Disk creation method and related equipment thereof

Abstract

The invention discloses a disk creation method and related equipment, and the disk creation method can comprise the following steps: in response to a disk creation request, obtaining a disk identifier allocated by a distributed storage system to create a target disk; based on the disk identifier of the target disk, creating a storage space of a head extension object of the target disk in the distributed storage system; if the creation request carries the encryption parameter of the target disk, the encryption parameter of the target disk is stored in the storage space of the head extension object, and the encryption parameter is used for encrypting and decrypting data requested to be interacted in the target disk.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a disk creation method, device, electronic device, storage medium and computer program product. Background Art

[0002] The block storage device (RADOS Block Device, RBD) of distributed object storage is one of the commonly used storage types in the distributed storage system (full name in English: Ceph Distributed File System). It aggregates multiple hard disk pools into a larger logical volume to provide storage as a whole. When using RBD, the device data is stored in plain text, which poses the risk of data leakage and data tampering. Therefore, it is necessary to encrypt RBD, that is, to create RBD encrypted disks. However, when Ceph creates a large number of RBD encrypted disks, it will cause a large consumption of local file system resources and network bandwidth resources. Summary of the invention

[0003] The embodiment of the present application provides a disk creation method and related equipment to solve the problem in the prior art that when Ceph creates a large number of RBD encrypted disks, it will cause a large consumption of local file system resources and network bandwidth resources.

[0004] The present application embodiment adopts the following technical solutions: In a first aspect, the present application provides a disk creation method, comprising: In response to a disk creation request, obtaining a disk identifier assigned by the distributed storage system to create a target disk; Based on the disk identifier of the target disk, creating storage space for the header extension object of the target disk in the distributed storage system; If the creation request carries encryption parameters of the target disk, the encryption parameters of the target disk are stored in the storage space of the header extension object, and the encryption parameters are used to encrypt and decrypt the data requested to be interacted with in the target disk.

[0005] In a second aspect, the present application provides a disk creation device, comprising: An acquisition module, used for acquiring a disk identifier assigned by the distributed storage system to create a target disk in response to a disk creation request; A creation module, used for creating a storage space of a header extension object of the target disk in the distributed storage system based on the disk identifier of the target disk; The storage module is used to store the encryption parameters of the target disk in the storage space of the header extension object if the creation request carries the encryption parameters of the target disk, and the encryption parameters are used to encrypt and decrypt the data requested to be interacted in the target disk.

[0006] In a third aspect, the present application provides an electronic device, including: one or more processors; Memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by one or more processors, and the one or more programs are configured to execute the steps in the method described in the first aspect.

[0007] In a fourth aspect, the present application provides a computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps in the method described in the first aspect above are implemented.

[0008] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps in the method described in the first aspect above.

[0009] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects: In an embodiment of the present application, when there is a need to create a disk, the disk identifier assigned by the distributed storage system to create the target disk can be obtained in response to the disk creation request, and storage space for a header extension object for storing encryption parameters of the target disk can be created directly in the distributed storage system based on the disk identifier. In addition, when the creation request carries the encryption parameters of the target disk, the encryption parameters for encrypting and decrypting the data requested to interact in the target disk are stored in the storage space of the header extension object, thereby completing the creation of a target disk with encryption and decryption functions. In this process, there is no need to consume local file system resources to create a sparse file locally for writing encryption parameters, nor is there any need to consume network bandwidth resources to upload the sparse file to the distributed storage system, thereby effectively saving the resources required to create a disk with encryption and decryption functions. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 Provides a specific application scenario diagram of a disk creation method for related technologies; Figure 2 A schematic diagram of an application environment of the disk creation method provided in an embodiment of the present application; Figure 3 A schematic diagram of the implementation process of a disk creation method is provided for an embodiment of the present application; Figure 4 A schematic diagram of an RBD disk creation interface provided in an embodiment of the present application; Figure 5 An example diagram of a disk creation method provided in an embodiment of the present application being applied in an actual scenario; Figure 6 A specific structural schematic diagram of a disk creation device is provided for an embodiment of the present application; Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0011] In order to make those skilled in the art better understand the present application scheme, the technical scheme in the present application embodiment will be clearly and completely described below in conjunction with the drawings in the present application embodiment. Obviously, the described embodiment is only a part of the present application embodiment, rather than all the embodiments. The components of the present application embodiment usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the present application for protection, but merely represents the selected embodiment of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0012] The following is an explanation of the concepts of some nouns involved in this application: Ceph: Ceph is a unified distributed file system with good performance, high availability and scalability. Ceph is unified in that it can provide file systems, block storage and object storage, and distributed in that it can be dynamically expanded. The Ceph ecosystem architecture can be divided into four parts: clients that serve data users, metadata servers for caching and synchronizing distributed metadata, object storage clusters for performing other key functions as object storage for data and metadata, and cluster monitors for performing monitoring functions.

[0013] RADOS: The full name of RADOS is Reliable, Autonomic Distributed Object Store. It is one of the core of Ceph. As a sub-project of Ceph distributed file system, it is specially designed for the needs of Ceph. It can provide a stable, scalable, high-performance single logical object (Object) storage interface and a storage system that can realize node adaptation and self-management on dynamically changing and heterogeneous storage device clusters.

