A file transparent encryption and decryption method and system in a trust-based environment

Abstract

The present invention relates to a method and system for transparent encryption and decryption of files in a trusted innovation environment in the field of data security technology, comprising the following steps: receiving a server security policy configured by a server, and kernelizing the server security policy to obtain a kernel security policy, wherein the server security policy includes a security key, a trusted software list and an encrypted file determination rule; based on the trusted software list, adding a trusted label in the startup process of the trusted software; based on the trusted label and the encrypted file determination rule, distinguishing a write file one that needs to be encrypted, a write file two that does not need to be encrypted, a read file one that needs to be decrypted and a read file two that does not need to be decrypted in the trusted software; using a public key in a security key to encrypt the write file one, and using a private key in the security key to decrypt the read file one, so as to solve the problem of low flexibility in encrypting data files in the existing trusted innovation environment.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a method and system for transparent encryption and decryption of files in a trusted computing environment. Background Art

[0002] Trusted and Innovative Environment (sometimes also referred to as "Information Technology Application Innovation Environment") refers to a complete ecosystem built to achieve independent innovation, security and control in the field of information technology. It aims to reduce dependence on external technologies and products, especially in critical infrastructure and sensitive industries, and ensure national information security and technological sovereignty.

[0003] At present, data encryption in the trusted computing environment is mostly active encryption, mainly full-disk file encryption and encrypted safe mechanisms. The former encrypts all data on the entire hard disk or storage device, including the operating system, applications, temporary files, and user data, and cannot classify single files; the latter requires the file to be placed in a certain location or actively clicked to encrypt, and then decrypted by entering the user account or password, which is relatively inconvenient and difficult to use. Therefore, the data encryption flexibility in the existing trusted computing environment is relatively low. Summary of the invention

[0004] In view of the shortcomings of the prior art, the present invention provides a method and system for transparent encryption and decryption of files in a trusted computing environment, thereby solving the problem of low flexibility in data file encryption in the existing trusted computing environment.

[0005] In order to solve the above technical problems, the present invention is solved by the following technical solutions:

[0006] A method for transparent encryption and decryption of files in a trusted environment comprises the following steps:

[0007] Receiving a server security policy configured by a server, and performing kernelization processing on the server security policy to obtain a kernel security policy, wherein the server security policy includes a security key, a trusted software list, and an encrypted file determination rule;

[0008] Based on the trusted software list, adding a trusted tag in the startup process of the trusted software;

[0009] Based on the trust label and the encryption file determination rule, distinguish between a write file 1 that needs to be encrypted, a write file 2 that does not need to be encrypted, a read file 1 that needs to be decrypted, and a read file 2 that does not need to be decrypted in the trust software;

[0010] The write file 1 is encrypted using the public key in the security key, and the read file 1 is decrypted using the private key in the security key.

[0011] Optionally, encrypting the written file 1 using a public key in the security key includes the following steps:

[0012] Hijacking the system function call table of the environment system, and replacing the address of the relevant system call function in the system function call table with the kernel encrypted address;

[0013] When the trusted software writes a file, the system call function required for writing the file is called and executed in the kernel encryption address to obtain the written data;

[0014] The write data is encrypted using a public key in the security key.

[0015] Optionally, hijacking a system function call table of an environment system and replacing the address of a related system call function in the system function call table with a kernel encrypted address comprises the following steps:

[0016] Use the addressing function to search the system function call table, and according to the system call number, search the specific address of the write function in the system call table;

[0017] The specific address one is hijacked, and the specific address one is replaced with a kernel encrypted address.

[0018] Optionally, using a private key in the security key to decrypt the read file 1 includes the following steps:

[0019] Hijacking the system function call table of the environment system, and replacing the address of the relevant system call function in the system function call table with the kernel decryption address;

[0020] When the trusted software reads a file, the system call function required for reading the file is called and executed in the kernel decryption address to obtain the read data;

[0021] The read data is decrypted using the public key in the security key.

[0022] Optionally, hijacking a system function call table of the environment system and replacing the address of a related system call function in the system function call table with a kernel decryption address comprises the following steps:

[0023] Using the addressing function to search the system function call table, and according to the system call number, searching the specific address of the read function in the system call table;

[0024] Hijack the specific address two, and replace the specific address two with the kernel decryption address.

