Method and system for transparently encrypting and decrypting DCS (Distributed Control System) controller file

Abstract

The invention provides a DCS controller file transparent encryption and decryption method and system, and belongs to the technical field of network industrial control security, and the method comprises the steps: inserting a transparent encryption and decryption drive module between a file system layer and a virtual file system layer of a DCS controller kernel, generating an encryption and decryption key through a password module, and enabling the encryption and decryption key to serve as a root key for file encryption and decryption, encrypting a random number through a root key to obtain a ciphertext encryption and decryption key, adding encryption information to the head of an encrypted file by a transparent encryption and decryption driving module, and writing the encrypted file into a disk after partitioning the encrypted file; and when the encrypted file is read and the encrypted file is written, the encryption and decryption keys are managed, and the plaintext file on the disk is encrypted and transparently decrypted. According to the method, important data are prevented from being stolen through transparent encryption, each file is accurately controlled by configuring an encryption and decryption strategy for a single file or directory, it is ensured that only files needing encryption protection are encrypted, common files or plaintexts are stored, and the operation efficiency of the system is improved.

Description

Technical Field

[0001] The invention belongs to the technical field of network industrial control security, and in particular relates to a method and system for transparent encryption and decryption of DCS controller files. Background Art

[0002] At present, the general mainstream systems have their own transparent encryption and decryption methods, such as Windows Bitlocker, Linux Unified Key Setup (LUKS), etc. These transparent encryption systems can be used to encrypt the specified disk, etc. Even if the disk is removed and inserted into another system, the entire file disk is encrypted and there is no decryption key, so the data content of the disk cannot be read, which can effectively improve the security of important assets and confidential data to a certain extent. However, for the real-time operating system SylixOS used by the DCS (Distributed Control System) controller, there is no such mechanism for transparent encryption and decryption, so it is relatively insufficient in terms of security. Summary of the invention

[0003] The invention provides a method and system for transparent encryption and decryption of files in a DCS controller, aiming to solve the problem that the DCS controller lacks transparent encryption and decryption functions of files.

[0004] The present invention provides a method for transparent encryption and decryption of DCS controller files, comprising the following steps: S1. Insert a transparent encryption and decryption driver module between the virtual file system layer and the file system layer of the DCS controller kernel; S2. Initialize the transparent encryption and decryption driver module, generate encryption and decryption keys through the password module of the DCS controller, and store them in the secure storage area of ​​the password module as the root key for file encryption and decryption; S3. When configuring the encryption and decryption strategy of the file, the transparent encryption and decryption driver module calls the password module to generate a random number as the encryption and decryption key of the file, and encrypts the random number with the root key to obtain the ciphertext encryption and decryption key; Among them, transparent encryption and decryption driver module: When you configure encryption and decryption policies for a single file, the file will be encrypted wherever it is moved. When configuring encryption and decryption policies for a directory, the files in the directory and the files in the recursive subdirectories are encrypted and stored, and each file corresponds to a key; Decrypt the files removed from the directory and save them to disk; S4, the transparent encryption and decryption driver module adds encryption information to the encrypted file header, encrypts the file in blocks and writes it to the disk; the encryption information includes the file size, the ciphertext encryption and decryption key, and the size of the encrypted data; S5. When reading an encrypted file, the transparent encryption and decryption driver module reads the encryption information from the file header, and reads the ciphertext encryption and decryption key of the encrypted file and the size of the encrypted data therefrom, decrypts the ciphertext encryption and decryption key using the root key, and after obtaining the plaintext key of the file, decrypts the encrypted file in blocks until the size of the decrypted data is equal to the size of the encrypted data. If the size of the encrypted data is smaller than the actual size of the encrypted file, the unencrypted data is directly read out and returned; When writing an encrypted file, the transparent encryption and decryption driver module reads the encryption information from the encrypted file header, and extracts the ciphertext encryption and decryption key of the encrypted file from it, uses the root key to decrypt the ciphertext encryption and decryption key, and after obtaining the plaintext key of the encrypted file, encrypts the encrypted file in blocks and stores it on the disk, and stores the actual size of the encrypted data in the field representing the size of the encrypted data.

