A disk data encryption and decryption method, device, equipment and storage medium

Abstract

The application discloses a disk data encryption and decryption method and device, equipment and a storage medium, and relates to the technical field of information security, and comprises the following steps: a virtualization computing node controller program sends a first key to a volume encryption application component by using a virtual encrypted volume constructed based on a created virtual machine image; the volume encryption application component triggers an encryption and decryption thread handle pool creation process by using an encrypted second key obtained based on the first key; when receiving encryption task information through a password management component, a first target password calculation resource linked list is determined based on an encryption and decryption thread handle pool corresponding to the encryption task information, and data encryption is performed by using a resource linked list scheduling rule and the first target password calculation resource linked list, so that disk data writing is completed; when receiving decryption task information through the password management component, decryption is performed by using a resource linked list scheduling rule and a second target password calculation resource linked list, so that data reading is completed. The encryption and decryption efficiency is effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security technology, and in particular to a disk data encryption and decryption method, device, equipment and storage medium. BACKGROUND

[0002] In the virtualization technology system, it is particularly important to protect the security isolation, confidentiality and integrity of the virtual machine image. However, in the existing method, (1) the use of password card mode needs to adapt to various server platforms, and the user server may not have a free slot to insert the password card, lacking flexibility; (2) when using external password machines and other devices and password services, the network performance is limited, and the corresponding encryption and decryption keys need to be imported into the password module and device, and then the data is encrypted and decrypted. After the encryption and decryption is completed, the encryption and decryption key is released. In this way, the frequent import and export of encryption and decryption keys reduces the overall performance and greatly increases the use cost. SUMMARY

[0003] Therefore, the purpose of the present application is to provide an information security technology method, device, equipment and storage medium, which can realize the logical isolation and confidentiality protection of the virtual machine image without adding external password related devices, reduce the import and export frequency of the key, improve the utilization rate of the password calculation resource and the efficiency and accuracy of the data encryption and decryption, thereby improving the applicability and reducing the use cost. The specific scheme is as follows:

[0004] In a first aspect, the present application provides a disk data encryption and decryption method, comprising:

[0005] A virtualization computing node controller program acquires a first key based on virtual machine identification information, and sends the first key to a volume encryption application component using a virtual encrypted volume constructed based on a created virtual machine image;

[0006] The volume encryption application component encrypts a second key using the first key, and calls a preset function of a password management component using the encrypted second key to trigger a creation process of an encryption and decryption thread handle pool corresponding to the virtual encrypted volume, so as to complete the initialization operation;

[0007] When the volume encryption application component sends encryption task information to the password management component, a first target password calculation resource chain table is determined based on the encryption task information, and data encryption is performed using a preset business management thread, a resource chain table scheduling rule, the first target password calculation resource chain table and the encryption task information, so that the encryption result obtained by the volume encryption application component is written to the disk;

[0008] When the decryption task information sent by the volume encryption application component is received by the password management component, a second target password calculation resource linked list is determined based on an encryption and decryption thread handle pool corresponding to the decryption task information, and data decryption is performed using the preset service management thread, the resource linked list scheduling rule, the second target password calculation resource linked list, and the decryption task information, so as to complete disk data reading by the volume encryption application component and using the obtained decryption result.

[0009] Optionally, before the first key is obtained by the virtualization calculation node controller program based on the virtual machine identification information, the method further includes:

[0010] When starting an operating system of the host, a plurality of password calculation resources pre-configured in the physical host are checked to obtain corresponding checking results;

[0011] If the checking results show that each of the password calculation resources meets a preset condition, the number of encryption and decryption threads and performance parameters corresponding to each of the password calculation resources are initialized to complete corresponding first data initialization operations and obtain first data initialization results.

[0012] Optionally, the preset function of the password management component is called by using the encrypted second key to trigger a creation process of the encryption and decryption thread handle pool corresponding to the virtual encrypted volume, including:

[0013] The encryption and decryption thread handle pool corresponding to the virtual encrypted volume is created by the password management component based on the preset function and the encrypted second key, and a corresponding linked list is configured for each of the password calculation resources in the encryption and decryption thread handle pool;

[0014] The available encryption and decryption thread number, the idle encryption and decryption thread number, and the total number of encryption and decryption threads corresponding to the plurality of password calculation resources of each of the password calculation resources in the encryption and decryption thread handle pool are initialized to complete corresponding second data initialization operations and obtain second data initialization results;

[0015] It is judged whether the current loop identifier is greater than a preset loop threshold, and when it is not satisfied, the loop identifier is updated, and a corresponding encryption and decryption thread handle pool addition operation is triggered;

[0016] After the encryption and decryption thread handle pool addition operation is completed, it is judged whether a preset encryption and decryption thread handle pool creation batch number is greater than a target encryption and decryption thread total number in the second data initialization result to obtain a corresponding first judgment result;

[0017] If the first judgment result shows that it is greater, a scheduling strategy optimization operation is triggered based on a resource linked list scheduling rule.

[0018] After the scheduling strategy optimization operation is completed, it is judged whether the current target encryption and decryption thread total number meets the preset number condition, and when it meets, it is re-jumped to the step of judging whether the current loop identifier is greater than the preset loop threshold, so as to complete the initialization operation.

[0019] Optionally, the first target cryptographic computing resource chain table is determined based on the encryption and decryption thread handle pool corresponding to the encryption task information, and data encryption is performed by using a preset business management thread, a resource chain table scheduling rule, the first target cryptographic computing resource chain table, and the encryption task information, including:

[0020] After receiving the encryption task information, the corresponding task processing notification is sent to the preset business management thread of the password management component;

[0021] The number of to-be-encrypted data blocks is determined by the preset business management thread based on the to-be-encrypted data block list in the encryption task information;

[0022] The first resource chain table in the encryption and decryption thread handle pool corresponding to the encryption task information is taken as the first target cryptographic computing resource chain table by the preset business management thread;

[0023] The first number of chain table nodes is taken out from the first target cryptographic computing resource chain table by the preset business management thread based on the current number of to-be-encrypted data blocks, the first target performance parameter corresponding to the first target cryptographic computing resource chain table, and the number of idle encryption threads, and the number of idle encryption threads is updated based on the first number, to obtain the updated number of idle encryption threads;

[0024] Each to-be-encrypted data block in the to-be-encrypted data block list is encrypted by calling a preset cryptographic computing resource interface by the preset business management thread based on the first number of chain table nodes, to obtain corresponding encrypted data;

[0025] In the process of data encryption, the current number of to-be-encrypted data blocks is updated by the preset business management thread, and if the current number of to-be-encrypted data blocks is greater than zero and all the cryptographic computing resource chain tables in the encryption and decryption thread handle pool corresponding to the encryption task information are not in an available state, then after completing the corresponding scheduling strategy optimization operation based on the resource chain table scheduling rule, the corresponding encryption and decryption thread handle pool addition operation is triggered until the encryption result corresponding to the encryption task information is obtained.

[0026] Optionally, the second target cryptographic computing resource chain table is determined based on the encryption / decryption thread handle pool corresponding to the decryption task information, and data decryption is performed by using the preset service management thread, the resource chain table scheduling rule, the second target cryptographic computing resource chain table, and the decryption task information.

[0027] After receiving the decryption task information, the corresponding task processing notification is sent to the preset service management thread of the cryptographic management component;

[0028] The number of to-be-decrypted data blocks is determined based on the to-be-decrypted data block list in the decryption task information by the preset service management thread.

