Virtual disk encryption method and device based on Ukey

Abstract

The present invention belongs to the field of information security technology and discloses a virtual disk encryption method and device based on Ukey. The method comprises: after detecting Ukey access, creating a virtual disk partition, generating a blank image file according to input file information, and writing the encrypted information obtained by encrypting the symmetric encryption key generated by the secure random number generator using the preset file content structure and the encryption certificate derived by the Ukey into the blank image file, and finally using the symmetric encryption key to encrypt the formatted file data in the file system to obtain ciphertext data and combine it with the preset file content structure written above to generate an encrypted disk image file. The UKey device is used to realize the separation management of keys and data. The keys are stored in the UKey and a physical chip is used to protect the keys, which greatly reduces the risk of key leakage and improves data security. At the same time, the encrypted image file data in a unified format can be seamlessly used between different platforms, with higher flexibility and convenience.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a virtual disk encryption method and device based on Ukey. Background Art

[0002] Currently, most systems in this field use default file encryption to protect data on disk using symmetric encryption technology (usually symmetric encryption algorithms such as AES), and use access control and user permissions to limit which users or groups can view, modify, and delete files.

[0003] The disadvantage of this type of encryption method is that it uses account passwords or key files to protect data. Key management is difficult and once leaked, if the user forgets the decryption password or loses the key file, it will become very difficult or even impossible to recover the encrypted data.

[0004] The above content is only used to assist in understanding the technical solution of the present invention and does not constitute an admission that the above content is prior art. Summary of the Invention

[0005] The main purpose of the present invention is to provide a virtual disk encryption method and device based on Ukey, which aims to solve the technical problem that the current encryption methods have the disadvantages of using account passwords or key files to protect data, the key management is difficult and once leaked, if the user forgets the decryption password or loses the key file when using it, then recovering the encrypted data will become very difficult or even impossible.

[0006] To achieve the above object, the present invention provides a virtual disk encryption method based on Ukey, which includes the following steps:

[0007] After detecting the Ukey connection, receive the virtual disk partition creation request;

[0008] Creating a virtual disk partition based on the virtual disk partition creation request;

[0009] Generate a blank image file based on the input file information, and write a preset file content structure into the blank image file to obtain a first image file, wherein the file information includes an image file name, an image file path, and an image file size;

[0010] Export the encryption certificate from the connected Ukey;

[0011] Generate symmetric encryption keys using a secure random number generator;

[0012] Encrypting the symmetric encryption key based on the encryption certificate, and writing the encrypted information obtained after encryption into the first image file to obtain a second image file;

[0013] Mounting the second image file to a file system using a disk drive corresponding to the virtual disk partition for formatting, and after the file system is formatted, decrypting the symmetric encryption key from the second image file, and encrypting the formatted file data in the file system using the symmetric encryption key to obtain ciphertext data;

[0014] The ciphertext data is written into the second image file to generate an encrypted disk image file.

[0015] In some embodiments, encrypting the symmetric encryption key based on the encryption certificate and writing the encrypted information obtained after encryption into the first image file includes:

[0016] Determining the encryption algorithm corresponding to the encryption certificate;

[0017] If the encryption algorithm is the SM2 encryption algorithm, the symmetric encryption key is encrypted using the SM2 asymmetric encryption algorithm, and after the encryption is completed, the asymmetric encryption algorithm parameters, the length of the asymmetric encryption algorithm parameters, the symmetric encryption key and associated parameters, and the length of the symmetric encryption key and associated parameters are written into the first image file, wherein the encryption structure of the symmetric encryption key includes a 16-byte key, a 4-byte counter bit occupancy, and a 32-byte formatting vector.

[0018] In some embodiments, writing the ciphertext data into the second image file includes:

[0019] Filling an isolation band in the second image file, wherein the isolation band has a size of 1024 bytes;

[0020] The ciphertext data is filled after the isolation band.

[0021] In some embodiments, the method further comprises:

[0022] Determine whether the Ukey is accessed for the first time;

[0023] If it is the first access, the step of receiving the virtual disk partition creation request is performed;

[0024] If it is not the first access, the stored encrypted disk image file is decrypted to obtain the decrypted file data;

[0025] A write request is received, the decrypted file data is updated based on the write request, and the updated file data is re-encrypted.