[0005] In some implementations, in S2, the encryption and decryption root key is generated by a cryptographic module and stored in a secure storage area. The cryptographic module includes a trusted cryptographic module TCM or an encryption card from a third-party manufacturer.

[0006] In some implementations, in S3, when a transparent encryption policy is configured for a single file or directory, each single file or file under the directory will have an independent encryption and decryption key, and each independent encryption and decryption key is based on a random number generated by a cryptographic module and is encrypted and protected by a root key.

[0007] In some implementations, in S4, the encryption information appended to the file header is managed by a transparent encryption and decryption driver module.

[0008] In some implementations, in S4, a single file or files under a directory with a configured encryption policy are initially encrypted, so that the file becomes ciphertext and is stored on the disk; during the initial encryption, encryption information is appended to the file header, and the size of the encrypted data indicates the actual size of the file. During decryption, the actually encrypted content is decrypted based on the size of the encrypted data, and unencrypted content does not need to be decrypted.

[0009] In some implementations, in S5, when reading an encrypted file, the encryption information in the file header is first read out, and the root key is used to decrypt the ciphertext encryption and decryption key stored in the file header to obtain the plaintext encryption and decryption key of the file, and then the size of the encrypted data of the file is read out. When the size of the encrypted data is smaller than the actual size of the file, only the encrypted data is decrypted to obtain the plaintext file and return it to the user.

[0010] In some implementations, in S5, when writing an encrypted file, after obtaining the plaintext encryption and decryption key of the file, the new total size information of the file is updated to the encryption information in the file header, and then the file is encrypted block by block; each time a block of data is encrypted, the size of the encrypted data in the encryption information is updated, and finally all the data of the file is encrypted and stored on the disk.

[0011] The present invention also provides a system for transparent encryption and decryption of DCS controller files, which is used to implement the above-mentioned method for transparent encryption and decryption of DCS controller files. The system includes a generation unit, an encryption and decryption strategy configuration unit, an encryption unit, a reading unit, and a writing unit, wherein: The generation unit is used to insert a transparent encryption and decryption driver module between the virtual file system layer and the file system layer of the DCS controller kernel; initialize the transparent encryption and decryption driver module, generate encryption and decryption keys through the password module of the DCS controller, and store them in the secure storage area of ​​the password module as the root key for file encryption and decryption; The encryption and decryption strategy configuration unit is used to, when configuring the encryption and decryption strategy of the file, the transparent encryption and decryption driver module calls the password module to generate a random number as the encryption and decryption key of the file, and encrypts the random number with the root key to obtain the ciphertext encryption and decryption key; The encryption unit is used to add encryption information to the encrypted file header of the transparent encryption and decryption driver module, and write the encrypted file into disk after encrypting the file in blocks; the encryption information includes the file size, ciphertext encryption and decryption key, and the size of the encrypted data; The reading unit is used for, when reading an encrypted file, the transparent encryption and decryption driver module reads the encryption information from the file header, and reads the ciphertext encryption and decryption key of the encrypted file and the size of the encrypted data therefrom, decrypts the ciphertext encryption and decryption key using the root key, and after obtaining the plaintext key of the file, decrypts the encrypted file in blocks until the size of the decrypted data is equal to the size of the encrypted data. If the size of the encrypted data is smaller than the actual size of the encrypted file, the unencrypted data is directly read out and returned; When writing an encrypted file, the transparent encryption and decryption driver module reads the encryption information from the encrypted file header, and extracts the ciphertext encryption and decryption key of the encrypted file from it, uses the root key to decrypt the ciphertext encryption and decryption key, and after obtaining the plaintext key of the encrypted file, encrypts the encrypted file in blocks and stores it on the disk, and stores the actual size of the encrypted data in the field representing the size of the encrypted data.

[0012] The present invention also provides a computer device, comprising a memory, a processor and a computer program stored and running on the memory, and the processor implements the steps of the above-mentioned method for transparent encryption and decryption of DCS controller files when executing the computer program.

[0013] The present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the method for transparent encryption and decryption of DCS controller files are implemented.