[0029] The first resource chain table in the encryption / decryption thread handle pool corresponding to the decryption task information is taken as the second target cryptographic computing resource chain table by the preset service management thread.

[0030] The second number of chain table nodes is taken from the second target cryptographic computing resource chain table based on the current number of to-be-decrypted data blocks, the second target performance parameter corresponding to the second target cryptographic computing resource chain table, and the number of idle decryption threads by the preset service management thread, and the number of idle decryption threads is updated based on the second number to obtain an updated number of idle decryption threads.

[0031] Each to-be-decrypted data block in the to-be-decrypted data block list is decrypted by calling a preset cryptographic computing resource interface to use a commercial cryptographic algorithm to perform data decryption on the to-be-decrypted data block based on the second number of chain table nodes by the preset service management thread, to obtain corresponding decrypted data.

[0032] During the data decryption process, the current number of to-be-decrypted data blocks is updated by the preset service management thread, and if the current number of to-be-decrypted data blocks is greater than zero and all the cryptographic computing resource chain tables in the encryption / decryption thread handle pool corresponding to the decryption task information are not in an available state, a corresponding encryption / decryption thread handle pool addition operation is triggered after a corresponding scheduling strategy optimization operation is completed based on a resource chain table scheduling rule, until a decryption result corresponding to the decryption task information is obtained.

[0033] Optionally, the encryption / decryption thread handle pool addition operation is triggered after the scheduling strategy optimization operation is completed based on the resource chain table scheduling rule, and includes:

[0034] The encryption / decryption thread handle pools are sorted using performance parameters corresponding to each of the cryptographic computing resources, and the corresponding first target cryptographic computing resource linked list update operation is triggered according to the sorting result to obtain the updated first target cryptographic computing resource linked list.

[0035] For the updated first target cryptographic computation resource linked list, calculate the difference between the corresponding number of created encryption threads and the expected number of encryption threads corresponding to the encryption task information, and determine whether the obtained difference satisfies the first preset condition to obtain the corresponding second judgment result;

[0036] If the second judgment result does not meet the requirement, then the target parameter is determined based on the difference and the preset task threshold corresponding to the updated first target password calculation resource linked list;

[0037] If the target parameter is not greater than zero, then create the target parameter encryption / decryption thread and linked list node, and for each created encryption / decryption thread, import the encrypted second key into the corresponding encryption / decryption thread handle pool.

[0038] Optionally, after obtaining the corresponding encrypted data, the method further includes:

[0039] If the current mode is asynchronous, the encrypted data is sent to the volume encryption application component based on the preset asynchronous processing callback function;

[0040] If the current mode is synchronous, the encrypted data is saved to the encryption / decryption return table in the encryption task information. After the encrypted data corresponding to each of the data blocks to be encrypted is obtained and saved, the encryption / decryption return table containing the encryption results is sent to the volume encryption application component so that the obtained encryption results can be written to the disk through the volume encryption application component.

[0041] Secondly, this application provides a disk data encryption / decryption device, comprising:

[0042] The first key acquisition module is used to acquire the first key based on the virtual machine identification information through the virtualization computing node controller program, and send the first key to the volume encryption application component using the virtual encrypted volume built based on the created virtual machine image.

[0043] The initialization completion module is used to encrypt and store the second key using the first key through the volume encryption application component, and to call the preset function of the password management component using the encrypted second key to trigger the creation process of the encryption / decryption thread handle pool corresponding to the virtual encrypted volume, so as to complete the initialization operation.

[0044] a data encryption module, configured to, when receiving the encryption task information sent by the volume encryption application component through the password management component, determine a first target password calculation resource chain table based on an encryption and decryption thread handle pool corresponding to the encryption task information, and perform data encryption by using a preset service management thread, a resource chain table scheduling rule, the first target password calculation resource chain table, and the encryption task information, so as to write an obtained encryption result to a disk through the volume encryption application component;

[0045] a data decryption module, configured to, when receiving the decryption task information sent by the volume encryption application component through the password management component, determine a second target password calculation resource chain table based on an encryption and decryption thread handle pool corresponding to the decryption task information, and perform data decryption by using the preset service management thread, the resource chain table scheduling rule, the second target password calculation resource chain table, and the decryption task information, so as to complete disk data reading by using an obtained decryption result through the volume encryption application component.

[0046] In a third aspect, the present application provides an electronic device, comprising:

[0047] a memory, configured to save a computer program;

[0048] a processor, configured to execute the computer program to implement the steps of the foregoing disk data encryption and decryption method.

[0049] In a fourth aspect, the present application provides a computer readable storage medium, configured to save a computer program, and the computer program is executed by a processor to implement the steps of the foregoing disk data encryption and decryption method.

[0050] It can be seen that, in the present application, the virtualized computing node controller program obtains a first key based on virtual machine identification information, and sends the first key to a volume encryption application component using a virtual encrypted volume constructed based on a created virtual machine image; the volume encryption application component encrypts a second key using the first key, and calls a preset function of a password management component using the encrypted second key to trigger a creation process of an encryption / decryption thread handle pool corresponding to the virtual encrypted volume, so as to complete an initialization operation; when the password management component receives encryption task information sent by the volume encryption application component, a first target password computing resource chain table is determined based on an encryption / decryption thread handle pool corresponding to the encryption task information, and data encryption is performed using a preset business management thread, a resource chain table scheduling rule, the first target password computing resource chain table, and the encryption task information, so that the volume encryption application component writes an obtained encryption result to a disk; when the password management component receives decryption task information sent by the volume encryption application component, a second target password computing resource chain table is determined based on an encryption / decryption thread handle pool corresponding to the decryption task information, and data decryption is performed using the preset business management thread, the resource chain table scheduling rule, the second target password computing resource chain table, and the decryption task information, so that the volume encryption application component completes disk data reading using an obtained decryption result. In the embodiment, the first key is obtained by the virtualized computing node controller program to complete the initialization operation, and in the subsequent encryption / decryption process, the first / second target password computing resource chain table corresponding to the received encryption / decryption task information and the initialized encryption / decryption thread handle pool obtained based on the virtual machine image are determined by the password management component, and the corresponding password computing resource scheduling is performed by the resource chain table scheduling rule during encryption / decryption, so as to complete data encryption / decryption. In this way, the logical isolation and confidentiality protection of the virtual machine image can be realized without adding external password-related devices, the import and export frequency of the key is reduced, the utilization rate of the password computing resource and the efficiency and accuracy of data encryption / decryption are improved, the applicability is improved, and the use cost is reduced. BRIEF DESCRIPTION OF DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor based on the provided drawings.

[0052] Figure 1 A flowchart of a disk data encryption / decryption method provided in the present application;

[0053] Figure 2 A specific disk data encryption and decryption method flowchart is provided for the present application.

[0054] Figure 3 A specific disk data encryption flowchart is provided for the present application.

[0055] Figure 4 A flowchart of adding an encryption and decryption thread handle pool is provided for the present application.

[0056] Figure 5 A disk data encryption and decryption device structure diagram is provided for the present application.

[0057] Figure 6 A structure diagram of an electronic device is provided for the present application. DETAILED DESCRIPTION

[0058] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of the present application.