[0026] In some embodiments, decrypting the stored encrypted disk image file includes:

[0027] Receive the input image file path and the virtual disk partition to be mounted;

[0028] Obtaining the stored encrypted disk image file according to the image file path;

[0029] Mapping the stored encrypted disk image file to the virtual disk partition, and performing format parsing and conversion on the encrypted data in the stored encrypted disk image file to obtain structured format data;

[0030] Receiving a read request, and obtaining a certificate key pair matching the Ukey through the virtual disk partition based on the read request;

[0031] The structured format data is decrypted based on the certificate key to obtain decrypted file data.

[0032] In some embodiments, the method further comprises:

[0033] Obtaining header information of the stored encrypted disk image file;

[0034] Verifying the stored encrypted disk image file based on the header information;

[0035] If the verification passes, the step of mapping the stored encrypted disk image file to the virtual disk partition is performed;

[0036] Accordingly, the method further comprises:

[0037] If the certificate key pair that matches the Ukey is not obtained, or the obtained certificate key pair does not match the Ukey, the user is reminded that the file data decryption loading failed.

[0038] In some embodiments, updating the decrypted file data based on the write request and re-encrypting the updated file data includes:

[0039] Obtaining a corresponding symmetric encryption key and updated file information based on the write request;

[0040] updating the decrypted file data based on the updated file information;

[0041] Encrypting the updated file data based on the symmetric encryption key to obtain new ciphertext data;

[0042] The new ciphertext data is formatted and stored to obtain an updated encrypted disk image file.

[0043] In addition, to achieve the above-mentioned purpose, the present invention also proposes a virtual disk encryption device based on Ukey, and the virtual disk encryption device based on Ukey includes:

[0044] The request receiving module is used to receive a virtual disk partition creation request after detecting that the Ukey is connected;

[0045] A partition creation module, configured to create a virtual disk partition based on the virtual disk partition creation request;

[0046] A file generation module, configured to generate a blank image file based on input file information, and write a preset file content structure into the blank image file to obtain a first image file, wherein the file information includes an image file name, an image file path, and an image file size;

[0047] The certificate acquisition module is used to export the encryption certificate from the connected Ukey;

[0048] A key generation module, configured to generate symmetric encryption keys using a secure random number generator;

[0049] A file encryption module, configured to encrypt the symmetric encryption key based on the encryption certificate, and write the encrypted information obtained after encryption into the first image file to obtain a second image file;

[0050] The file encryption module is configured to mount the second image file to a file system using a disk drive corresponding to the virtual disk partition for formatting, and after the file system is formatted, decrypt the symmetric encryption key from the second image file, and encrypt the formatted file data in the file system using the symmetric encryption key to obtain ciphertext data;

[0051] The file generation module is used to write the ciphertext data into the second image file to generate an encrypted disk image file.

[0052] In some embodiments, the file encryption module is used to determine the encryption algorithm corresponding to the encryption certificate;

[0053] If the encryption algorithm is the SM2 encryption algorithm, the symmetric encryption key is encrypted using the SM2 asymmetric encryption algorithm, and after the encryption is completed, the asymmetric encryption algorithm parameters, the length of the asymmetric encryption algorithm parameters, the symmetric encryption key and associated parameters, and the length of the symmetric encryption key and associated parameters are written into the first image file, wherein the encryption structure of the symmetric encryption key includes a 16-byte key, a 4-byte counter bit occupancy, and a 32-byte formatting vector.

[0054] In some embodiments, the file generation module is configured to fill an isolation band in the second image file, wherein the isolation band has a size of 1024 bytes;

[0055] The ciphertext data is filled after the isolation band.