[0014] Compared with the prior art, the method and system for transparent encryption and decryption of DCS controller files of the present invention have the following beneficial effects: The present invention improves the security of the encryption and decryption key of the file by, in the initialization stage, the DCS controller generates an encryption and decryption root key and stores it in the hardware password module. When configuring the file policy, a random number is used to generate an independent encryption and decryption key of the file, and the encryption and decryption key of the ciphertext of the file is obtained after encryption by the root key and stored in the encryption information of the file header. When the file policy is initialized, the file is encrypted once using the key of the file, and the encrypted ciphertext is stored in the disk. The present invention effectively prevents important data from being stolen through transparent encryption. By configuring the encryption and decryption strategy for a single file or directory, each file can be accurately controlled to ensure that only important files that need to be encrypted and protected are encrypted, while general files are still stored in plain text, thereby improving the system operation efficiency. In addition, the present invention does not use the same key for all files, but each file has its own encryption and decryption key, and the key is encrypted and protected using the root key in the hardware password module, thereby effectively protecting the security of the key. Even if the key of a certain file is leaked, other files are safe, which greatly improves the security of each file. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings in the specification are used to provide further understanding of the present invention and constitute a part of the present invention. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0016] Figure 1 A schematic diagram of a flow chart of a method for transparent encryption and decryption of a DCS controller file according to the present invention; Figure 2 A schematic diagram of a processing flow of reading / writing files in a method for transparent encryption and decryption of files in a DCS controller of the present invention; Figure 3 A schematic diagram of the architecture of a system for transparent encryption and decryption of DCS controller files according to the present invention; Figure 4 A schematic diagram of a computer processing device according to the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0018] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0020] In the description of the embodiments of the present invention, it should be noted that if the terms "upper", "lower", "horizontal", "inner", etc. indicate an orientation or positional relationship based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship in which the product of the invention is usually placed when in use, it is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In addition, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0021] In addition, if the term "horizontal" appears, it does not mean that the component must be absolutely horizontal, but can be slightly tilted. For example, "horizontal" only means that its direction is more horizontal than "vertical", which does not mean that the structure must be completely horizontal, but can be slightly tilted.

[0022] In the description of the embodiments of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms "set", "install", "connect", and "connect" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal connection of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0023] On the current DCS controller, the kernel layer transparent encryption and decryption technology is used to add a transparent encryption and decryption driver module between the kernel virtual file system layer (VFS) and the file system layer (ext4, ext3, ntfs, fat, etc.). For files entering and exiting the disk, if the encryption and decryption policy is configured, encryption or decryption operations are performed. When the user reads the file, the file is read from the disk and decrypted by the transparent encryption and decryption driver module and returned to the user in plain text; when the user writes the file, the file is encrypted by the transparent encryption and decryption driver module and stored on the disk. The whole process is transparent to the user. For the encryption and decryption key of the file, it is not stored in a certain location of the partition like the encryption and decryption of ordinary files, and a partition has only one key, but each file has an independent secret key, and is encrypted with the secret key and stored in the encrypted information of the file header. Even if there is a problem with the file, it will not affect other files.

[0024] The present invention effectively prevents important data from being stolen through transparent encryption. By configuring encryption and decryption strategies for specified files or directories, each file can be accurately controlled to ensure that only important files that need encryption protection are encrypted, while general files are still stored in plain text, thereby improving system operation efficiency.