[0014] Block storage: refers to a controller that adds a group of disk drives to a RAID (Redundant Array of Independent Disks) set, and then provides a fixed-size RAID block as a LUN (Logical Unit Number) volume. Block storage mainly maps the entire raw disk space to the host for use. That is to say, for example, there are 5 hard disks in the disk array (for the convenience of explanation, assume that each hard disk is 1G), and then N logical hard disks can be logically divided through various methods such as logical disk, Raid, or LVM (Logical Volume). Then the block storage will use the mapping method to map these logical disks to the host. The operating system on the host will recognize that there are 5 hard disks, but the operating system cannot distinguish whether they are logical or physical. It thinks that they are just 5 raw physical hard disks. There is no difference from directly mounting a physical hard disk to the operating system, at least there is no difference in the perception of the operating system.

[0015] RBD: Ceph provides a block storage module, which is one of the commonly used storage types of Ceph. RBD block devices can be mounted similar to disks. RBD block devices have many features such as snapshots, multiple copies, and clones. Usually, RBD images, RBD volumes, and RBD disks all refer to the same entity and have the same semantics.

[0016] Ceph Raods object: Ceph's unit for storing data. A Raods object consists of three parts: data, omap, and xattr. The data part is used to store the data itself; Omap is a key-value storage structure that stores key-value structures; xattr has the same storage structure as omap, but the difference is that the number of key-value pairs stored in xattr is less than that in omap. Ceph provides operations such as creation, deletion, and modification of rados objects.

[0017] Omap: Omap is a component of Ceph Rados objects. It is a key-value database that provides a key-value storage interface to the outside world. It can be used to save certain attributes and attribute values ​​associated with the object. For example, for the student object, there can be a name attribute, which can be stored as <name, Zhang San>. Usually, the student object is determined by the student ID, and then the student's name is found.

[0018] LUKS: An encrypted disk format that can encrypt file systems and block devices. The encryption key, encryption algorithm, and encryption type are stored in the header of the encrypted volume.

[0019] RAW format: A sparse file format with performance close to that of a real disk. Disk space is actually occupied only in sectors where data is written. This disk format contains two sizes: virtual size and real disk file size.

[0020] I / O: The abbreviation of Input / Output refers to the input and output in the field of data storage, which corresponds to the writing and reading operations of data to the storage medium respectively.

[0021] Sparse file: A computer file that attempts to use the file system's space more efficiently when the file's contents are mostly empty. It works by representing empty data blocks with short information (metadata) instead of taking up actual space on the disk to store them. Only real (non-empty) data blocks are written to the disk as is.

[0022] As described in the background technology, in the related art, if you want to create an RBD encrypted disk in Ceph, you need to use the local file system to create a sparse file, then write the encryption parameters of the RBD encrypted disk to be created into the sparse file, and use network bandwidth resources to upload the sparse file in the local file system to the RBD of Ceph, so as to complete the creation of the RBD encrypted disk in Ceph. In this process, it is inevitable that resources in the local file system will be wasted, and additional network bandwidth resources need to be consumed to upload sparse files.

[0023] For example, Figure 1 As shown, in the related technology, if the client wants to create an RBD encrypted disk in Ceph, the client needs to send an RBD encrypted disk creation request to the local file system, and the local file system parses the request to obtain the encryption parameters of the RBD encrypted disk (including encryption mode, encryption algorithm and encryption key). The local file system then uses local resources to create a disk file, such as a sparse file, in RAW format, and uses LUKS to format the file header of the sparse file. Then the encryption parameters are written to the specified location of the sparse file through the LUKS specification, and finally the local file system uses network resources to transfer the sparse file to the RBD disk in a pool in Ceph, thereby completing the creation of the RBD disk.

[0024] During this process, on the one hand, the client needs to consume the resources of the local file system to create a sparse file, and the sparse file is a temporary file. Once a system failure (such as a crash) occurs in the local file system during the creation process, the created sparse file and the encryption parameters added therein will be lost, and the client will need to re-enter the encryption parameters to the local file system. On the other hand, after the local file system completes the creation of the sparse file and writes the encryption parameters to the sparse file, it also needs to transmit the sparse file to Ceph through the network. This process will cause the consumption of network bandwidth resources. Moreover, if the number of sparse files is large or the capacity of the RBD encrypted disk to be created is large, resulting in a large sparse file, it will also cause a large consumption of network bandwidth resources, and even cause network congestion and other situations.

[0025] In view of this, an embodiment of the present application aims to provide a disk creation method, which can respond to the creation request of the disk when there is a need to create an encrypted disk, obtain the disk identifier assigned by the distributed storage system to create a target disk, and can directly create a storage space for a header extension object for storing encryption parameters of the target disk based on the disk identifier in the distributed storage system, and when the creation request carries the encryption parameters of the target disk, the encryption parameters for encrypting and decrypting the data requested to interact in the target disk are stored in the storage space of the header extension object, thereby completing the creation of a target disk with encryption and decryption functions. In this process, there is no need to consume local file system resources to create a sparse file locally for writing encryption parameters, and there is no need to consume network bandwidth resources to upload the sparse file to the distributed storage system, thereby effectively saving the resources required to create a disk with encryption and decryption functions.

[0026] In order to better understand a disk creation method and related equipment provided by an embodiment of the present application, the application environment applicable to the embodiment of the present application is first described below.

[0027] See also Figure 2 , Figure 2 The following is a schematic diagram showing an application environment of the disk creation method provided by an embodiment of the present application. For example, the disk creation method, disk creation device, electronic device, storage medium and computer program product provided by the embodiment of the present application can be applied to electronic devices, wherein the electronic device can be, for example, Figure 2 The server 210 shown in the figure can be linked to the terminal device 220 through a network. The network is used to provide a medium for a communication link between the server 210 and the terminal device 220. The network can include various connection types, such as wired communication links, wireless communication links, etc., which are not limited in the embodiments of the present application. Optionally, in other embodiments, the electronic device can also be a smart phone, a laptop computer, etc.