[0056] The present invention receives a virtual disk partition creation request after detecting Ukey access; creates a virtual disk partition based on the virtual disk partition creation request; generates a blank image file based on the input file information, and writes a preset file content structure into the blank image file to obtain a first image file; derives an encryption certificate from the connected Ukey; generates a symmetric encryption key using a secure random number generator; encrypts the symmetric encryption key based on the encryption certificate, and writes the encrypted information obtained after encryption into the first image file to obtain a second image file; mounts the second image file to a file system using a disk drive corresponding to the virtual disk partition for formatting, and after the file system is formatted, decrypts the symmetric encryption key from the second image file, and uses the symmetric encryption key to encrypt the formatted file data in the file system to obtain ciphertext data; writes the ciphertext data into the second image file to generate an encrypted disk image file. The UKey device is used to realize the separation management of keys and data. The keys are stored in the UKey, and a physical chip is used to protect the keys, which greatly reduces the risk of key leakage and improves data security. At the same time, the encrypted image file data in a unified format can be seamlessly used between different platforms, with higher flexibility and convenience. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a flowchart of the first embodiment of the virtual disk encryption method based on Ukey of the present invention;

[0058] Figure 2 This is a schematic diagram of the functional modules in the virtual disk encryption method based on Ukey of the present invention;

[0059] Figure 3 This is a schematic diagram of the user operation interface in the virtual disk encryption method based on Ukey of the present invention;

[0060] Figure 4 A schematic diagram of creating a virtual encrypted disk partition and file system data mapping in the virtual disk encryption method based on Ukey of the present invention;

[0061] Figure 5 This is a flowchart of the overall solution for mounting a virtual encrypted disk in the virtual disk encryption method based on Ukey of the present invention;

[0062] Figure 6 This is a structural block diagram of the first embodiment of the virtual disk encryption device based on Ukey of the present invention.

[0063] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0064] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0065] The embodiment of the present invention provides a virtual disk encryption method based on Ukey, referring to Figure 1 , Figure 1 This is a flow chart of a first embodiment of a virtual disk encryption method based on Ukey according to the present invention.

[0066] In this embodiment, the virtual disk encryption method based on Ukey includes the following steps:

[0067] Step S10: After detecting that the Ukey is connected, a virtual disk partition creation request is received.

[0068] In this embodiment, the executor of this embodiment is a Ukey-based virtual disk encryption device, wherein the Ukey-based virtual disk encryption device has functions such as data processing, data communication and program running. The Ukey-based virtual disk encryption device can be a computer terminal device or other network device, and of course it can also be other devices with similar functions. This embodiment does not limit this.

[0069] It should be noted that the disadvantage of current encryption methods is that they all use account passwords or key files to protect data. Key management is difficult and once leaked, if the user forgets the decryption password or loses the key file, then recovering the encrypted data will become very difficult or even impossible.

[0070] In order to solve the above technical problems, in this embodiment, after detecting that Ukey is connected, a virtual disk partition creation request is received; a virtual disk partition is created based on the virtual disk partition creation request; a blank image file is generated based on the input file information, and a preset file content structure is written into the blank image file to obtain a first image file; an encryption certificate is derived from the connected Ukey; a symmetric encryption key is generated using a secure random number generator; the symmetric encryption key is encrypting based on the encryption certificate, and the encrypted information obtained after encryption is written into the first image file to obtain a second image file; the second image file is mounted to the file system using the disk drive corresponding to the virtual disk partition. The row is formatted, and after the file system is formatted, the symmetric encryption key is decrypted from the second image file, and the formatted file data in the file system is encrypted using the symmetric encryption key to obtain ciphertext data; the ciphertext data is written into the second image file to generate an encrypted disk image file. The UKey device is used to realize the separation management of keys and data. The keys are stored in the UKey, and a physical chip is used to protect the keys, which greatly reduces the risk of key leakage and improves data security. At the same time, the encrypted image file data in a unified format can be seamlessly used between different platforms, with higher flexibility and convenience. Specifically, it can be implemented as follows.