[0059] However, in the prior method, (1) the use of a password card requires adaptation to various server platforms, and the user server may not have a free slot to insert the password card, lacking flexibility; (2) when using external password machines and the like, the network performance is limited, and the corresponding encryption and decryption keys need to be imported into the password module and device, and then the data is encrypted and decrypted, and the encryption and decryption keys are released after the encryption and decryption is completed. In this way, the process of frequently importing and releasing the encryption and decryption keys reduces the overall performance and greatly increases the use cost. Therefore, the present application provides a disk data encryption and decryption scheme, which can realize logical isolation and confidentiality protection of a virtual machine image without adding external password-related devices, and effectively improves the encryption and decryption efficiency.

[0060] Referring to Figure 1 The present embodiment discloses a disk data encryption and decryption method, which comprises:

[0061] In step S11, a first key is obtained based on virtual machine identification information through a virtualization computing node controller program, and the first key is sent to a volume encryption application component by using a virtual encrypted volume constructed based on a created virtual machine image.

[0062] In combination with Figure 1It is shown that, in this embodiment, some configurations and pre-processing are required before use to complete initialization. Specifically, the configurations include: encryption performance priority option or decryption performance priority option, encryption and decryption thread handle pool (i.e. Figure 1 the encryption and decryption service thread handle pool in cnfpatch), encryption and decryption thread invalidation time (i.e. cnfouttime), maximum number of tasks per password calculation resource (i.e. cnfmaxths, ≥ 2*cnfpatch), number of password calculation resources N and corresponding password calculation resource interfaces, and confirmation of the consistency and interoperability of the algorithms provided by each password calculation resource. Among them, the password calculation resources include soft password modules based on soft algorithms, embedded algorithm password acceleration chips (such as CPUs (Central Processing Unit), motherboards, etc.), password cards and other types of calculation resources. Then, when starting the operating system of the host, the pre-configured multiple password calculation resources in the physical host are checked to obtain the corresponding checking result; if the checking result shows that each password calculation resource meets the preset condition, i.e. normal, initialize the number of all encryption and decryption threads created by each password calculation resource g_totalths_src[1...N]=0, initialize the performance parameters of each password calculation resource g_perf_src[0]=1, g_perf_src[1..N]=0, to complete the corresponding first data initialization operation and obtain the first data initialization result.

[0063] Further, in this embodiment, when creating a virtual machine encryption image (i.e. a virtual machine image), the virtualization computing node controller program (i.e. Figure 1 the computing node controller agent in cnfpatch) applies for a first key PK from the secret tube system or a controller with secret tube capability according to the allocated virtual machine unique identifier (i.e. virtual machine identifier information). It should be noted that the virtualization computing node controller program in this embodiment is used to realize the connection with the key management system, obtain the required key, and call the command interface to realize the creation, loading and other operations of the virtual machine encryption volume.

[0064] Step S12, the volume encryption application component encrypts and stores the second key using the first key, and calls a preset function of the password management component using the encrypted second key to trigger the encryption and decryption thread handle pool creation process corresponding to the virtual encryption volume, so as to complete the initialization operation.

[0065] In combination with Figure 1 It is shown that, in this embodiment, after obtaining the first key PK, the data encryption key WK (i.e. the second key) is encrypted and stored by the volume encryption application component (i.e. Figure 1The volume encryption application module in the virtual machine (PK) randomly generates and protects the storage using a PK. When loading the virtual machine encrypted image, the password management component (i.e., Figure 1 The preset function of the cryptographic computation management module (in this embodiment), namely the `set_key` function, passes the key (WK) to the cryptographic management component for corresponding initialization. It's important to understand that the cryptographic management component in this embodiment provides various commercial cryptographic algorithms, supports asynchronous and synchronous processing, manages multiple cryptographic computation resources using a thread pool, performs encryption, decryption, and hashing operations on data blocks read and written to disk, and provides standardized interfaces to support encryption and decryption for different applications. Specifically, the initialization process involves the following steps:

[0066] 1): The virtualization compute node controller program loads the virtual machine image to form a virtual encrypted volume and passes the PK to the volume encryption application component. The volume encryption application component encrypts and protects the WK with the PK according to its own key system, and then calls the password management component to perform the set_key operation. The main parameters of set_key include ctx, WK, etc., where ctx can be the virtual encrypted volume instance context or the context structure data of the current request.

[0067] 2): The password management component creates an encryption / decryption volume business thread handle pool (thpool) under the current ctx. Each password computing resource in the thpool generates an empty linked list. The number of encryption / decryption threads for each password computing resource in the thpool is initialized, i.e., the number of available encryption / decryption threads currths_src[1...N]=0. The number of idle encryption / decryption threads for each password computing resource in the thpool is initialized to idleths_src[1...N]=0. The total number of encryption / decryption threads for the password computing resources in the thpool is initialized to totalths_ctx=0, and cycleid (i.e., the cycle identifier)=0.

[0068] 3): If cycleid > preset cycle threshold (can be set to 2, or can be set according to actual needs), then return and wait for the next trigger; otherwise, continue to execute, update cycleid = cycleid + 1, execute the "add encryption / decryption thread handle pool" process through the password management component, and pass in the parameters thpool, addnum (representing the expected number of threads) = cnfpatch and WK, and wait for the execution to complete before proceeding to step 4;

[0069] 4): compare totalths_ctx with cnfpatch, if the first judging result shows that totalths_ctx≥cnfpatch, return; otherwise, set the current thpool's o_total=totalths_ctx, execute the scheduling strategy optimization operation, i.e., the "strategy optimization timing task" flow, pass in the parameters freenums=cnfpatch-totalths_ctx and thpool, and after waiting for the execution to be completed, execute step 5;

[0070] 5): judge whether o_total>totalths_ctx, if the condition is true, it indicates that there is release, continue step 3, otherwise, return.

[0071] Step S13, when receiving the encryption task information sent by the volume encryption application component through the password management component, determining a first target password calculation resource chain table based on the encryption and decryption thread handle pool corresponding to the encryption task information, and using a preset business management thread, a resource chain table scheduling rule, the first target password calculation resource chain table and the encryption task information to perform data encryption, so as to write the obtained encryption result to the disk through the volume encryption application component.

[0072] In the embodiment, when encrypting, the volume encryption application component calls the encrypt function of the password management component, if it is an asynchronous mode, the data processed by the encryption is received through the callback function of the volume encryption application component, if it is a synchronous mode, the data processed by the encryption is directly returned through the encrypt function, and then the volume encryption application component writes the received data processed by the encryption to the disk. The password management component first starts the encryption operation according to a performance optimization strategy, and at the same time, performs encryption task detection, if there is a remaining encryption task, more encryption and decryption threads are created and obtained to perform the encryption operation. In combination with Figure 3 As shown in the figure, the specific encryption steps are as follows:

[0073] 1): when the upper caller (such as a file system, a virtual machine monitor, etc.) requests to write data to the read-write request module of the volume encryption application component, the volume encryption application component calls the encrypt operation of the password management component, and passes in the encryption task information, including the parameter ctx (herein, the context structure data of the data encryption task corresponding to the current data write request), the to-be-encrypted data block list, the encryption and decryption return table, the asynchronous processing callback function, etc.

[0074] 2) The password management component calculates the encryption request task T, puts it into a task table, and notifies the business management thread, i.e., the preset business management thread, to process it. At the same time, if the password management component is in asynchronous mode, it directly returns the result to the volume encryption application component; if it is in synchronous mode, it waits for the encryption / decryption return table to receive all encrypted data blocks before returning to the volume encryption application component.