[0025] like Figure 1 and Figure 2 As shown, the present invention provides a method for transparent encryption and decryption of DCS controller files, comprising the following steps: S1. Insert a transparent encryption and decryption driver module between the virtual file system layer and the file system layer of the DCS controller kernel; S2. Initialize the transparent encryption and decryption driver module, generate encryption and decryption keys through the password module of the DCS controller, and store them in the secure storage area of ​​the password module as the root key for file encryption and decryption; S3. When configuring the encryption and decryption strategy of the file, the transparent encryption and decryption driver module calls the password module to generate a random number as the encryption and decryption key of the file, and encrypts the random number with the root key to obtain the ciphertext encryption and decryption key; Among them, transparent encryption and decryption driver module: When you configure encryption and decryption policies for a single file, the file will be encrypted wherever it is moved. When configuring encryption and decryption policies for a directory, the files in the directory and the files in the recursive subdirectories are encrypted and stored, and each file corresponds to a key; Decrypt the files removed from the directory and save them to disk; S4, the transparent encryption and decryption driver module adds encryption information to the encrypted file header, encrypts the file in blocks and writes it to the disk; the encryption information includes the file size, the ciphertext encryption and decryption key, and the size of the encrypted data; S5. When reading an encrypted file, the transparent encryption and decryption driver module reads the encryption information from the file header, and reads the ciphertext encryption and decryption key of the encrypted file and the size of the encrypted data therefrom, decrypts the ciphertext encryption and decryption key using the root key, and after obtaining the plaintext key of the file, decrypts the encrypted file in blocks until the size of the decrypted data is equal to the size of the encrypted data. If the size of the encrypted data is smaller than the actual size of the encrypted file, the unencrypted data is directly read out and returned; When writing an encrypted file, the transparent encryption and decryption driver module reads the encryption information from the encrypted file header, and extracts the ciphertext encryption and decryption key of the encrypted file from it, uses the root key to decrypt the ciphertext encryption and decryption key, and after obtaining the plaintext key of the encrypted file, encrypts the encrypted file in blocks and stores it on the disk, and stores the actual size of the encrypted data in the field representing the size of the encrypted data.

[0026] In some implementations, in an initial state, all files stored on the disk are in plain text, and by configuring a policy for a specified file, the transparent encryption and decryption driver module will immediately encrypt and store the file.

[0027] The transparent encryption and decryption driver module of the present invention is responsible for managing the encryption information of the file header; when configuring the encryption and decryption strategy of the file, the transparent encryption and decryption driver module calls the interface provided by the password module to generate a random number as the encryption and decryption key of the file, and obtains the encryption and decryption key of the ciphertext of the file after encrypting it with the root key generated by S2, so as to protect the security of the encryption and decryption key of the file; wherein, the transparent encryption and decryption driver module can specify a single file to configure the encryption and decryption strategy, or specify a directory to configure the encryption strategy. In the case of configuring a directory, all files under the directory and files under the recursive subdirectories will be encrypted, and all newly created files under the directory will be automatically encrypted and stored. When configuring the encryption strategy of the directory, the files under the directory are automatically decrypted and stored after being moved out of the directory, that is, the files become plain text, and files outside the directory are automatically encrypted and stored in ciphertext form when they are moved into the directory.

[0028] The encryption and decryption operations of data using a key include: first reading the ciphertext key of the file from the encrypted information in the file header, then decrypting the ciphertext key using the root key stored in the cryptographic module to obtain a plaintext key, and then using the plaintext key to encrypt and decrypt the data.

[0029] In some implementations, the file for which the encryption policy is specified will undergo an initial encryption process to convert the plaintext file into a ciphertext file and store it on a disk. The process includes: 1) The transparent encryption and decryption driver module uses the cryptographic module to generate a random number as the encryption and decryption key of the file, and uses the root key to encrypt the plaintext encryption and decryption key of the file to obtain the encryption key of the ciphertext of the file to prevent key leakage; 2) Read the content and size information of the file, create a structure for storing encrypted information, store the encrypted ciphertext encryption and decryption key, file size, and size information of the encrypted data of the file into the encrypted information, add the information to the file header, and store it on the disk; 3) Encrypt the file in blocks, encrypt one block at a time and store it on disk. At the same time, update the value of the encrypted data size in the encrypted information data in the file header. This value stores the actual size of the encrypted data. When all the data is encrypted, the initialization of the file is completed. In some embodiments, when reading an encrypted file, the transparent encryption and decryption driver module first reads the encryption information from the file header to confirm whether the file is ciphertext. If so, the ciphertext encryption and decryption key, file size, and encrypted data size of the file are taken out from the encrypted information data, and the root key in the hardware cryptographic module is used to decrypt the file to obtain the plaintext encryption and decryption key of the file. The key is then used to decrypt the read data until the decrypted data is equal to the size of the recorded encrypted data, and the plaintext data is returned to the user. In some embodiments, when writing an encrypted file, the transparent encryption and decryption driver module first reads the encryption information from the file header, and takes out the ciphertext key of the file, decrypts it using the root key in the hardware cryptographic module, obtains the plaintext key of the file, and then encrypts the file block by block and stores it on the disk, while updating the size of the encrypted data in the encryption information until the entire file is encrypted and written back to the disk.