[0028] It should be understood that Figure 2 The server 210, network and terminal device 220 are merely illustrative. Depending on the implementation requirements, there may be any number of servers, networks and terminal devices. For example, the server 210 may be a physical server or a server cluster consisting of multiple servers. Among them, the terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices may be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. It is understandable that the embodiments of the present application may also allow multiple terminal devices 220 to access the server 210 at the same time.

[0029] In some embodiments, the user may send an RBD creation request to the server 210 through the terminal device 220 to create an RBD encrypted disk. In other embodiments, the user may also send an RBD creation request to the server 210 through a client installed in the terminal device 220. The server 210 is deployed with a Ceph system, which can respond to the RBD creation request, parse the encryption parameters and target location in the RBD creation request, and create a target RBD encrypted disk at the target location in the Ceph system based on the encryption parameters.

[0030] The above application environment is only an example for the convenience of understanding. It can be understood that the embodiments of the present application are not limited to the above application environment.

[0031] It should be understood that the disk creation method proposed in the embodiments of the present application can be executed by an electronic device or software installed in the electronic device. The electronic device referred to here may include a terminal device, such as a smart phone, a tablet computer, a laptop computer, a desktop computer, an intelligent voice interaction device, a smart home appliance, a smart watch, a vehicle terminal, an aircraft, etc.; or, the electronic device may also include a server, such as an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0032] The disk creation method and related equipment provided in the embodiments of the present application will be described in detail below through specific examples.

[0033] See also Figure 3 , which shows a schematic diagram of the process of creating a disk provided by an embodiment of the present application. Figure 3 The process shown in the figure is described in detail, and the disk creation method may include the following steps: Step 310: In response to the disk creation request, obtain a disk identifier allocated by the distributed storage system to create a target disk.

[0034] Optionally, the disk creation request may be triggered by a user through a client for creating a disk installed on a terminal device. As an example, Figure 4 This is a schematic diagram of the RBD disk creation interface provided in the embodiment of the present application. The user can open the client for creating the RBD disk on the terminal device, and the client can provide the user with a visual interface for creating the RBD disk. Figure 4 As shown in the figure, the visualization interface of the RBD disk may include configurable parameters such as encryption parameters, disk name, disk capacity, and creation location. Users can enter encryption parameters (encryption mode is ECB, encryption algorithm is Twofish, encryption key is 26982*@xx), disk name (disk name is xxx disk), disk capacity (disk capacity is 1tb), and creation location (creation location is pool2) in the visualization interface according to their needs, and click the Submit button to trigger the client to send an RBD creation request carrying these parameter information to the Ceph system.

[0035] As an example, after receiving the creation request, the creation request can be parsed to obtain the encryption parameters and creation location of the disk to be created (i.e., the target disk) carried in the creation request. The creation location is used to indicate in which resource pool in the distributed storage system the disk to be created needs to be created. Optionally, the location of the target disk can also be empty to indicate that the distributed storage system creates the target disk in a default location in the distributed storage system, which can be a resource pool (pool) pre-set in the distributed storage system for creating RBDs.

[0036] The disk identifier assigned by the distributed storage system to create the target disk can be specifically generated by the distributed storage system based on the creation request and in accordance with the disk ID number generation rule to uniquely identify the target disk. Taking the target disk as an RBD disk as an example, when there is a demand to create an RBD disk, the distributed storage system will automatically generate a unique identifier for the RBD disk in accordance with the RBD disk ID number generation rule, and the unique identifier can be used as the disk identifier of the RBD disk.

[0037] Step 320: Create storage space for the header extension object of the target disk in the distributed storage system based on the disk identifier of the target disk.

[0038] In order to convert an ordinary disk into an encrypted disk, the embodiment of the present application expands on the basis of the header object of the original disk used to store basic disk information, and obtains a header extension object for providing encryption and decryption capabilities for the disk. To achieve this encryption and decryption capability, the embodiment of the present application can create storage space for the header extension object of the target disk based on the disk identifier of the target disk at the creation location of the target disk. For example, taking the target disk as an RBD disk, assuming that the RBD disk is created in the first resource pool of the distributed storage system, then based on the disk identifier of the RBD disk, a storage space for the header extension object of the RBD disk can be created in the first resource pool for storing the encryption parameters of the RBD disk.

[0039] As an example, the naming convention of the header extension object of the target disk is: rbd_header.<rbd_image_id> .extension, where rbd_header. is its prefix name and .extension is its suffix name. The prefix name and suffix name are fixed names. rbd_image_id is the disk ID of the target disk, which is the only variable in the naming rule.

[0040] Since the distributed storage system can provide an interface for creating Ceph Rados objects and supports operations such as creation, deletion, and modification of Ceph Rados objects, and the header extension object of the target disk is essentially a Ceph Rados object, based on this, the embodiment of the present application can use the name of the header extension object of the target disk as a parameter value and pass it into the creation interface of the Ceph Rados object in the distributed storage system to complete the creation of the storage space of the header extension object of the target disk.

[0041] As an example, assuming that the disk identifier rbd_image_id assigned to the disk to be created (i.e., the target disk) is 2aa527557a42, according to the above header extension object naming rules, the name of the header extension object of the disk to be created (i.e., the target disk) is: rbd_header.2aa527557a42.extension. By passing rbd_header.2aa527557a42.extension as the parameter value of the header extension object name of the disk to be created (i.e., the target disk) to the creation interface of the Ceph Rados object in the distributed storage system, a Ceph Rados object can be created as the storage space of the header extension object of the target disk.