[0025] Optionally, using a public key in the security key to encrypt the write file one, and using a private key in the security key to decrypt the read file one, includes the following steps:

[0026] Hijacking the function call unified interface of the environment system, and replacing the address of the function call unified interface with the kernel encryption address and the kernel decryption address;

[0027] When the trusted software writes a file, the system call function required for writing the file is called and executed in the kernel encryption address to obtain the written data;

[0028] Encrypting the written data using a public key in the security key;

[0029] When the trusted software reads a file, the system call function required for reading the file is called and executed in the kernel decryption address to obtain the read data;

[0030] The read data is decrypted using the public key in the security key.

[0031] Optionally, the following steps are also included:

[0032] Record the reading process data generated when the trusted software reads the reading file, and encrypt the reading process data.

[0033] Optionally, the encrypted file determination rule is a determination rule generated by any one of the determination conditions of determining the encrypted file based on an encrypted file suffix list, determining the encrypted file based on keyword matching, determining the encrypted file based on a regular expression, or determining the encrypted file based on a related path configuration list.

[0034] Optionally, the kernelization process includes the following steps:

[0035] Parsing the server security policy and extracting kernel requirement data;

[0036] Fill the kernel requirement data with a structure to generate a kernel security policy.

[0037] A file transparent encryption and decryption system in a trusted innovation environment, the file transparent encryption and decryption system executes any one of the above-mentioned file transparent encryption and decryption methods in a trusted innovation environment, including a server, a client, an extended listening module located in the client, and a kernel character device driver module located in the client;

[0038] The server is used to configure and send a server security policy, wherein the server security policy includes a security key, a trusted software list, and an encrypted file determination rule;

[0039] The client is used to receive the server security policy and send the server security policy to the extended monitoring module;

[0040] The extended monitoring module is used to perform kernel processing on the server security policy to obtain the kernel security policy, and send the kernel security policy to the kernel character device driver module; based on the trusted software list, add a trusted label in the startup process of the trusted software;

[0041] The kernel character device driver module is used to distinguish between write file one that needs to be encrypted, write file two that does not need to be encrypted, read file one that needs to be decrypted, and read file two that does not need to be decrypted in the trusted software based on the trusted label and the encrypted file judgment rules; use the public key in the security key to encrypt the write file one, and use the private key in the security key to decrypt the read file one.

[0042] Compared with the prior art, the technical solution provided by the present invention has the following beneficial effects:

[0043] This application executes the server security policy sent by the server on the client, so that the staff does not need to set the security policy on the client, but only needs to issue the security policy uniformly on the server, thereby improving the freedom of operation and strong operability; at the same time, since encryption and decryption are performed in the kernel character device driver module, the operation is performed in a driver manner to ensure compatibility; finally, by hijacking and replacing the system call function and the address of the function call unified interface, the control over the software process and output files is improved, ensuring that the data output by the trusted file is encrypted data, even if it is sent out, it is an encrypted file, thereby ensuring the security of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0045] Figure 1 This is a flow chart of a method for transparent encryption and decryption of files in a trust-based environment proposed in the first embodiment of the present invention;

[0046] Figure 2This is an architectural diagram of a file transparent encryption and decryption system in a trusted computing environment proposed in the third embodiment. DETAILED DESCRIPTION

[0047] The present invention is further described in detail below in conjunction with embodiments. The following embodiments are for explanation of the present invention but the present invention is not limited to the following embodiments.

[0048] Embodiment 1

[0049] like Figure 1 As shown, a method for transparent encryption and decryption of files in a trusted computing environment includes the following steps: receiving a server security policy configured by a server, and kernelizing the server security policy to obtain a kernel security policy, wherein the kernelization processing specifically includes the following steps: parsing the server security policy and extracting kernel requirement data; filling the kernel requirement data with a structure to generate a kernel security policy.

[0050] Specifically, the client obtains the server security policy from the server through the login interface. The server security policy is a security policy configured by the staff on the server side according to the needs and sent to the client through the server. The server security policy includes security keys, trusted software lists and encryption file judgment rules.