[0030] Optionally, in some embodiments, in S2, an encryption and decryption root key is initialized. The key is generated by the cryptographic module and stored in the persistent storage space of the cryptographic module, and an interface is provided to connect to the cryptographic module. The cryptographic module uses a trusted cryptographic module TCM or an encryption card from a third-party manufacturer; the key is the encryption and decryption key for encrypting and decrypting files.

[0031] Optionally, in some embodiments, in S3, a transparent encryption policy is configured for a single file or directory, and all files under the file or directory configured with the policy will have an independent encryption and decryption key for the file. The random number generated by the cryptographic module is used as the encryption and decryption key for the file, and is encrypted and protected by the root key of the cryptographic module.

[0032] Optionally, in some embodiments, in S4, an initial encryption is required for the files configured with the encryption policy or all files under the directory, so that the files are stored on the disk after being ciphertext. During the initial encryption, encryption information is added to the file header. The encryption information includes the file size, ciphertext encryption and decryption keys, and the size information of the encrypted data, where the size of the encrypted content indicates the size of the actual encrypted data of the file. During decryption, the actually encrypted content is decrypted based on the size of the encrypted data, and the unencrypted content does not need to be decrypted.

[0033] Optionally, in some embodiments, in S5, when reading an encrypted file, the encryption information in the file header is first read out, and the root key is used to decrypt the ciphertext encryption and decryption key of the file stored in the header to obtain the plaintext encryption and decryption key of the file, and then the size of the actual encrypted data of the file is read out. When the size of the encrypted data is smaller than the actual size of the file, only the encrypted data is decrypted, and the unencrypted data does not need to be decrypted to obtain the plaintext file and return it to the user.

[0034] When writing an encrypted file, first read the encrypted information in the file header, and use the root key to decrypt the ciphertext encryption and decryption key of the file stored in the encrypted information to obtain the plaintext encryption and decryption key of the file, and update the new total size information of the file to the encrypted information in the file header. According to the updated encrypted information, the file is encrypted block by block. Every time a piece of data is encrypted, the encrypted data size value in the encrypted information is updated, and finally all the data of the file is encrypted and stored on the disk.

[0035] In some implementations, in S1, the root key is used to protect the security of the key. The key is not used directly to encrypt and decrypt files, but to encrypt and decrypt the encryption and decryption keys of each file, and the file is encrypted and decrypted using the file's key.

[0036] In some implementations, in S5, when encrypting a file, the size of the encrypted data will be simultaneously recorded in the encryption information of the file header to avoid a sudden power failure during the encryption process, which would result in only partial encryption of the data. When decrypting, the data of the corresponding size will be decrypted based on this value, thereby ensuring that the ciphertext can be correctly decrypted.

[0037] As an embodiment, specifically, the present invention provides a method for transparent encryption and decryption of a DCS controller file, which initializes and generates a root key for encryption and decryption and stores it in a hardware password module. The key is not directly used to encrypt and decrypt files, but is used to encrypt and protect the encryption and decryption keys of each file. An encryption policy is configured for a specified file or directory. After the configuration is completed, the encryption of the file will be initialized and stored on a disk. During the encryption process, a random number will first be generated by the hardware password module as the encryption key of the file, and the encryption key of the ciphertext of the file will be obtained after it is encrypted by the generated root key and stored in the encrypted information data of the file header. When the file is to be encrypted and decrypted, the ciphertext encryption and decryption key of the file is first read from the encrypted information, and then the root key is used to decrypt it to obtain the plaintext encryption and decryption key of the file. When reading an encrypted file, the transparent encryption and decryption driver module reads the ciphertext encryption and decryption key of the file from the encrypted information of the file header, and then uses the root key to decrypt it to obtain the plaintext encryption and decryption key of the file, and then reads the size of the encrypted data from the encrypted information, and then decrypts the specified file until the decrypted data size reaches the size of the encrypted data, indicating that the ciphertext has been completely decrypted. When writing an encrypted file, the transparent encryption and decryption driver module reads the ciphertext encryption and decryption key of the file from the encryption information in the file header, and then uses the root key to decrypt it to obtain the plaintext encryption and decryption key of the file. The file is then encrypted and stored block by block, and the size of the encrypted data stored in the encryption information in the file header is synchronously updated.