[0075] 3): When the business management thread receives the notification message, it starts task processing, calculates the number of blocks in the list of data blocks to be encrypted in T to obtain the number of data blocks to be encrypted, i.e., waitttasks;

[0076] 4): Let the current password computation resource linked list S, i.e. the first target password computation resource linked list, be the first linked list in the encryption / decryption volume thread handle pool of the corresponding ctx, with the number i; set the number of threads that have been retrieved and run in the current task popths=0;

[0077] 5): The business management thread calculates the weight mul (number of threads to be retrieved from the current linked list i) and the number of threads to be retrieved from the current linked list popfactor.

[0078] ;

[0079] popfactor=min(waittaks-popths*mul, idleths_src[i]);

[0080] 6): The business management thread retrieves popths = min(popfactor, idleths_src[i]), which is the first number of linked list nodes, from S. Then it updates idleths_src[i] = idleths_src[i] - popths and executes the encryption / decryption thread that retrieves the node. (It should be noted that in this embodiment, the operations of updating g_totalths_src, totalths_ctx, currths_src, and idleths_src are all atomic operations.)

[0081] 7): The business management thread recalculates waittasks = min(waittasks - popths, the number of data blocks to be encrypted in T). If the current waittasks > 0 and there is a next available cryptographic calculation resource in the encryption / decryption volume thread handle pool of the corresponding ctx, let S = the next cryptographic calculation resource linked list, numbered i, and continue to step 5.

[0082] 8): If the current waittasks>0 and there is no next available password computing resource in the encryption / decryption thread handle pool corresponding to the ctx, the service management thread executes the "strategy optimization timing task" process, then executes the "encryption / decryption thread handle pool adding" process, and then judges whether the corresponding ctx satisfies >0, if yes, continue step 4, otherwise, wait for a short time and then continue step 4;

[0083] 9): If the waittasks<=0, the service management thread is suspended and the processing is stopped.

[0084] Further, the following steps 10 to 12 are the processes executed by each encryption / decryption thread taken out in step 6.

[0085] 10): Assuming that the encryption / decryption thread is runthreads, runthreads takes out a data block to be encrypted from the head of the list of data blocks to be encrypted in T, if the taking out is successful, continue step 11, otherwise, the thread is suspended, the active time in the list node node of the thread is updated, and the node is put back into the corresponding password computing resource list;

[0086] 11): runthreads calls the preset password computing resource interface to use the commercial password algorithm to perform encryption operation on the data block to be encrypted, and obtains the corresponding encrypted data. If the encryption strategy priority configuration is set, a latest single task processing time is recorded and updated into the corresponding node;

[0087] 12): If it is an asynchronous mode, runthreads calls the preset asynchronous processing callback function of the volume encryption application component to return the encrypted data. If it is a synchronous mode, runthreads stores the encrypted data into the encryption / decryption return table saved by the password management component. Continue step 10 until the encrypted data corresponding to all data blocks to be encrypted is obtained, so as to write all the encrypted data into the disk through the volume encryption application component.

[0088] In combination with Figure 4 shown in the figure, in the embodiment, regarding the strategy optimization timing task, the strategy optimization processing module of the password management component is used to complete the task, and the specific steps are as follows:

[0089] 1): Calculate the g_perf_src of each password computing resource: estimate the average performance g_perf_src[idx]=(∑each latest single task processing time) / the number of encryption / decryption threads with single task processing time greater than 0, wherein idx is the number of each password computing resource;

[0090] 2): Sort the encryption / decryption thread handle pool according to the g_perf_src value from small to large, and obtain the sorting result;

[0091] 3): Set realnum (representing the number of currently released (unable to process encryption / decryption tasks) handle pools) = 0, node is the first linked list node in the first linked list of the first ctx (which can be a virtual encrypted volume instance context or a context structure data of a current write / read request), and execute:

[0092] 3-1): If the node is empty, execute step 4; otherwise, continue, obtain the current time t, determine that the node corresponds to an instance ctx, set the node corresponding encryption / decryption thread handle pool as thp2, the node corresponding resource linked list as S, and the node corresponding linked list number as id;

[0093] 3-2): If the active time recorded by t-node is greater than cnfouttime, release the encryption / decryption thread, encryption / decryption handle pool and node, update S g_totalths_src[id]=g_totalths_src[id]-1, update realnum=realnum+1, update ctx totalths_ctx=totalths_ctx-1, update S currths_src[id]=currths_src[id]-1, update S idleths_src[id]=idleths_src[id]-1, that is, complete the first target password calculation resource linked list update operation;

[0094] 3-3): Let node=next node, if the node is empty, the node is the first linked list node of the next resource linked list. And execute step 3-1;

[0095] 4): If the parameters freenums and thpool are received, calculate freenums=freenums-realnum, if freenums is greater than 0, execute:

[0096] 4-1): Calculate the maximum number of encryption / decryption threads that can be created cancreated= (cnfmaxths[i]-g_totalths_src[i]), and update freenums=freenums-cancreated, if freenums is greater than 0, execute the next step;

[0097] 4-2): Find 5 encryption and decryption thread lists with the largest number of currths_src under all ctxs except thpool, and mark them as top_5, and set id as the number of the first encryption and decryption thread list S in top_5, and the corresponding instance ctx;

[0098] 4-3): If S is empty or freenums is less than or equal to 0, return to the beginning of step 4, otherwise continue to the next step;

[0099] 4-4): Release realnum=min(idleths_src[id], freenums) encryption and decryption threads and handles in S, update g_totalths_src[id]=g_totalths_src[id]-realnum, update totalths_ctx of the corresponding ctx=totalths_ctx-realnum, update currths_src[id] of the corresponding S=currths_src[id]-realnum, update idleths_src[id] of the corresponding S=idleths_src[id]-realnum, and freenums=freenums-realnum;

[0100] 4-5): S is the next encryption and decryption thread list in top_5, S is numbered as id, and the corresponding instance ctx is executed in step 4-3.

[0101] That is, the embodiment automatically adjusts the encryption and decryption thread handle pool to be used by calculating the performance of each cryptographic computing resource, so as to realize automatic optimization of parallel scheduling strategy and improve the encryption and decryption processing performance of a large number of data blocks such as virtual volumes and physical volumes.

[0102] It should be further understood that in the embodiment, the encryption and decryption thread handle pool addition operation has the following specific steps:

[0103] 1): Set tmpa (representing the number of created threads) =0, and set the current encryption and decryption thread list S as the first encryption and decryption thread list in thpool, numbered i;

[0104] 2): Calculate the difference between the number of created encryption threads and the expected number of encryption threads corresponding to the encryption task information, that is, calculate b=addnum-tmpa, and determine whether the obtained difference b satisfies the first preset condition, that is, whether b<1 or S is empty, if the second determination result is yes, return tmpa;

[0105] 3): If the second judgment result is negative, calculate the target parameter a=min(b, cnfmaxths[i]-g_totalths_src[i]). If a is greater than 0, continue to step 4 below; otherwise, directly execute step 5.

[0106] 4): Create a encryption / decryption threads and nodes. In each newly created encryption / decryption thread, import WK into the corresponding password calculation resource to obtain the encryption / decryption handle. Put the thread number, encryption / decryption handle and other information into the node. Put the node into the end of S and set g_totalths_src[i]=g_totalths_src[i]+a, totalths_ctx=totalths_ctx+a, currths_src[i]=currths_src[i]+a, idleths_src[i]=idleths_src[i]+a, tmpa=tmpa+a;

[0107] 5): S = the next cryptographic computation resource list in thpool, continue to step 2.