[0051] The client then sends the server security policy to the extended listening module. Since the data transmitted by the server to the client are all serialized data, and the data structure that can be used by the kernel character device driver module on the client is structured data, the server security policy needs to be kernelized in the extended listening module to provide a kernel security policy that can be used by the kernel character device driver module.

[0052] Among them, during kernel processing, the server security policy is first parsed, and then the security key and encryption file judgment rules are extracted to obtain the kernel requirement data, and the kernel requirement data is structured and filled to generate a kernel security policy that can be used by the kernel character device driver module, and then the kernel security policy is transmitted to the kernel character device driver module.

[0053] On the other hand, after parsing the server security policy, the extended listening module adds a trusted label to the startup process of the trusted software based on the trusted software list. Specifically, since the extended listening module has a software monitoring function, when the software is started, it will be monitored by the extended listening module, and then based on the obtained trusted software list, it is determined whether the started software is trusted software. If the started software is in the trusted software list, it means that the started software is trusted software, otherwise it is untrusted software. After the trusted software is monitored, a trusted label will be added to the startup process of the trusted software to mark the trusted software. Among them, the trusted label can be a label without content, and can also be set to a label containing data content, and the data content contained can be set by itself.

[0054] Furthermore, when the monitoring function of the monitoring module is extended, it is implemented through the execve function. When the software is started, the startup process of the software will call the function to monitor the started software. After monitoring the started software, the trusted software can be marked by adding a trusted tag in the startup process.

[0055] While the extended monitoring module is adding the trust tag, the kernel character device driver module can perform the following operations: hijack the system function call table of the environment system, and replace the address of the relevant system call function in the system function call table with the kernel encryption address and the kernel decryption address, in preparation for subsequent file encryption and decryption.

[0056] Specifically, the method includes the following steps: using an addressing function to search a system function call table, and according to a system call number, searching for a specific address one of a write function in the system call table; according to a system call number, searching for a specific address two of a read function in the system call table; hijacking specific address one and specific address two, and replacing specific address one with a kernel encryption address, and replacing specific address two with a kernel decryption address.

[0057] More specifically, use the kprobe probe to first find the addressing function (kallsyms_lookup_name), obtain the address of the system function call table (sys_table_call) through the addressing function (kallsyms_lookup_name), and then read the function (sys_read ) and the system call number of the write function (including sys_write and sys_rename) obtain the specific address one of the write function and the specific address two of the read function, and record them, then hijack the specific address one and the specific address two, and replace them with the kernel encryption address and the kernel decryption address respectively, so that when the system calls the write function and the read function, it directly jumps to the kernel character device driver module through the replacement of the kernel encryption address and the kernel decryption address, and after completing the encryption and decryption on the kernel character device driver module, it returns to the client system to execute the original system call logic, wherein, since data writing will cause the software process to generate a new file, and general software will call the two types of system calls, write or rename, when writing data, the encryption function can be realized by controlling the system to call the function and combining the software trust list. Therefore, the write function in this application refers to the direct write function (sys_write) and the rename function (sys_rename).

[0058] After completing the insertion of the kernel encryption address and the kernel decryption address and the addition of the trust label, the files written in the software can be encrypted and decrypted. When there is software writing or reading files, it is necessary to distinguish between the write file one that needs to be encrypted, the write file two that does not need to be encrypted, the read file one that needs to be decrypted, and the read file two that does not need to be decrypted in the trusted software based on the trust label and the encryption file judgment rules.

[0059] Specifically, when the software writes a file, it will first determine whether the software is trusted software based on whether there is a trust label in the software. If there is no trust label, there is no need to encrypt the file written by the software, and the written file is written file 2; if there is a trust label, it means that the software is trusted software, and it is necessary to further determine whether the written file needs to be encrypted.

[0060] Further judging whether the written file is to be encrypted is mainly used to judge whether the file is an important file. Specifically, since the encrypted file judgment rule is a judgment rule generated by any one of the judgment conditions of determining the encrypted file based on an encrypted file suffix list, determining the encrypted file based on keyword matching, determining the encrypted file based on a regular expression, or determining the encrypted file based on a related path configuration list, whether the written file is an important file can be achieved in a variety of ways.