[0038] The present invention discloses a method for transparent encryption and decryption of files of a DCS controller, which can ensure the data security of a disk on a trusted DCS controller to a certain extent. Even if the disk is removed by an offender or an operator and inserted into another device, since the important files are encrypted on the disk, and the encryption and decryption keys of the files are stored in the encrypted information of the file header after being kept confidential by the root key, and the root key of the encryption and decryption keys of the ciphertext of the files is stored in the hardware password module of the original device, and the new device does not have the root key information, the ciphertext key of the encrypted file cannot be decrypted, and the ciphertext file cannot be decrypted. The present invention can effectively protect data assets from being leaked, can well protect the configuration data on the controller, and improve its security.

[0039] In a method for transparent encryption and decryption of DCS controller files of the present invention, a trusted controller mainboard integrates a hardware encryption module, which can generate and securely store encryption keys to protect the security of the keys. The secret key is not used as the encryption key of the file. For each encrypted file, a unique encryption key is randomly generated and encrypted with the root key in the hardware password module and stored in the encrypted information of the file header. Since each file has an independent key and is encrypted, it will only be decrypted when used. Even if a file is leaked for some reason, it will not affect other encrypted files, and the security of the system encrypted files can be effectively protected.

[0040] Furthermore, the data transparent encryption and decryption method of the present invention configures an encryption strategy for each file instead of encrypting the disk partition, so that some files on the same disk are encrypted and some are plain text. Users can configure encryption strategies for important files according to their actual situation, and do not configure encryption strategies for other unimportant files. Each file has an independent encryption key, and each encrypted file header has encryption information of the file, including the encryption and decryption key of the ciphertext of the file, the size of the encrypted data of the file, and the actual size information of the file. When encrypting and decrypting a data file, it is necessary to first extract the encryption and decryption key of the ciphertext of the file from the encryption information of the file header, and then use the root key to decrypt the encryption and decryption key of the ciphertext of the file to obtain the encryption and decryption key of the plain text of the file, so that the file can be encrypted and decrypted to ensure the security of the file. At the same time, in order to ensure that the file is only partially encrypted due to a sudden power failure during the encryption process without affecting the normal decryption of the file, and to ensure the availability of the file, the encryption information also stores the size of the encrypted data of the file. Using this information, only the encrypted part can be decrypted, and the unencrypted part can be directly read, thereby ensuring that the file content can be read completely, greatly improving the fault tolerance and ensuring the availability of the file.

[0041] like Figure 3 As shown, the present invention also provides a DCS controller file transparent encryption and decryption system, the system includes a generation unit, an encryption and decryption strategy configuration unit, an encryption unit, a reading unit and a writing unit, wherein: The generation unit is used to insert a transparent encryption and decryption driver module between the virtual file system layer and the file system layer of the DCS controller kernel; initialize the transparent encryption and decryption driver module, generate encryption and decryption keys through the password module of the DCS controller, and store them in the secure storage area of ​​the password module as the root key for file encryption and decryption; The encryption and decryption strategy configuration unit is used to, when configuring the encryption and decryption strategy of the file, the transparent encryption and decryption driver module calls the password module to generate a random number as the encryption and decryption key of the file, and encrypts the random number with the root key to obtain the ciphertext encryption and decryption key; The encryption unit is used to add encryption information to the encrypted file header of the transparent encryption and decryption driver module, and write the encrypted file into disk after encrypting the file in blocks; the encryption information includes the file size, ciphertext encryption and decryption key, and the size of the encrypted data; The reading unit is used for, when reading an encrypted file, the transparent encryption and decryption driver module reads the encryption information from the file header, and reads the ciphertext encryption and decryption key of the encrypted file and the size of the encrypted data therefrom, decrypts the ciphertext encryption and decryption key using the root key, and after obtaining the plaintext key of the file, decrypts the encrypted file in blocks until the size of the decrypted data is equal to the size of the encrypted data. If the size of the encrypted data is smaller than the actual size of the encrypted file, the unencrypted data is directly read out and returned; When writing an encrypted file, the transparent encryption and decryption driver module reads the encryption information from the encrypted file header, and extracts the ciphertext encryption and decryption key of the encrypted file from it, uses the root key to decrypt the ciphertext encryption and decryption key, and after obtaining the plaintext key of the encrypted file, encrypts the encrypted file in blocks and stores it on the disk, and stores the actual size of the encrypted data in the field representing the size of the encrypted data.