[0108] Step S14: When the password management component receives the decryption task information sent by the volume encryption application component, a second target password computation resource linked list is determined based on the encryption / decryption thread handle pool corresponding to the decryption task information. The data is then decrypted using the preset business management thread, the resource linked list scheduling rules, the second target password computation resource linked list, and the decryption task information, so that the disk data can be read by the volume encryption application component using the obtained decryption result.

[0109] In this embodiment, as Figure 1 As shown, during decryption, the volume encryption application component calls the `decrypt` function of the password management component. During reading, the password management component can directly return data to a higher-level caller (such as the file system, virtual machine monitor, etc.). The password management component first starts encryption / decryption threads according to an optimal performance strategy to perform decryption operations, while simultaneously checking decryption tasks. If there are remaining tasks to be decrypted, it attempts to create or acquire more encryption / decryption threads to perform decryption operations. The specific decryption steps can be found in the encryption steps in S13, as shown below:

[0110] 1): When the upper caller (such as a file system, a virtual machine monitor, etc.) requests to write data, the upper caller requests the read-write request module of the volume encryption application component to read disk data, the volume encryption application component calls the decrypt operation of the password management component, and passes in decryption task information, including parameters ctx (here, a context structure data of a data decryption task corresponding to the current data read request), a list of data blocks to be decrypted, a decryption return table, an asynchronous processing callback function, etc., wherein the decryption return table can be passed in by the upper caller to support returning decrypted data directly to the upper caller;

[0111] 2): The password management component calculates a decryption request task T, puts it into a task table, and notifies a business management thread to process. At the same time, the password management component directly returns the result to the volume encryption application component in an asynchronous mode, and waits for the volume encryption application component to return after all the decrypted data blocks are received by the decryption return table in a synchronous mode;

[0112] 3): The business management thread receives the notification message and starts task processing, calculates the number of blocks in the list of data blocks to be decrypted in T, and obtains the number of data blocks to be decrypted, i.e., waittasks;

[0113] 4): Let the current password calculation resource chain table S, i.e., the second target password calculation resource chain table, be the first chain table corresponding to the ctx in the encryption thread handle pool, numbered i; set the number of threads currently running for the current task popths=0;

[0114] 5): The business management thread calculates the weight mul of the number of threads to be taken out of the current chain table numbered i, and the number of threads popfactor to be taken out of the current chain table numbered i:

[0115] ;

[0116] popfactor=min(waittasks-popths*mul,idleths_src[i]);

[0117] 6): The business management thread takes out popths=min(popfactor,idleths_src[i]), i.e., the second number of chain table nodes node from S, and then updates idleths_src[i]=idleths_src[i]-popths, and executes the decryption thread of the taken-out node;

[0118] 7): The service management thread recalculates waittasks = min (waittasks-popths, the number of decrypted data blocks in T), and if the current waittasks > 0 and there is a next available cryptographic computing resource in the encryption and decryption thread handle pool corresponding to the ctx, sets S = the next cryptographic computing resource chain table, numbered i, and continues step 5;

[0119] 8): The service management thread determines whether there is a next available cryptographic computing resource in the encryption and decryption thread handle pool corresponding to the ctx if the current waittasks > 0, and if not, executes the "strategy optimization timing task" process, then executes the "encryption and decryption thread handle pool addition" process, and then determines whether the corresponding ctx meets > 0, and if so, continues step 4, otherwise waits for a short time and continues step 4;

[0120] 9): If waittasks <= 0, the service management thread is suspended and stops processing.

[0121] Further, the following steps 10 to 12 are the processes executed by each encryption and decryption thread taken out in step 6.

[0122] 10): Set the encryption and decryption thread as runthreads, and runthreads takes a decrypted data block from the head of the decrypted data block list in T, and if the taking is successful, continues step 11; otherwise, the thread is suspended, the active time in the node of the thread chain table node is updated, and the node is put back into the corresponding cryptographic computing resource chain table;

[0123] 11): runthreads calls the preset cryptographic computing resource interface using a commercial cryptographic algorithm to perform decryption operation on the decrypted data block, and obtains the corresponding decrypted data. If the decryption strategy priority configuration is set, a recent single task processing time is recorded and updated in the corresponding node;

[0124] 12): If it is an asynchronous mode, runthreads calls the preset asynchronous processing callback function of the volume encryption application component to return the decrypted data. If it is a synchronous mode, runthreads stores the decrypted data into the encryption and decryption return table saved by the cryptographic management component. Continue step 10 until the decrypted data corresponding to all decrypted data blocks is obtained, so as to return all decrypted data to the upper layer caller through the volume encryption application component to complete the disk data reading.

[0125] In summary, in the embodiment, different cryptographic computing resources such as a soft password module, a password card, and a password acceleration chip deployed in a virtualized computing node are integrated, a combined encryption and decryption thread and handle integrated pool management method is combined, according to a performance priority scheduling strategy, corresponding cryptographic computing resources are automatically called, high-performance parallel encryption and decryption processing of a large number of data blocks such as disks is implemented. The cryptographic computing management module provides a standardized interface, and an upper key system manages according to its own business, and supports high-performance encryption and decryption processing of different block storage devices in different application scenarios. That is, in the embodiment, multiple cryptographic computing resources configured by a physical host are fully utilized, high-performance cryptographic computing resources are preferentially selected, the import and export frequency of encryption and decryption keys is reduced, the utilization rate of cryptographic computing resources is improved, the high-performance concurrent processing capability for a large number of data blocks such as virtual volumes and physical disk partitions is improved, and the encryption and decryption efficiency is effectively improved; at the same time, commercial cryptographic algorithms are used in each module to ensure the security compliance of key use and cryptographic application.

[0126] As can be seen, in the embodiment, the initialization operation is completed by obtaining the first key through the virtualized computing node controller program, in the subsequent encryption / decryption process, the corresponding first / second target cryptographic computing resource linked list is determined by the cryptographic management component and using the received encryption / decryption task information, and the initialized encryption and decryption thread handle pool based on the virtual machine image, and the corresponding cryptographic computing resource scheduling is performed according to the resource linked list scheduling rule during encryption / decryption to complete data encryption / decryption. In this way, without the need to add external password-related devices, logical isolation and confidentiality protection of the virtual machine image can be realized, the import and export frequency of the key is reduced, the utilization rate of the cryptographic computing resource and the efficiency and accuracy of the data encryption and decryption are improved, thereby improving the applicability and reducing the use cost.

[0127] Referring to Figure 5 The application embodiment also discloses a disk data encryption and decryption device, which comprises:

[0128] A first key obtaining module 11 is configured to obtain a first key based on virtual machine identification information through a virtualized computing node controller program, and send the first key to a volume encryption application component by using a virtual encrypted volume constructed based on a created virtual machine image.

[0129] An initialization completion module 12 is configured to encrypt and store a second key by using the first key through the volume encryption application component, and call a preset function of a cryptographic management component by using the encrypted second key, so as to trigger a corresponding encryption and decryption thread handle pool creation process of the virtual encrypted volume, so as to complete the initialization operation.