[0061] When the judgment basis is based on the encrypted file suffix list, it is judged whether the suffix of the written file is in the encrypted file suffix list. Only the file in the encrypted file suffix list can be used as the written file that needs to be encrypted. When the judgment basis is based on the relevant path configuration list, when writing, the full path of the written file is obtained through f_path.dentry->d_name.name in the struct file structure, and the relevant path configuration list is used to determine whether to encrypt the file.

[0062] When the judgment basis is keyword matching, the judgment is achieved by performing keyword matching on the file content of the written file. When the matching result shows that the file content of the file contains specific confidential words, it means that the written file is a written file that needs to be encrypted. When the judgment basis is a regular expression, the judgment is achieved by performing a regular expression on the written file. When it meets the regular expression, it means that the written file is a written file that needs to be encrypted.

[0063] When the software reads a file, it first determines whether the software is trusted software based on whether there is a trust label in the software. If there is no trust label, there is no need to decrypt the file read by the software, and the read file is read file two; if there is a trust label, it means that the software is trusted software, and the read file needs to be decrypted when reading, and the read file is regarded as read file one.

[0064] Next, when it is determined that the file to be written is write file one, the write file one is encrypted using the public key in the security key, and the read file one is decrypted using the private key in the security key.

[0065] Among them, the public key in the security key is used to encrypt the write file one, including the following steps: when the trusted software writes the file, the system call function required for writing the write file one is called and executed in the kernel encryption address to obtain the write data; the public key in the security key is used to encrypt the write data.

[0066] Specifically, the system call function required for writing a file is write, rename and other system call functions. When the system call function is executed, the write data will be obtained, and then the security protection of the write data can be achieved through public key encryption.

[0067] In addition, the encryption algorithm used to encrypt the written data can be customized, such as using AES, DES, RSA and other algorithms.

[0068] It should be noted that the system call function is an interface provided by the operating system to user space programs, which allows programs to request services from the operating system. The main system call functions used are file operation system call functions, such as read, write, mmap, rename and a series of other system call functions.

[0069] Furthermore, the private key in the security key is used to decrypt the read file one, including the following steps: when the trusted software reads the file, the system call function required to read the read file one is called and executed in the kernel decryption address to obtain the read data; the public key in the security key is used to decrypt the read data.

[0070] Specifically, the system call function required for calling the reading of the file is the read system call function. When the system call function is executed, the read data will be obtained, and then the read data can be displayed and presented by decrypting it with a private key.

[0071] In addition, if it is trusted software that has read encrypted files, the PID (unique identifier of the process) of this process will also be recorded to mark the trusted software process that has read the encrypted files. The marked process will encrypt the file even if it outputs a non-suffix file.

[0072] At this point, the transparent file encryption and decryption process is completed. This application executes the server security policy sent by the server on the client, so that the staff does not need to set the security policy on the client, but only needs to issue the security policy uniformly on the server, thereby improving the freedom of operation and strong operability; at the same time, since the encryption and decryption are performed in the kernel character device driver module, the operation is performed in a driver manner to ensure compatibility; finally, by hijacking and replacing the system call function and the address of the function call unified interface, the control over the software process and output files is improved, ensuring that the data output by the trusted file is encrypted data, even if it is sent out, it is an encrypted file, thereby ensuring the security of the data.

[0073] It should be noted that this application is mainly applicable to transparent encryption and decryption of files in a trusted computing environment, and is also applicable to Linux environments whose architectures include arm64 and x86_64. The environment system mentioned in this application refers to the OS system and the Linux system; the kernel encryption address of this application is the address of the kernel encryption module in the kernel character device driver module, and the kernel decryption address is the address of the kernel decryption module in the kernel character device driver module.

[0074] Embodiment 2

[0075] The difference between this embodiment and embodiment one is that this embodiment uses the public key in the security key to encrypt the write file one and uses the private key in the security key to decrypt the read file one, which is achieved through the following steps: hijacking the function call unified interface of the environment system, and replacing the address of the function call unified interface with the kernel encryption address; when the trusted software writes the file, calling and executing the system call function required for writing the write file one in the kernel encryption address to obtain the write data; using the public key in the security key to encrypt the write data; when the trusted software reads the file, calling and executing the system call function required for reading the read file one in the kernel decryption address to obtain the read data; using the public key in the security key to decrypt the read data.