[0042] During the implementation of the disk creation method provided in the embodiment of the present application, it is only necessary to create a storage space for the header extension object of the target disk in the distributed storage system based on the disk identifier of the target disk; and the encryption parameters of the target disk are stored in the storage space of the header extension object of the target disk to complete the creation of an encrypted disk with encryption and decryption functions, without the need for the client to rely on the local file system to create intermediate temporary files, which effectively solves the problem of excessive pressure and waste of local file system space caused by the need to create large-capacity temporary files when creating large-capacity RDB encrypted disks. In addition, there is no need to upload intermediate temporary files to the RBD disk through network bandwidth resources, so the network transmission time can be greatly reduced, effectively solving the problem of too long overall creation time for creating large-capacity RBD encrypted disks.

[0043] Step 330: If the creation request carries encryption parameters of the target disk, the encryption parameters of the target disk are stored in the storage space of the header extension object. The encryption parameters are used to encrypt and decrypt the requested interactive data in the target disk.

[0044] As an example, encryption parameters may include: encryption algorithm name (cipher-name), encryption mode (cipher-mode) and encryption key (password). The encryption algorithm name cipher-name value can be set to aes or aes-256, the encryption key password value is specified by the user, and the encryption mode cipher-mode value can be set to aes-xts-plain64, ecb or cbc-plain.

[0045] In some exemplary embodiments, a client for creating a disk may establish a data communication connection with the distributed storage system through an API interface provided in a librbd library of the distributed storage system.

[0046] In some embodiments, the disk creation request may carry encryption parameters and a target location of the disk to be created. The encryption parameters of the disk to be created may include at least one of an encryption mode parameter, an encryption algorithm parameter, and an encryption key parameter. The target location is used to indicate which resource pool (i.e., the sequence number of the pool) the disk to be created is in in the distributed storage system.

[0047] In some exemplary embodiments, the encryption mode may include: ECB mode, CBC mode, CFB mode, OFB mode, XTS mode, etc. The encryption mode parameters may include specific parameters corresponding to the ECB mode, CBC mode, CFB mode, OFB mode, and XTS mode. As an example, the encryption mode parameters may include parameters corresponding to ECB, cbc-plain, cbc-essiv:hash, xts-plain64, etc.

[0048] Among them, the ECB mode is also called the Electronic Codebook mode. Its full English name is Electronic Codebook. ECB is the simplest block cipher encryption mode. Before encryption, it will be divided into several blocks according to the encryption block size (such as 128 bits for AES), and then each block will be encrypted / decrypted separately using the same key.

[0049] CBC mode is also known as Cipher-block chaining: In CBC mode, each cipher block to be encrypted is first XORed with the ciphertext of the previous cipher block before encryption and then encrypted with the encryptor. The first plaintext block is XORed with a data block called the initialization vector.

[0050] CFB mode is also known as Cipher feedback mode: Unlike ECB and CBC modes that can only encrypt block data, CFB can convert block ciphertext into stream ciphertext. The encryption work of CFB is divided into two parts: 1. Encrypt the ciphertext obtained from the previous segment; 2. XOR the data encrypted in the first step with the plaintext of the current segment.

[0051] OFB mode is also known as output feedback mode: OFB is to first use a block cipher to generate a key stream, and then XOR the key stream with the plaintext stream to obtain a ciphertext stream. Decryption is to first use a block cipher to generate a key stream, and then XOR the key stream with the ciphertext stream to obtain plaintext. Due to the symmetry of the XOR operation, the encryption and decryption processes are exactly the same.

[0052] XTS mode is an encryption mode for encrypted block devices. Its full name is "XEX-based TweakedCodeBook mode with ciphertext stealing". XTS mode is based on XEX (XOR-Encrypt-XOR) mode and is used to provide security protection for data storage, especially in disk encryption and other forms of sector-level encryption.

[0053] For each encryption mode, a different encryption algorithm may be set. As an example, the encryption algorithm in the embodiment of the present application may include: AES algorithm, Twofish algorithm, CAST algorithm, etc.

[0054] Among them, the AES algorithm is a symmetric key encryption algorithm that uses a 128, 192 or 256-bit key to encrypt data. The encryption process of the AES algorithm includes operations such as round key addition, byte substitution, row shift and column confusion.

[0055] The Twofish algorithm is also called the Pisces algorithm. It has three key lengths of 128, 192, and 256 bits to choose from, and a block size of 128 bits. The iconic feature of the Twofish algorithm is that it uses a key-related substitution box (S box). Half of the key input bits are used to organize the "real" encryption process and used as Feistel's round key, while the other half are used to modify the S box used by the algorithm.

[0056] The CAST algorithm includes CAST5 (also known as CAST-128) and CAST6 (also known as CAST-256). CAST5 is a permutation combination network (SPN) encryption system similar to DES, while CAST6 is proposed as a candidate algorithm for AES. CAST5 is a 12- or 16-cycle Feistel cipher with a block length of 64 bits and a variable key length that increases by 8 bits from 40 bits to 128 bits, and 16 cycles are allowed only when the key length is greater than 80 bits. CAST6 is a 48-cycle Feistel cipher with a block length of 128 bits and a variable key length that increases by 32 bits from 128 bits to 256 bits.

[0057] The encryption key parameter may specifically be an encryption key set by the user for a specified encryption mode and encryption algorithm. The created RBD encrypted disk may encrypt data written to the RBD encrypted disk using the encryption mode, encryption algorithm, and encryption key specified by the user, and correspondingly, may also decrypt data read from the RBD encrypted disk using the encryption mode, encryption algorithm, and encryption key specified by the user.