[0042] The system of the present invention is used as a carrier for realizing a method for transparently encrypting and decrypting files of a DCS controller.

[0043] like Figure 4 As shown, the present invention also provides a computer device, including a memory, a processor, and a computer program stored and running on the memory, and when the processor executes the computer program, the steps of the method for transparent encryption and decryption of DCS controller files as described above are implemented.

[0044] The present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the method for transparent encryption and decryption of DCS controller files are implemented.

[0045] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any ordinary technician in the industry can smoothly implement the present invention as shown in the specification and described above. However, any equivalent changes, modifications and evolutions made by technicians familiar with the profession without departing from the scope of the technical solution of the present invention using the technical content disclosed above are all equivalent embodiments of the present invention. At the same time, any equivalent changes, modifications and evolutions made to the above embodiments based on the essential technology of the present invention are still within the protection scope of the technical solution of the present invention.

Claims

1. A method for transparent encryption and decryption of DCS controller files, characterized in that: The steps include: S1. Insert a transparent encryption and decryption driver module between the virtual file system layer and the file system layer of the DCS controller kernel; S2. Initialize the transparent encryption and decryption driver module, generate encryption and decryption keys through the password module of the DCS controller, and store them in the secure storage area of ​​the password module as the root key for file encryption and decryption; S3. When configuring the encryption and decryption strategy of the file, the transparent encryption and decryption driver module calls the password module to generate a random number as the encryption and decryption key of the file, and encrypts the random number with the root key to obtain the ciphertext encryption and decryption key; Among them, transparent encryption and decryption driver module: When you configure encryption and decryption policies for a single file, the file will be encrypted wherever it is moved. When configuring encryption and decryption policies for a directory, the files in the directory and the files in the recursive subdirectories are encrypted and stored, and each file corresponds to a key; Decrypt the files removed from the directory and save them to disk; S4, the transparent encryption and decryption driver module adds encryption information to the encrypted file header, encrypts the file in blocks and writes it to the disk; the encryption information includes the file size, the ciphertext encryption and decryption key, and the size of the encrypted data; S5. When reading an encrypted file, the transparent encryption and decryption driver module reads the encryption information from the file header, and reads the ciphertext encryption and decryption key of the encrypted file and the size of the encrypted data therefrom, decrypts the ciphertext encryption and decryption key using the root key, and after obtaining the plaintext key of the file, decrypts the encrypted file in blocks until the size of the decrypted data is equal to the size of the encrypted data. If the size of the encrypted data is smaller than the actual size of the encrypted file, the unencrypted data is directly read out and returned; When writing an encrypted file, the transparent encryption and decryption driver module reads the encryption information from the encrypted file header, and extracts the ciphertext encryption and decryption key of the encrypted file from it, uses the root key to decrypt the ciphertext encryption and decryption key, and after obtaining the plaintext key of the encrypted file, encrypts the encrypted file in blocks and stores it on the disk, and stores the actual size of the encrypted data in the field representing the size of the encrypted data.

2. The method for transparent encryption and decryption of DCS controller files according to claim 1, characterized in that: In S2, the encryption and decryption root key is generated by a cryptographic module and stored in a secure storage area. The cryptographic module includes a trusted cryptographic module TCM or an encryption card of a third-party manufacturer.