[0076] Among them, the function call unified interface of the hijacked environment system is replaced with the kernel encryption address and kernel decryption address by the address of the function call unified interface. The specific process is: use the kprobe probe to find the location of the unified interface x64_sys_call, hijack the interface, and replace the interface address with the kernel encryption address and kernel decryption address unified by the kernel encryption module and the kernel decryption module in the kernel character device driver module, so as to monitor all system calls in the current environment, and manage the system calls that need to be used according to the system call number, such as using the call labels of read and write to control read and write. When reading and writing files, the unified interface can be sent to the interface of the kernel character device driver module to decrypt and read and encrypt and write the trusted files.

[0077] This embodiment hijacks the unified function call interface, so that the system call function to be controlled can be adjusted according to the kernel security policy, without recording too many system call addresses, and can better control the encryption and decryption operations during the file reading and writing process of the trusted software.

[0078] Embodiment 3

[0079] like Figure 2 As shown, a file transparent encryption and decryption system in a trusted computing environment includes a server, a client, an extended listening module located in the client, and a kernel character device driver module located in the client. When the client communicates with the kernel character driver module, the kernel character driver module sets a socket through the netlink technology, and then connects to the set socket for communication when the client starts. The client and the kernel character driver module can achieve data communication interaction in this way.

[0080] The server is used to configure and send a server security policy, wherein the server security policy includes a security key, a trusted software list, and an encryption file determination rule.

[0081] The client is used to receive the server security policy and send the server security policy to the extended monitoring module;

[0082] The extended monitoring module is used to kernelize the server security policy, obtain the kernel security policy, and send the kernel security policy to the kernel character device driver module; based on the trusted software list, add a trusted label in the startup process of the trusted software.

[0083] The kernel character device driver module is used to distinguish between write file one that needs to be encrypted, write file two that does not need to be encrypted, read file one that needs to be decrypted, and read file two that does not need to be decrypted in the trusted software based on the trusted label and the encrypted file judgment rules; use the public key in the security key to encrypt the write file one, and use the private key in the security key to decrypt the read file one.

[0084] Among them, the kernel character device driver module includes a kernel encryption module and a kernel decryption module. The kernel encryption module is used to encrypt the write file one using the public key in the security key; the kernel decryption module is used to decrypt the read file one using the private key in the security key.

[0085] Since the file transparent encryption and decryption system of this embodiment executes the file transparent encryption and decryption method in the trusted computing environment described in Embodiment 1 or Embodiment 2, the file transparent encryption and decryption method will not be repeated.

[0086] The above is only a preferred embodiment of the present invention, and is not any formal or substantial limitation of the present invention. It should be pointed out that ordinary technicians in this technical field can make several improvements and supplements without departing from the method of the present invention, and these improvements and supplements should also be regarded as the protection scope of the present invention. Any technician familiar with this profession, without departing from the spirit and scope of the present invention, can make some changes, modifications and evolutions of the technical content disclosed above, which are equivalent embodiments of the present invention; at the same time, any changes, modifications and evolutions of any equivalent changes made to the above embodiments based on the essential technology of the present invention are still within the scope of the technical solution of the present invention.

Claims

1. A method for transparent encryption and decryption of files in a trusted environment, characterized in that: The following steps are involved: Receiving a server security policy configured by a server, and performing kernelization processing on the server security policy to obtain a kernel security policy, wherein the server security policy includes a security key, a trusted software list, and an encrypted file determination rule; Based on the trusted software list, adding a trusted tag in the startup process of the trusted software; Based on the trust label and the encryption file determination rule, distinguish between a write file 1 that needs to be encrypted, a write file 2 that does not need to be encrypted, a read file 1 that needs to be decrypted, and a read file 2 that does not need to be decrypted in the trust software; The write file 1 is encrypted using the public key in the security key, and the read file 1 is decrypted using the private key in the security key.