[0130] The data encryption module 13 is configured to, when receiving the encryption task information sent by the volume encryption application component through the password management component, determine a first target password calculation resource chain table based on an encryption and decryption thread handle pool corresponding to the encryption task information, and perform data encryption by using a preset service management thread, a resource chain table scheduling rule, the first target password calculation resource chain table, and the encryption task information, so as to write an obtained encryption result to a disk by the volume encryption application component.

[0131] The data decryption module 14 is configured to, when receiving the decryption task information sent by the volume encryption application component through the password management component, determine a second target password calculation resource chain table based on an encryption and decryption thread handle pool corresponding to the decryption task information, and perform data decryption by using the preset service management thread, the resource chain table scheduling rule, the second target password calculation resource chain table, and the decryption task information, so as to complete disk data reading by the volume encryption application component and by using an obtained decryption result.

[0132] The more specific working processes of the above modules can refer to the corresponding contents disclosed in the foregoing embodiments, and will not be described here again.

[0133] Therefore, in the embodiment, the first key is obtained by the virtualized computing node controller program to complete the initialization operation, and in the subsequent encryption / decryption process, the corresponding first / second target password calculation resource chain table is determined by the password management component and by using the received encryption / decryption task information and the initialized encryption and decryption thread handle pool obtained based on the virtual machine image, and the corresponding password calculation resource scheduling is performed by the resource chain table scheduling rule during encryption / decryption, so as to complete data encryption / decryption. In this way, the logical isolation and confidentiality protection of the virtual machine image can be realized without adding external password-related devices, the key import / export frequency is reduced, the utilization rate of the password calculation resource and the efficiency and accuracy of data encryption / decryption are improved, and thus the applicability is improved and the use cost is reduced.

[0134] In some specific embodiments, the disk data encryption and decryption apparatus can further include:

[0135] The computing resource checking unit is configured to, when starting an operating system of the host machine, check a plurality of password calculation resources pre-configured in the physical host machine to obtain a corresponding checking result.

[0136] The first data initialization unit is configured to, if the checking result indicates that each of the password calculation resources meets a preset condition, initialize an encryption and decryption thread number and a performance parameter corresponding to each of the password calculation resources respectively to complete a corresponding first data initialization operation and obtain a first data initialization result.

[0137] In some embodiments, the initialization completion module 12 can specifically include:

[0138] The encryption / decryption thread handle pool creation unit is configured to create an encryption / decryption thread handle pool corresponding to the virtual encrypted volume through the password management component and based on the preset function and the encrypted second key, and configure a corresponding linked list for each of the password calculation resources in the encryption / decryption thread handle pool.

[0139] The second data initialization unit is configured to initialize the number of available encryption / decryption threads, the number of idle encryption / decryption threads of each of the password calculation resources in the encryption / decryption thread handle pool, and the total number of encryption / decryption threads corresponding to the plurality of password calculation resources to complete a corresponding second data initialization operation and obtain a second data initialization result.

[0140] The encryption / decryption thread handle pool adding unit is configured to determine whether the current loop identifier is greater than a preset loop threshold, and when the determination result is negative, update the loop identifier and trigger a corresponding encryption / decryption thread handle pool adding operation.

[0141] The first determination unit is configured to determine whether a preset encryption / decryption thread handle pool creation batch number is greater than a target total number of encryption / decryption threads in the second data initialization result after the encryption / decryption thread handle pool adding operation is completed, to obtain a corresponding first determination result.

[0142] The scheduling strategy optimization unit is configured to trigger a corresponding scheduling strategy optimization operation based on a resource linked list scheduling rule if the first determination result indicates that the preset encryption / decryption thread handle pool creation batch number is greater than the target total number of encryption / decryption threads.

[0143] The step jumping unit is configured to determine whether the current target total number of encryption / decryption threads meets a preset quantity condition after the scheduling strategy optimization operation is completed, and when the determination result is positive, jump back to the step of determining whether the current loop identifier is greater than the preset loop threshold, so as to complete the initialization operation.

[0144] In some embodiments, the data encryption module 13 can specifically include:

[0145] The first notification sending unit is configured to send a corresponding task processing notification to a preset business management thread of the data encryption module 13 through the password management component after receiving the encryption task information.

[0146] The to-be-encrypted data block quantity determination unit is configured to determine a corresponding to-be-encrypted data block quantity based on a to-be-encrypted data block list in the encryption task information through the preset business management thread.

[0147] A first target cryptographic computing resource chain table determination unit is configured to determine, by the preset service management thread, a first resource chain table in an encryption / decryption thread handle pool corresponding to the encryption task information as a first target cryptographic computing resource chain table.

[0148] A first chain table node extraction unit is configured to extract, by the preset service management thread, a first number of chain table nodes from the first target cryptographic computing resource chain table based on the current number of data blocks to be encrypted, a first target performance parameter corresponding to the first target cryptographic computing resource chain table, and the number of idle encryption threads, and update the number of idle encryption threads based on the first number to obtain an updated number of idle encryption threads.

[0149] A data encryption unit is configured to perform data encryption on each data block to be encrypted in the list of data blocks to be encrypted by calling a preset cryptographic computing resource interface to use a commercial cryptographic algorithm to encrypt the data block to be encrypted based on the first number of chain table nodes by the preset service management thread.

[0150] An encryption result acquisition unit is configured to update the current number of data blocks to be encrypted by the preset service management thread during data encryption. If the current number of data blocks to be encrypted is greater than zero and none of the cryptographic computing resource chain tables in the encryption / decryption thread handle pool corresponding to the encryption task information is in an available state, the encryption / decryption thread handle pool addition operation is triggered after the corresponding scheduling strategy optimization operation based on the resource chain table scheduling rule is completed, until the encryption result corresponding to the encryption task information is obtained.

[0151] In some embodiments, the data decryption module 14 can specifically include:

[0152] A second notification sending unit is configured to send a corresponding task processing notification to the preset service management thread of the cryptographic management component after receiving the decryption task information.

[0153] A data block quantity to be decrypted determination unit is configured to determine, by the preset service management thread, a corresponding number of data blocks to be decrypted based on a list of data blocks to be decrypted in the decryption task information.

[0154] A second target cryptographic computing resource chain table determination unit is configured to determine, by the preset service management thread, a first resource chain table in an encryption / decryption thread handle pool corresponding to the decryption task information as a second target cryptographic computing resource chain table.

[0155] a second chain table node extraction unit, configured to extract, by the preset service management thread, a second number of chain table nodes from the second target cryptographic computing resource chain table based on the current number of to-be-decrypted data blocks, a second target performance parameter corresponding to the second target cryptographic computing resource chain table, and the number of idle decryption threads, and update the number of idle decryption threads based on the second number to obtain an updated number of idle decryption threads;

[0156] a data decryption unit, configured to perform, by the preset service management thread, data decryption on each to-be-decrypted data block in the to-be-decrypted data block list based on the second number of chain table nodes, by calling a preset cryptographic computing resource interface, to obtain corresponding decrypted data by using a commercial cryptographic algorithm;

[0157] a decryption result acquisition unit, configured to update, by the preset service management thread, the current number of to-be-decrypted data blocks during the data decryption, and if the current number of to-be-decrypted data blocks is greater than zero and all the cryptographic computing resource chain tables in the encryption and decryption thread handle pool corresponding to the decryption task information are not in an available state, trigger a corresponding encryption and decryption thread handle pool addition operation after a corresponding scheduling strategy optimization operation based on a resource chain table scheduling rule is completed, until a decryption result corresponding to the decryption task information is obtained.