[0058] In some exemplary embodiments, in order to improve the reading efficiency of the encryption parameters of the target disk, the embodiments of the present application can store the encryption parameters of the target disk in the storage space of the header extension object in the format of key-value pairs. Specifically, if the creation request carries the encryption parameters of the target disk, the encryption parameters of the target disk are stored in the storage space of the header extension object, including: If the creation request carries encryption parameters of the target disk, the encryption parameters of the target disk are stored in the storage space of the header extension object in the format of key-value pairs.

[0059] In some exemplary embodiments, the encryption parameters include at least one of an encryption algorithm parameter, an encryption mode parameter, and a user password. When the encryption parameters include the encryption algorithm parameter or the encryption mode parameter, the encryption parameters of the target disk are stored in a storage space of a header extension object in a key-value pair format, including: Determine a target key name corresponding to the encryption parameter of the target disk, and use the value of the encryption parameter of the target disk as the key value corresponding to the target key name; The target key name and the key value corresponding to the target key name are stored as a key-value pair in the storage space of the header extension object; When the encryption parameters include a user password, since there is a certain security risk in directly storing the user password, the embodiment of the present application can process the user password accordingly. Specifically, the encryption parameters of the target disk are stored in the storage space of the header extension object in the format of a key-value pair, including: Convert user passwords into encryption keys used to encrypt and decrypt data; Determine a target key name corresponding to the encryption key, and use the encryption key as a key value corresponding to the target key name; The target key name and the key value corresponding to the target key name are stored as a key-value pair in the storage space of the header extension object.

[0060] Among them, the storage space of the header extension object is a persistent storage space. As an example, the storage space corresponding to the header extension object can be the Omap storage space of the distributed storage system. The Omap storage space is an objectmap object mapping, which stores metadata in an independent Key-value storage system outside the distributed storage system. The Rados object mechanism of the distributed storage system can provide Omap storage space for each Ceph Rados object, and the header extension object, as a Ceph Rados object, also has a corresponding Omap storage space. The Omap storage space is a Key-value database, presented in key-value form.

[0061] As an example, for encryption algorithm parameters, the encryption algorithm name can be saved in the storage space of the header extension object. Specifically, when the encryption algorithm is the AES algorithm, the encryption algorithm parameter storage method can be as follows:<CIPHER_NAME, aes> , save the key-value tuple to the storage space of the header extension object. When the encryption algorithm parameters need to be read, the Rados object Omap read interface provided by the distributed storage system can be used, and CIPHER_NAME can be input as the key to index the value corresponding to the key CIPHER_NAME. In the embodiment of the present application, the encryption algorithm corresponding to the key CIPHER_NAME is aes.

[0062] As an example, for the encryption mode parameter, the encryption mode parameter can be saved in the storage space of the header extension object. Specifically, when the encryption mode parameter is aes-xts-plain64, the encryption mode parameter storage method can be as follows:<CIPHER_MODE, aes-xts-plain64> , save the key-value tuple to the storage space of the header extension object. When the encryption mode parameter needs to be written, the Omap write interface of the Rados object provided by the distributed storage system can be used to store the key = CIPHER_MODE and the value = aes-xts-plain64 in the storage space of the header extension object. When the encryption mode parameter needs to be read, the Omap read interface of the Rados object provided by the distributed storage system can be used, and CIPHER_MODE can be used as the key to index the corresponding value of aes-xts-plain64.

[0063] As an example, for the encryption key parameter password, the plain text of the encryption key parameter password can be converted into the encryption key key_master required for encrypting and decrypting data through the algorithm defined and implemented by the existing LUKS specification. The key is a necessary parameter for the encryption and decryption process. It should be understood that in order to avoid the leakage of the encryption key, the embodiment of the present application does not save the plain text of the encryption key parameter password. The encryption key storage method can be as follows:<KEY_MASTER,key_master> , save the key-value tuple to the storage space of the header extension object.

[0064] In some exemplary embodiments, in order to improve the data reading and writing efficiency of the created target disk, the embodiment of the present application adds an encryption flag bit in the header object of the target disk to indicate whether the target disk is an encrypted disk. Specifically, the method further includes: If the creation request carries encryption parameters of the target disk, the value of the encryption flag of the target disk is assigned to a first value, and the first value is used to indicate that the target disk is an encrypted disk.

[0065] Among them, in addition to the encryption flag, the header object of the target disk also stores basic disk information such as the disk name, disk capacity, and disk creation time.

[0066] In some exemplary embodiments, the value of the encryption flag may include two types: a first value (for example, it may be True) and a second value (for example, it may be False). When the value of the encryption flag is the first value, the encryption flag is used to indicate that the corresponding target disk is an encrypted disk; when the value of the encryption flag is the second value, the encryption flag is used to indicate that the corresponding target disk is a non-encrypted disk.

[0067] Specifically, when it is determined that the creation request carries encryption parameters of the disk to be created (i.e., the target disk), the value of the encryption flag of the disk to be created can be determined to be a first value, and in the header object of the created target disk, the parameters of the encryption flag and the value of the encryption flag are added as the first value.

[0068] In some embodiments, the disk creation request can also be used to request the creation of a non-encrypted RBD disk. In this case, the disk creation request does not include encryption parameters. When it is determined that the creation request does not carry encryption parameters for the disk to be created, the value of the encryption flag of the disk to be created can be determined to be a second value, which is used to indicate that the disk to be created is a non-encrypted disk, and the parameters of the encryption flag and the value of the encryption flag are added to the header object of the target disk.

[0069] As an example, taking the target disk as an RBD disk, the embodiment of the present application can add an encryption disk flag based on the existing properties of the RBD disk. The parameter can be represented as: enable_encrypt, and the value type is Boolean. When encryption parameters such as encryption mode, encryption algorithm, and encryption key are passed into the command line or interface for creating the RBD disk, the value of the encryption flag enable_encrypt parameter can be set to the first value. For the created non-encrypted RBD disk, the command line or interface in this scenario does not contain encryption parameters such as encryption mode, encryption algorithm, and encryption key. At this time, the value of the encryption flag enable_encrypt parameter can be set to the second value.