2. According to the method for transparent encryption and decryption of files in a trust-based environment as described in claim 1, it is characterized in that: Using the public key in the security key to encrypt the write file 1 includes the following steps: Hijacking the system function call table of the environment system, and replacing the address of the relevant system call function in the system function call table with the kernel encrypted address; When the trusted software writes a file, the system call function required for writing the file is called and executed in the kernel encryption address to obtain the written data; The write data is encrypted using a public key in the security key.

3. According to the method for transparent encryption and decryption of files in a trusted environment as described in claim 2, it is characterized in that: Hijacking the system function call table of the environment system and replacing the address of the relevant system call function in the system function call table with the kernel encrypted address includes the following steps: Use the addressing function to search the system function call table, and according to the system call number, search the specific address of the write function in the system call table; The specific address one is hijacked, and the specific address one is replaced with a kernel encrypted address.

4. According to the method for transparent encryption and decryption of files in a trust-based environment as described in claim 1, it is characterized in that: The process of decrypting the read file 1 using the private key in the security key includes the following steps: Hijacking the system function call table of the environment system, and replacing the address of the relevant system call function in the system function call table with the kernel decryption address; When the trusted software reads a file, the system call function required for reading the file is called and executed in the kernel decryption address to obtain the read data; The read data is decrypted using the public key in the security key.

5. According to the method for transparent encryption and decryption of files in a trusted environment as described in claim 4, it is characterized in that: Hijacking the system function call table of the environment system and replacing the address of the relevant system call function in the system function call table with the kernel decryption address includes the following steps: Using the addressing function to search the system function call table, and according to the system call number, searching the specific address of the read function in the system call table; Hijack the specific address two, and replace the specific address two with the kernel decryption address.

6. According to a method for transparent encryption and decryption of files in a trusted environment as described in claim 1, it is characterized in that: The method of encrypting the write file 1 using the public key in the security key and decrypting the read file 1 using the private key in the security key includes the following steps: Hijacking the function call unified interface of the environment system, and replacing the address of the function call unified interface with the kernel encryption address and the kernel decryption address; When the trusted software writes a file, the system call function required for writing the file is called and executed in the kernel encryption address to obtain the written data; Encrypting the written data using a public key in the security key; When the trusted software reads a file, the system call function required for reading the file is called and executed in the kernel decryption address to obtain the read data; The read data is decrypted using the public key in the security key.

7. According to a method for transparent encryption and decryption of files in a trusted environment as described in claim 1, it is characterized in that: The following steps are also included: Record the reading process data generated when the trusted software reads the reading file, and encrypt the reading process data.

8. A method for transparent encryption and decryption of files in a trusted environment according to any one of claims 1 to 7, characterized in that: The encrypted file determination rule is a determination rule generated by any one of the determination conditions of determining the encrypted file based on an encrypted file suffix list, determining the encrypted file based on keyword matching, determining the encrypted file based on a regular expression, or determining the encrypted file based on a related path configuration list.

9. A method for transparent encryption and decryption of files in a trusted environment according to any one of claims 1 to 7, characterized in that: The kernelization process comprises the following steps: Parsing the server security policy and extracting kernel requirement data; Fill the kernel requirement data with a structure to generate a kernel security policy.

10. A file transparent encryption and decryption system in a trusted environment, characterized in that: The file transparent encryption and decryption system implements the file transparent encryption and decryption method in the information innovation environment described in any one of claims 1 to 9, including a server, a client, an extended listening module located in the client, and a kernel character device driver module located in the client; The server is used to configure and send a server security policy, wherein the server security policy includes a security key, a trusted software list, and an encrypted file determination rule; The client is used to receive the server security policy and send the server security policy to the extended monitoring module; The extended monitoring module is used to perform kernel processing on the server security policy to obtain the kernel security policy, and send the kernel security policy to the kernel character device driver module; based on the trusted software list, add a trusted label in the startup process of the trusted software; The kernel character device driver module is used to distinguish between write file one that needs to be encrypted, write file two that does not need to be encrypted, read file one that needs to be decrypted, and read file two that does not need to be decrypted in the trusted software based on the trusted label and the encrypted file judgment rules; use the public key in the security key to encrypt the write file one, and use the private key in the security key to decrypt the read file one.

Images