypted is greater than zero and the cryptographic computing resource lists in the encryption and decryption thread handle pool corresponding to the encryption task information are not in an available state, then after completing the corresponding scheduling strategy optimization operation based on the resource list scheduling rules, the corresponding encryption and decryption thread handle pool addition operation is triggered until the encryption result corresponding to the encryption task information is obtained.

5. The disk data encryption and decryption method according to claim 1, characterized in that: The method of determining a second target cryptographic computing resource linked list based on the encryption and decryption thread handle pool corresponding to the decryption task information, and performing data decryption using the preset business management thread, the resource linked list scheduling rule, the second target cryptographic computing resource linked list, and the decryption task information includes: After receiving the decryption task information, the password management component sends a corresponding task processing notification to its own preset business management thread; Determining the corresponding number of data blocks to be decrypted based on the list of data blocks to be decrypted in the decryption task information by the preset business management thread; Using the preset business management thread to use the first resource linked list in the encryption and decryption thread handle pool corresponding to the decryption task information as the second target cryptographic calculation resource linked list; Taking out a second number of linked list nodes from the second target cryptographic computing resource linked list through the preset business management thread based on the current number of data blocks to be decrypted, the second target performance parameter corresponding to the second target cryptographic computing resource linked list, and the number of idle decryption threads, and updating the number of idle decryption threads based on the second number to obtain an updated number of idle decryption threads; By using the preset business management thread and based on the second number of linked list nodes, respectively decrypting the data blocks to be decrypted in the list of data blocks to be decrypted by calling a preset cryptographic computing resource interface, so as to use a commercial cryptographic algorithm to decrypt the data blocks to be decrypted, so as to obtain corresponding decrypted data; During the data decryption process, the current number of data blocks to be decrypted is updated through the preset business management thread. If the current number of data blocks to be decrypted is greater than zero and the cryptographic computing resource lists in the encryption and decryption thread handle pool corresponding to the decryption task information are not in an available state, then after completing the corresponding scheduling strategy optimization operation based on the resource list scheduling rules, the corresponding encryption and decryption thread handle pool addition operation is triggered until the decryption result corresponding to the decryption task information is obtained.

6. The disk data encryption and decryption method according to claim 4, characterized in that: After completing the corresponding scheduling strategy optimization operation based on the resource linked list scheduling rule, triggering the corresponding encryption and decryption thread handle pool addition operation includes: Sorting each of the encryption and decryption thread handle pools based on performance parameters corresponding to each of the cryptographic computing resources, and triggering a corresponding first target cryptographic computing resource linked list update operation according to the obtained sorting result, so as to obtain an updated first target cryptographic computing resource linked list; For the updated first target cryptographic computing resource chain table, calculating the difference between the corresponding number of created encryption threads and the expected number of encryption threads corresponding to the encryption task information, and determining whether the obtained difference satisfies a first preset condition, so as to obtain a corresponding second determination result; If the second judgment result indicates that it is not satisfied, determining the target parameter based on the difference and the preset task threshold corresponding to the updated first target cryptographic computing resource linked list; If the target parameter is not greater than zero, then create the target parameter encryption and decryption threads and linked list nodes, and for each of the created encryption and decryption threads, import the encrypted second key into the corresponding encryption and decryption thread handle pool.

7. The disk data encryption and decryption method according to claim 4, characterized in that: After obtaining the corresponding encrypted data, the method further includes: If the current mode is asynchronous, sending the encrypted data to the volume encryption application component based on a preset asynchronous processing callback function; If the current mode is synchronous, the encrypted data will be saved in the encryption and decryption return table in the encryption task information until the encrypted data corresponding to each data block to be encrypted is obtained and saved, and then the encryption and decryption return table that saves the encryption result will be sent to the volume encryption application component so that the encryption result can be written to the disk through the volume encryption application component.

8. A disk data encryption and decryption device, characterized in that: include: A first key acquisition module, used to acquire a first key based on virtual machine identification information through a virtualized computing node controller program, and send the first key to a volume encryption application component using a virtual encrypted volume constructed based on a created virtual machine image; An initialization completion module, configured to encrypt and store a second key using the first key through the volume encryption application component, and to call a preset function of the password management component using the encrypted second key to trigger a creation process of an encryption and decryption thread handle pool corresponding to the virtual encrypted volume, so as to complete the initialization operation; a data encryption module, configured to, when receiving encryption task information sent by the volume encryption application component through the password management component, determine a first target cryptographic computing resource linked list based on the encryption and decryption thread handle pool corresponding to the encryption task information, and perform data encryption using a preset business management thread, a resource linked list scheduling rule, the first target cryptographic computing resource linked list, and the encryption task information, so as to write the obtained encryption result to a disk through the volume encryption application component; A data decryption module is used to determine a second target cryptographic computing resource list based on an encryption and decryption thread handle pool corresponding to the decryption task information when receiving decryption task information sent by the volume encryption application component through the password management component, and to perform data decryption using the preset business management thread, the resource list scheduling rules, the second target cryptographic computing resource list and the decryption task information, so as to complete disk data reading through the volume encryption application component and using the obtained decryption result.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the disk data encryption and decryption method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, which, when executed by a processor, implements the disk data encryption and decryption method according to any one of claims 1 to 7.

Images