[0070] Continuing to take the target disk as an RBD disk as an example, the role of the encryption flag enable_encrypt can be reflected in the I / O read and write data scenario of the created RBD disk. Specifically, before performing read and write data operations on the RBD disk, you can first read the value of this encryption flag enable_encrypt. If the value of the encryption flag enable_encrypt is True, it means that the RBD disk has encryption enabled and is an RBD encrypted disk. Then, it is necessary to further read encryption parameters such as encryption mode, encryption algorithm, and encryption key for subsequent encryption and decryption of the RBD disk's I / O data. If the value of the encryption flag enable_encrypt is False, it means that the RBD disk is not encrypted and is a non-encrypted RBD disk. Then, there is no need to perform data encryption and decryption operations. The data I / O process of the RBD disk is the original, non-encrypted I / O process.

[0071] In summary, the embodiment of the present application adds the encryption flag enable_encrypt to the header object of the disk, so that it can determine whether the disk is an encrypted disk at one time in subsequent I / O read and write data scenarios, avoiding the need to determine whether the disk is an encrypted disk when reading and writing data, thereby avoiding unnecessary data encryption and decryption operations, thereby reducing the waste of CPU resources and I / O bandwidth, and effectively improving data reading and writing efficiency.

[0072] Optionally, the creation request may also carry the name and capacity of the disk to be created.

[0073] Figure 5 This is an example diagram of a disk creation method provided in an embodiment of the present application being applied in an actual scenario. Figure 5 In the Ceph client, the user can enter encryption parameters to trigger the generation of an RBD disk creation request. The client sends the request to the Ceph system through the network. The Ceph system parses the request and obtains the creation location and encryption parameters for indicating the resource pool (pool). First, the RBD disk is created in the indicated resource pool (pool2) and the disk identifier of the RBD disk is obtained. Then, based on the disk identifier, the storage space of the header extension object of the RBD disk is created in the indicated resource pool (pool2), and the encryption parameters are passed into the storage space of the created header extension object. Each RBD disk has an encryption flag to indicate whether the corresponding RBD disk is an RBD encrypted disk.

[0074] In some exemplary embodiments, after the target disk is created, when there is a need to write data to the target disk, and when the target disk is determined to be an encrypted disk, the encryption parameters stored in the storage space of the header extension object of the target disk can be used to perform encryption operations on the data to be written. Specifically, the method provided in the embodiment of the present application also includes: receiving a request for writing data to a target disk; If it is determined that the target disk is an encrypted disk, encrypt the data to be written carried by the data write request based on the encryption parameters stored in the storage space of the header extension object of the target disk; In response to the data writing request, the data to be written encrypted based on the encryption parameters is written to the target disk.

[0075] It can be seen that when there is a need to write data to the target disk, only the data to be written can be encrypted without affecting other existing data in the target disk, thereby enabling more convenient data encryption operations.

[0076] In some exemplary embodiments, after the target disk is created, when there is a need to read part of the data from the target disk, and when the target disk is determined to be an encrypted disk, the encryption parameters stored in the storage space of the header extension object of the target disk can be used to perform a decryption operation on the part of the data to be read in the target disk. The method provided in the embodiment of the present application also includes: receiving a request for reading data from a target disk; If it is determined that the target disk is an encrypted disk, decrypting the to-be-read data of the data read request in the target disk based on the encryption parameters stored in the storage space of the header extension object of the target disk; In response to the data read request, the to-be-read data decrypted based on the encryption parameters is returned.

[0077] It can be seen that when there is a need to read data from the target disk, only the data to be read can be decrypted without affecting other existing data in the target disk, thereby enabling more convenient data decryption and data reading operations.

[0078] Among them, whether the target disk is an encrypted disk can be determined by obtaining the value of the encryption flag of the target disk. If the value of the encryption flag of the target disk is a first value, it indicates that the target disk is an encrypted disk, and if the value of the encryption flag of the target disk is a second value, it indicates that the target disk is a non-encrypted disk. In the case that the target disk is a non-encrypted disk, data encryption or decryption operations are not required when reading data from the target disk or writing data to the target disk.

[0079] In some exemplary embodiments, if the disk identifier of the target disk is provided, the name of the header extension object of the target disk can be obtained according to the preset header extension object naming rules, and then the header extension object of the target disk and its content can be retrieved through the Raods object reading interface provided by the distributed storage system. It can be seen that the header extension object can provide the encryption parameters required in the encryption and decryption process of the I / O data of the target disk without destroying other existing parameters of the target disk. Specifically, the method of obtaining the encryption parameters stored in the storage space of the header extension object of the target disk includes: Determine the disk ID of the target disk; Determine the storage space of the header extension object of the target disk based on the disk identifier of the target disk; The encryption parameters of the target disk are obtained from the storage space of the header extension object of the target disk.

[0080] For example, the target disk has been created. When I / O data is performed on it, the encryption algorithm name is needed to encrypt and decrypt the data. Obtaining the encryption algorithm name may include the following steps: Step a, based on the disk identifier of the target disk, retrieve the storage space of its header extension object; Step b: In the storage space of the header extension object of the target disk, the corresponding value can be retrieved by using CIPHER_NAME as a key, that is, the encryption algorithm name is aes, as an encryption algorithm parameter.