3. The method for transparent encryption and decryption of DCS controller files according to claim 1, characterized in that: In the S3, when a transparent encryption policy is configured for a single file or directory, each single file or file under the directory will have an independent encryption and decryption key. Each independent encryption and decryption key is based on a random number generated by a cryptographic module and is encrypted and protected by a root key.

4. The method for transparent encryption and decryption of DCS controller files according to claim 1, characterized in that: In S4, the encryption information added to the file header is managed by the transparent encryption and decryption driver module.

5. The method for transparent encryption and decryption of DCS controller files according to claim 1, characterized in that: In S4, a single file or files under a directory configured with an encryption policy are initially encrypted, so that the file becomes ciphertext and is stored on a disk; during the initial encryption, encryption information is added to the file header, and the size of the encrypted data indicates the actual size of the file. During decryption, the actually encrypted content is decrypted according to the size of the encrypted data, and the unencrypted content does not need to be decrypted.

6. The method for transparent encryption and decryption of DCS controller files according to claim 1, characterized in that: In S5, when reading an encrypted file, the encryption information in the file header is first read out, and the root key is used to decrypt the ciphertext encryption and decryption key stored in the file header to obtain the plaintext encryption and decryption key of the file, and then the size of the encrypted data of the file is read out. When the size of the encrypted data is smaller than the actual size of the file, only the encrypted data is decrypted to obtain the plaintext file and return it to the user.

7. The method for transparent encryption and decryption of DCS controller files according to claim 1, characterized in that: In S5, when writing an encrypted file, after obtaining the plaintext encryption and decryption key of the file, the new total size information of the file is updated to the encryption information in the file header, and then the file is encrypted block by block; each time a block of data is encrypted, the size of the encrypted data in the encryption information is updated, and finally all the data of the file is encrypted and stored on the disk.

8. A system for transparent encryption and decryption of DCS controller files, used to implement the method for transparent encryption and decryption of DCS controller files according to any one of claims 1 to 7, characterized in that: The system includes a generation unit, an encryption and decryption strategy configuration unit, an encryption unit, a reading unit, and a writing unit, wherein: The generation unit is used to insert a transparent encryption and decryption driver module between the virtual file system layer and the file system layer of the DCS controller kernel; initialize the transparent encryption and decryption driver module, generate encryption and decryption keys through the password module of the DCS controller, and store them in the secure storage area of ​​the password module as the root key for file encryption and decryption; The encryption and decryption strategy configuration unit is used to, when configuring the encryption and decryption strategy of the file, the transparent encryption and decryption driver module calls the password module to generate a random number as the encryption and decryption key of the file, and encrypts the random number with the root key to obtain the ciphertext encryption and decryption key; The encryption unit is used to add encryption information to the encrypted file header of the transparent encryption and decryption driver module, and write the encrypted file into disk after encrypting the file in blocks; the encryption information includes the file size, ciphertext encryption and decryption key, and the size of the encrypted data; The reading unit is used for, when reading an encrypted file, the transparent encryption and decryption driver module reads the encryption information from the file header, and reads the ciphertext encryption and decryption key of the encrypted file and the size of the encrypted data therefrom, decrypts the ciphertext encryption and decryption key using the root key, and after obtaining the plaintext key of the file, decrypts the encrypted file in blocks until the size of the decrypted data is equal to the size of the encrypted data. If the size of the encrypted data is smaller than the actual size of the encrypted file, the unencrypted data is directly read out and returned; When writing an encrypted file, the transparent encryption and decryption driver module reads the encryption information from the encrypted file header, and extracts the ciphertext encryption and decryption key of the encrypted file from it, uses the root key to decrypt the ciphertext encryption and decryption key, and after obtaining the plaintext key of the encrypted file, encrypts the encrypted file in blocks and stores it on the disk, and stores the actual size of the encrypted data in the field representing the size of the encrypted data.

9. A computer device comprising a memory, a processor and a computer program stored and executed on the memory, characterized in that: When the processor executes the computer program, the steps of the method for transparent encryption and decryption of DCS controller files according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of transparent encryption and decryption of a DCS controller file according to any one of claims 1 to 7 are implemented.

Images