[0158] In some embodiments, the encryption result acquisition unit can specifically include:

[0159] a first target cryptographic computing resource chain table updating sub-unit, configured to sort each encryption and decryption thread handle pool based on a performance parameter corresponding to each cryptographic computing resource, and trigger a corresponding first target cryptographic computing resource chain table updating operation according to a sorting result obtained to obtain an updated first target cryptographic computing resource chain table;

[0160] a second judgment sub-unit, configured to calculate a difference between a created encryption thread number corresponding to the updated first target cryptographic computing resource chain table and an expected encryption thread number corresponding to the encryption task information, and determine whether the difference obtained satisfies a first preset condition to obtain a corresponding second judgment result;

[0161] a target parameter determination sub-unit, configured to determine a target parameter based on the difference and a preset task threshold corresponding to the updated first target cryptographic computing resource chain table if the second judgment result indicates that the first preset condition is not satisfied;

[0162] The thread creation subunit is configured to create the target number of encryption and decryption threads and linked list nodes if the target parameter is not greater than zero, and to import the encrypted second key into a corresponding encryption and decryption thread handle pool for each created encryption and decryption thread.

[0163] In some embodiments, the disk data encryption and decryption apparatus can further include:

[0164] The asynchronous processing unit is configured to send the encrypted data to the volume encryption application component based on a preset asynchronous processing callback function if the current mode is asynchronous.

[0165] The synchronous processing unit is configured to save the encrypted data in an encryption and decryption return table in the encryption task information if the current mode is synchronous, and to send the encryption and decryption return table storing the encryption result to the volume encryption application component after obtaining and saving the encrypted data corresponding to each to-be-encrypted data block, so that the volume encryption application component writes the obtained encryption result to the disk.

[0166] Further, the application also discloses an electronic device, Figure 6 The electronic device 2 / 30 is shown in accordance with an exemplary embodiment, and the content in the figure should not be considered as any limitation on the use range of the application.

[0167] Figure 6 The electronic device 2 / 30 provided by the embodiment of the application is shown in a structural schematic diagram. The electronic device 2 / 30 can specifically include at least one processor 2 / 31, at least one memory 2 / 32, a power supply 2 / 33, a communication interface 2 / 34, an input / output interface 2 / 35, and a communication bus 2 / 36. The memory 2 / 32 is configured to store a computer program, and the processor 2 / 31 is configured to load and execute the computer program to implement the related steps in the disk data encryption and decryption method disclosed in any of the preceding embodiments. In addition, the electronic device 2 / 30 in the embodiment can be an electronic computer.

[0168] In the embodiment, the power supply 2 / 33 is configured to provide working voltage for each hardware device on the electronic device 2 / 30, the communication interface 2 / 34 is configured to create a data transmission channel between the electronic device 2 / 30 and external devices, and the communication protocol followed by the communication interface 2 / 34 can be any communication protocol applicable to the technical solution of the application, which is not limited here; the input / output interface 2 / 35 is configured to obtain external input data or output data to the outside, and the specific interface type can be selected according to the specific application needs, which is not limited here.

[0169] In addition, the memory 2 / 32 is a carrier for storing resources, which can be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc. The resources stored thereon can include an operating system 2 / 321, a computer program 2 / 322, etc. The storage mode can be temporary storage or permanent storage.

[0170] The operating system 2 / 321 is used for managing and controlling each hardware device on the electronic device 2 / 30 and the computer program 2 / 322, which can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program capable of completing the disk data encryption and decryption method executed by the electronic device 2 / 30 disclosed in any of the foregoing embodiments, the computer program 2 / 322 can further include a computer program capable of completing other specific work.

[0171] Further, the present application also discloses a computer readable storage medium for storing a computer program; wherein the computer program is executed by a processor to implement the foregoing disclosed disk data encryption and decryption method. For the specific steps of the method, refer to the corresponding content disclosed in the foregoing embodiments, which will not be described here.

[0172] The embodiments in the specification are described in a progressive manner, and each embodiment focuses on the difference from other embodiments. For the same or similar parts between the embodiments, refer to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and refer to the method part for the relevant part.

[0173] The skilled person can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of the two. In order to clearly show the interchangeability of hardware and software, the components and steps of the examples have been described in the above description. Whether the functions are realized by hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0174] The steps of the method or algorithm described in combination with the embodiments disclosed herein can be directly implemented by hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0175] Finally, it needs to be pointed out that in this document, relational terms such as first and second and the like can only be intended to distinguish one entity or operation from another entity or operation without necessarily requiring or implying any actual such relationship or order between such entities or operations. Moreover, the terms "comprising", "including", or any other variant thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element defined by the statement "comprising a" does not exclude the existence of additional identical elements in the process, method, article, or apparatus including the stated element.

[0176] The above detailed description of the technical solutions provided by the present application has been provided, and the principles and implementation modes of the present application have been described by applying specific examples. The above description of the examples is only for the purpose of helping to understand the method of the present application and its core idea; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range will be changed, and the above description of the content of the specification should not be understood as a limitation of the present application.

Claims

1. A magnetic disk data encryption and decryption method, characterized by, The method comprises the following steps: obtaining a first key based on virtual machine identification information through a virtualized computing node controller program, and sending the first key to a volume encryption application component by using a virtual encrypted volume constructed based on a created virtual machine image; encrypting a second key by using the first key through the volume encryption application component, and calling a preset function of a password management component by using the encrypted second key to trigger a creation process of an encryption and decryption thread handle pool corresponding to the virtual encrypted volume, so as to complete an initialization operation; when receiving encryption task information sent by the volume encryption application component through the password management component, determining a first target password computing resource linked list based on an encryption and decryption thread handle pool corresponding to the encryption task information, and performing data encryption by using a preset business management thread, a resource linked list scheduling rule, the first target password computing resource linked list and the encryption task information, so as to write an obtained encryption result to a disk through the volume encryption application component; when receiving decryption task information sent by the volume encryption application component through the password management component, determining a second target password computing resource linked list based on an encryption and decryption thread handle pool corresponding to the decryption task information, and performing data decryption by using the preset business management thread, the resource linked list scheduling rule, the second target password computing resource linked list and the decryption task information, so as to complete disk data reading by using an obtained decryption result through the volume encryption application component.

2. The magnetic disk data encryption and decryption method of claim 1, wherein, Before the step of obtaining a first key based on virtual machine identification information through a virtualized computing node controller program, the method further comprises the following steps: when starting an operating system of a host, checking a plurality of password computing resources pre-configured in a physical host to obtain corresponding checking results; if the checking results show that each of the password computing resources meets a preset condition, initializing a number of encryption and decryption threads and performance parameters corresponding to each of the password computing resources respectively to complete a corresponding first data initialization operation and obtain a first data initialization result.