[0081] For example, the target disk has been created. When I / O data is performed on the target disk, encryption mode parameters are required for data encryption and decryption. Obtaining the encryption mode parameters may include the following steps: Step c, based on the disk identifier of the target disk, retrieving the storage space of its header extension object; Step d, in the storage space of the header extension object of the target disk, use CIPHER_MODE as the key to retrieve the corresponding value in Omap, that is, the encryption algorithm name is aes-xts-plain64, as the encryption mode parameter.

[0082] For example, after the target disk has been created, when I / O data is performed on the target disk, encryption key parameters are required for data encryption and decryption. Obtaining the encryption key parameters may include the following steps: Step e, based on the disk identifier of the target disk, retrieving the storage space of its header extension object; Step f, in the storage space of the header extension object of the target disk, use KSY_MASTER as the key to retrieve the corresponding value in Omap, which is the encryption key.

[0083] The disk creation method provided by one or more embodiments of the present application can, when there is a need to create an encrypted disk, obtain the disk identifier assigned by the distributed storage system to create the target disk in response to the disk creation request, and can directly create a storage space for a header extension object for storing encryption parameters of the target disk based on the disk identifier in the distributed storage system, and when the creation request carries the encryption parameters of the target disk, the encryption parameters for encrypting and decrypting the data requested to interact in the target disk are stored in the storage space of the header extension object, thereby completing the creation of the target disk with encryption and decryption functions. In this process, there is no need to consume local file system resources to create a sparse file locally for writing encryption parameters, and there is no need to consume network bandwidth resources to upload the sparse file to the distributed storage system, thereby effectively saving the resources required to create a disk with encryption and decryption functions.

[0084] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0085] In addition, Figure 3 Corresponding to the disk creation method shown, the present application embodiment also provides a disk creation device. Figure 6 , is a schematic diagram of a disk creation device 600 provided in one embodiment of the present application, and the device 600 may include: The acquisition module 610 is used to obtain the disk identifier allocated by the distributed storage system to create a target disk in response to a disk creation request; A creation module 620, configured to create a storage space for a header extension object of the target disk in the distributed storage system based on the disk identifier of the target disk; The storage module 630 is used to store the encryption parameters of the target disk in the storage space of the header extension object if the creation request carries the encryption parameters of the target disk, and the encryption parameters are used to encrypt and decrypt the data requested to be interacted with in the target disk.

[0086] In some exemplary embodiments, the apparatus further comprises an assignment module, configured to: If the creation request carries the encryption parameter of the target disk, the value of the encryption flag of the target disk is assigned to a first value, where the first value is used to indicate that the target disk is an encrypted disk.

[0087] In some exemplary embodiments, if the creation request carries the encryption parameters of the target disk, the storage module 630 stores the encryption parameters of the target disk in the storage space of the header extension object, specifically for: If the creation request carries the encryption parameters of the target disk, the encryption parameters of the target disk are stored in the storage space of the header extension object in a key-value pair format.

[0088] In some exemplary embodiments, the encryption parameter includes at least one of an encryption algorithm parameter, an encryption mode parameter, and a user password. When the encryption parameter includes an encryption algorithm parameter or an encryption mode parameter, the storage module 630 stores the encryption parameter of the target disk in the storage space of the header extension object in a key-value pair format, specifically for: Determine a target key name corresponding to the encryption parameter of the target disk, and use the value of the encryption parameter of the target disk as the key value corresponding to the target key name; The target key name and the key value corresponding to the target key name are stored as a key-value pair in the storage space of the header extension object; When the encryption parameter includes a user password, the storage module 630 stores the encryption parameter of the target disk in the storage space of the header extension object in the format of a key-value pair, specifically for: Converting the user password into an encryption key for encrypting and decrypting data; Determine a target key name corresponding to the encryption key, and use the encryption key as a key value corresponding to the target key name; The target key name and the key value corresponding to the target key name are taken as a key-value pair and stored in the storage space of the header extension object.

[0089] In some exemplary embodiments, the apparatus further comprises: A first receiving module, used for receiving a data writing request to a target disk; an encryption module, configured to encrypt the data to be written carried by the data write request based on the encryption parameters stored in the storage space of the header extension object of the target disk if it is determined that the target disk is an encryption disk; A writing module is used to write the to-be-written data encrypted based on the encryption parameters to the target disk in response to the data writing request.

[0090] In some exemplary embodiments, the apparatus further comprises: A second receiving module, used for receiving a data reading request for the target disk; a decryption module, configured to decrypt the data to be read of the data read request in the target disk based on the encryption parameters stored in the storage space of the header extension object of the target disk if it is determined that the target disk is an encrypted disk; The returning module is used to return the to-be-read data decrypted based on the encryption parameters in response to the data reading request.

[0091] In some exemplary embodiments, the device further includes a parameter acquisition module, and the parameter acquisition module is specifically used to: Determine the disk identifier of the target disk; Based on the disk identifier of the target disk, determining the storage space of the header extension object of the target disk; The encryption parameters of the target disk are obtained from the storage space of the header extension object of the target disk.

[0092] The disk creation device provided by one or more embodiments of the present application can, when there is a need to create an RBD encrypted disk, respond to the disk creation request and obtain the disk identifier assigned by the distributed storage system to create the target disk. Moreover, based on the disk identifier, storage space for a header extension object for storing encryption parameters of the target disk can be directly created in the distributed storage system. Moreover, when the creation request carries the encryption parameters of the target disk, the encryption parameters for encrypting and decrypting the data requested to be interacted with in the target disk are stored in the storage space of the header extension object, thereby completing the creation of the target disk with encryption and decryption functions. In this process, there is no need to consume local file system resources to create a sparse file locally for writing encryption parameters, nor is there any need to consume network bandwidth resources to upload the sparse file to the distributed storage system, thereby effectively saving the resources required to create a disk with encryption and decryption functions.

[0093] Obviously, the disk creation device of the embodiment of the present application can be used as the above Figure 3 The execution body of the disk creation method shown in FIG. Figure 3 The functions realized are as follows. Since the principles are the same, they will not be described here.

[0094] Figure 7 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. Figure 7 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0095] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0096] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0097] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a disk creation device at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations: In response to a disk creation request, obtaining a disk identifier assigned by the distributed storage system to create a target disk; Based on the disk identifier of the target disk, creating storage space for the header extension object of the target disk in the distributed storage system; If the creation request carries encryption parameters of the target disk, the encryption parameters of the target disk are stored in the storage space of the header extension object, and the encryption parameters are used to encrypt and decrypt the data requested to be interacted with in the target disk.

[0098] The above application Figure 3The method performed by the disk creation device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in a decoding processor. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0099] The electronic device may also perform Figure 3 The method and the page embedding device are implemented in Figure 3 The functions of the embodiments shown in the examples are not described in detail in the embodiments of the present application. Of course, in addition to the software implementation, the electronic device of the present application does not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices. The information in the memory is combined with its hardware to complete the steps of the above method.

[0100] The embodiment of the present application also provides a computer-readable storage medium, which stores one or more programs, wherein the one or more programs include instructions, which, when executed by a portable electronic device including a plurality of application programs, enable the portable electronic device to execute Figure 3 The method of the embodiment shown is specifically used to perform the following operations: In response to a disk creation request, obtaining a disk identifier assigned by the distributed storage system to create a target disk; Based on the disk identifier of the target disk, creating storage space for the header extension object of the target disk in the distributed storage system; If the creation request carries encryption parameters of the target disk, the encryption parameters of the target disk are stored in the storage space of the header extension object, and the encryption parameters are used to encrypt and decrypt the data requested to be interacted with in the target disk.

[0101] In short, the above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0102] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0103] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0104] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0105] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A disk creation method, characterized in that: include: In response to a disk creation request, obtaining a disk identifier assigned by the distributed storage system to create a target disk; Based on the disk identifier of the target disk, creating storage space for the header extension object of the target disk in the distributed storage system; If the creation request carries encryption parameters of the target disk, the encryption parameters of the target disk are stored in the storage space of the header extension object, and the encryption parameters are used to encrypt and decrypt the data requested to be interacted with in the target disk.

2. The method according to claim 1, characterized in that The method further comprises: If the creation request carries the encryption parameter of the target disk, the value of the encryption flag of the target disk is assigned to a first value, where the first value is used to indicate that the target disk is an encrypted disk.

3. The method according to claim 1, characterized in that If the creation request carries the encryption parameters of the target disk, storing the encryption parameters of the target disk in the storage space of the header extension object includes: If the creation request carries the encryption parameters of the target disk, the encryption parameters of the target disk are stored in the storage space of the header extension object in a key-value pair format.

4. The method according to claim 3, characterized in that The encryption parameter includes at least one of an encryption algorithm parameter, an encryption mode parameter, and a user password. When the encryption parameter includes an encryption algorithm parameter or an encryption mode parameter, storing the encryption parameter of the target disk in a storage space of the header extension object in a key-value pair format includes: Determine a target key name corresponding to the encryption parameter of the target disk, and use the value of the encryption parameter of the target disk as the key value corresponding to the target key name; The target key name and the key value corresponding to the target key name are stored as a key-value pair in the storage space of the header extension object; When the encryption parameter includes a user password, storing the encryption parameter of the target disk in a storage space of the header extension object in a key-value pair format includes: Convert the user password into an encryption key for encrypting and decrypting data; Determine a target key name corresponding to the encryption key, and use the encryption key as a key value corresponding to the target key name; The target key name and the key value corresponding to the target key name are taken as a key-value pair and stored in the storage space of the header extension object.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: receiving a request for writing data to a target disk; If it is determined that the target disk is an encrypted disk, encrypting the data to be written carried by the data write request based on the encryption parameters stored in the storage space of the header extension object of the target disk; In response to the data writing request, the data to be written encrypted based on the encryption parameters is written to the target disk.

6. The method according to claim 5, characterized in that The method further comprises: Receiving a request to read data from the target disk; If it is determined that the target disk is an encrypted disk, decrypting the to-be-read data of the data read request in the target disk based on the encryption parameters stored in the storage space of the header extension object of the target disk; In response to the data read request, the to-be-read data decrypted based on the encryption parameters is returned.

7. The method according to claim 5, characterized in that The method for obtaining the encryption parameters stored in the storage space of the header extension object of the target disk includes: Determine the disk identification of the target disk; Based on the disk identifier of the target disk, determining the storage space of the header extension object of the target disk; The encryption parameters of the target disk are obtained from the storage space of the header extension object of the target disk.

8. A disk creation device, characterized in that: include: An acquisition module, used for acquiring a disk identifier assigned by the distributed storage system to create a target disk in response to a disk creation request; A creation module, used for creating a storage space of a header extension object of the target disk in the distributed storage system based on the disk identifier of the target disk; The storage module is used to store the encryption parameters of the target disk in the storage space of the header extension object if the creation request carries the encryption parameters of the target disk, and the encryption parameters are used to encrypt and decrypt the data requested to be interacted in the target disk.

9. An electronic device, characterized in that: include: one or more processors; Memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by one or more processors, and the one or more programs are configured to perform the steps in the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the method according to any one of claims 1 to 7 are implemented.

11. A computer program product, characterized in that The method comprises a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 7.

Images