3. The magnetic disk data encryption and decryption method of claim 2, wherein, The step of calling a preset function of a password management component by using the encrypted second key to trigger a creation process of an encryption and decryption thread handle pool corresponding to the virtual encrypted volume comprises the following steps: creating the encryption and decryption thread handle pool corresponding to the virtual encrypted volume based on the preset function and the encrypted second key through the password management component, and configuring a corresponding linked list for each of the password computing resources in the encryption and decryption thread handle pool; initializing a number of available encryption and decryption threads, a number of idle encryption and decryption threads and a total number of encryption and decryption threads corresponding to the plurality of password computing resources of each of the password computing resources in the encryption and decryption thread handle pool to complete a corresponding second data initialization operation and obtain a second data initialization result; judging whether a current loop identifier is greater than a preset loop threshold, and updating the loop identifier and triggering a corresponding encryption and decryption thread handle pool adding operation when the judgment result is not satisfied. After the adding operation of the encryption / decryption thread handle pool is completed, it is judged whether the preset encryption / decryption thread handle pool creation batch number is greater than the target encryption / decryption thread total number in the second data initialization result, to obtain a corresponding first judgment result; If the first judgment result indicates that it is greater, a corresponding scheduling strategy optimization operation is triggered based on a resource chain table scheduling rule; After the scheduling strategy optimization operation is completed, it is judged whether the current target encryption / decryption thread total number meets a preset quantity condition, and when it meets, it is re-jumped to the step of judging whether the current loop identifier is greater than a preset loop threshold, so as to complete the initialization operation.

4. The method of claim 1, wherein, The first target password calculation resource chain table is determined based on the encryption / decryption thread handle pool corresponding to the encryption task information, and data encryption is performed by using a preset business management thread, a resource chain table scheduling rule, the first target password calculation resource chain table, and the encryption task information, including: After receiving the encryption task information, the password management component sends a corresponding task processing notification to the preset business management thread of itself; The preset business management thread determines the number of to-be-encrypted data blocks based on the to-be-encrypted data block list in the encryption task information; The preset business management thread takes the first resource chain table in the encryption / decryption thread handle pool corresponding to the encryption task information as the first target password calculation resource chain table; The preset business management thread takes out a first number of chain table nodes from the first target password calculation resource chain table based on the current number of to-be-encrypted data blocks, a first target performance parameter corresponding to the first target password calculation resource chain table, and the number of idle encryption threads, and updates the number of idle encryption threads based on the first number, to obtain an updated number of idle encryption threads; The preset business management thread respectively encrypts each to-be-encrypted data block in the to-be-encrypted data block list by calling a preset password calculation resource interface based on the first number of chain table nodes, to obtain corresponding encrypted data. In the process of data encryption, the preset business management thread updates the current number of to-be-encrypted data blocks, and if the current number of to-be-encrypted data blocks is greater than zero and all password calculation resource chain tables in the encryption / decryption thread handle pool corresponding to the encryption task information are not in an available state, a corresponding encryption / decryption thread handle pool adding operation is triggered after a corresponding scheduling strategy optimization operation is completed based on a resource chain table scheduling rule, until an encryption result corresponding to the encryption task information is obtained.

5. The method of claim 1, wherein, The second target password calculation resource chain table is determined based on the encryption / decryption thread handle pool corresponding to the decryption task information, and data decryption is performed by using the preset business management thread, the resource chain table scheduling rule, the second target password calculation resource chain table, and the decryption task information, including: After receiving the decryption task information, the password management component sends a corresponding task processing notification to the preset business management thread of itself; determining, by the preset service management thread, a number of to-be-decrypted data blocks corresponding to the to-be-decrypted data block list in the decryption task information; determining, by the preset service management thread, a first resource linked list in a cipher computation resource linked list pool corresponding to the decryption task information as a second target cipher computation resource linked list; determining, by the preset service management thread, a second number of linked list nodes from the second target cipher computation resource linked list based on the current number of to-be-decrypted data blocks, a second target performance parameter corresponding to the second target cipher computation resource linked list, and a number of idle decryption threads, and updating the number of idle decryption threads based on the second number to obtain an updated number of idle decryption threads; decrypting, by the preset service management thread, each to-be-decrypted data block in the to-be-decrypted data block list based on the second number of linked list nodes, respectively, by calling a preset cipher computation resource interface, to obtain corresponding decrypted data by using a commercial cipher algorithm. In the process of data decryption, updating, by the preset service management thread, the current number of to-be-decrypted data blocks, and if the current number of to-be-decrypted data blocks is greater than zero and all cipher computation resource linked lists in the cipher thread handle pool corresponding to the decryption task information are not in an available state, triggering a corresponding cipher thread handle pool adding operation after completing a corresponding scheduling strategy optimization operation based on a resource linked list scheduling rule, until obtaining a decryption result corresponding to the decryption task information.

6. The method of claim 4, wherein, The triggering of the corresponding cipher thread handle pool adding operation after the completion of the corresponding scheduling strategy optimization operation based on the resource linked list scheduling rule comprises: sorting the cipher thread handle pools based on performance parameters corresponding to each cipher computation resource, and triggering a first target cipher computation resource linked list updating operation according to a sorting result obtained to obtain an updated first target cipher computation resource linked list; calculating a difference between a number of created encryption threads corresponding to the updated first target cipher computation resource linked list and an expected number of encryption threads corresponding to the encryption task information, and determining whether the difference obtained satisfies a first preset condition to obtain a second determination result; if the second determination result indicates that the first preset condition is not satisfied, determining a target parameter based on the difference and a preset task threshold corresponding to the updated first target cipher computation resource linked list; if the target parameter is not greater than zero, creating the target parameter number of cipher threads and linked list nodes, and for each created cipher thread, importing the encrypted second key into a corresponding cipher thread handle pool.

7. The method of claim 4, wherein the step of encrypting the data comprises the step of: The obtaining of the corresponding encrypted data further comprises: ​ if the current mode is an asynchronous mode, sending the encrypted data to the volume encryption application component based on a preset asynchronous processing callback function. If the current mode is synchronous, the encrypted data is saved to an encryption and decryption return table in the encryption task information, and after the encrypted data corresponding to each of the to-be-encrypted data blocks is obtained and saved, the encryption and decryption return table storing the encrypted result is sent to the volume encryption application component, so that the obtained encrypted result is written to the disk by the volume encryption application component.

8. A magnetic disk data encryption / decryption apparatus, characterized by comprising: The method comprises the steps of: a first key obtaining module, configured to obtain a first key based on virtual machine identification information by a virtualized computing node controller program, and send the first key to a volume encryption application component by using a virtual encrypted volume constructed based on a created virtual machine image; an initialization completion module, configured to encrypt and store a second key by the volume encryption application component using the first key, and call a preset function of a password management component by using the encrypted second key, so as to trigger a creation process of an encryption and decryption thread handle pool corresponding to the virtual encrypted volume, so as to complete an initialization operation; a data encryption module, configured to determine a first target password computing resource chain table based on an encryption and decryption thread handle pool corresponding to encryption task information when the encryption task information sent by the volume encryption application component is received by the password management component, and perform data encryption by using a preset business management thread, a resource chain table scheduling rule, the first target password computing resource chain table, and the encryption task information, so that the obtained encrypted result is written to the disk by the volume encryption application component; a data decryption module, configured to determine a second target password computing resource chain table based on an encryption and decryption thread handle pool corresponding to decryption task information when the decryption task information sent by the volume encryption application component is received by the password management component, and perform data decryption by using the preset business management thread, the resource chain table scheduling rule, the second target password computing resource chain table, and the decryption task information, so that the obtained decryption result is used to complete disk data reading by the volume encryption application component.

9. An electronic device, comprising: The method comprises the steps of: a memory, configured to save a computer program; a processor, configured to execute the computer program to implement the disk data encryption and decryption method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, A computer program is saved, and the computer program is executed by a processor to implement the disk data encryption and decryption method according to any one of claims 1 to 7.

Images