[0071] In the specific implementation, the overall functional structure of the solution is first described in this embodiment, and the specific Figure 2 As shown, Figure 2It is divided into user space and kernel space. Regarding user space, users can use virtual disk tools to create virtual disk encryption files, set the file name of the image file, the path where the file is stored, the size of the space used for the image file, and select the encryption certificate for protection. Multiple encryption certificates can be selected, and multiple certificates can be obtained in other ways. Selecting multiple encryption certificates means supporting simultaneous sharing by multiple people, as well as setting the encryption symmetric algorithm. The symmetric algorithm is the national encryption algorithm SM4, and the working mode uses CTR. After determining the above parameters, click the confirmation button to generate the image file. Regarding kernel space, it is implemented through a virtual disk encryption driver, which is mainly used for key generation, data encryption, and the generation and management of the final image file. It is also linked to the file system to use virtual disks to store encrypted data. The virtual disk user tool is a tool provided to users that allows them to create and mount encrypted disks. The virtual disk encryption driver is the kernel of the operating system, responsible for implementing the core processing logic of disk encryption. It includes submodules such as the disk device management module, key management module, encryption module, and image file management module. The disk device management module is responsible for handling general disk logic, such as disk initialization, opening, closing, and exception processing. The key management module is responsible for communicating with UKey and processing key-related information. The encryption module is responsible for implementing encryption and decryption algorithms, providing highly secure algorithm core logic functions. The image file management module is responsible for implementing encrypted disk file format conversion, data file writing and reading, and other operations.

[0072] The user interface corresponding to the above user space and kernel space and the process of creating a virtual encrypted disk partition can be referred to respectively. Figure 3 and Figure 4 As shown. Figure 3 As shown, the interface includes multiple functional options. The first is a file selection button that allows users to select an image file path in write / create mode. For the selection box of the symmetric key algorithm, users can choose symmetric encryption algorithms such as SM4-CTR. The disk space size is filled in manually by the operator, and the unit can be modified through the selection box, supporting MB and GB units. In addition, there are two buttons, "Add from File" and "Add from U-Key", through which users can add encryption certificates. The added certificate will be displayed in the certificate grid, including information such as the certificate subject name, certificate type, and validity period. Finally, the purpose of the Load Partition button is to help users select the disk partition to be encrypted and include its contents in the encryption process to ensure that all data in the selected partition is protected. This button ensures that users can easily load and process partitions, and the disk data required to perform encryption tasks can be added to the overall structure of the encrypted disk in a timely manner. Reference Figure 4As shown in the figure, after a user initiates a partition creation request, the virtual disk user tool creates the corresponding partition based on the preset disk size. It then initializes the file system using virtual disk encryption. After initialization, the initialized file system data is encrypted and stored in an image file. The corresponding virtual disk partition is then mapped to the file system, allowing the user to view the virtual disk partition associated with the file system. To create a disk partition, the user uses the virtual disk user tool to initiate a disk partition creation request, which is then processed by the virtual disk encryption driver. To initialize a virtual disk partition, the virtual disk encryption driver interacts with the file system driver to initialize a new virtual disk partition and file system data. To initialize the file system, the virtual disk driver sends the initialization data to the virtual disk driver via a write request after the file system is formatted. A secure random number is used to generate a symmetric key E1. The symmetric key is used to encrypt the file system formatted data to generate FileSystemEnc. The generated symmetric key E1 is then encrypted using the asymmetric key E2 from the encryption certificate. The algorithm uses the certificate algorithm. If the certificate is an SM2 certificate, the SM2 algorithm is used to encrypt the symmetric key to generate KeyEncryptedData, where KeyEncryptedData = Enc(E2, E1). After the encryption is completed, FileSystemEnc, KeyEncryptedData, the length of the asymmetric encryption algorithm parameters, the asymmetric encryption algorithm parameters, the length of the result of encrypting the symmetric key and related parameters, and the result of encrypting the symmetric key and related parameters are written to the image file. Mapping the file system: virtual disk driver, calling the UKey interface, the user enters the password, decrypting the symmetric key for encrypting the file system data, activating the key management module and the encryption module. The file system maps the disk partition to the file system of the operating system, and the user can access the disk partition normally. Display virtual partitions: users can see and access the newly created disk partition and start using the encrypted partition. In addition, the overall flow diagram of this solution combined with the above two processes can be referred to Figure 5 shown.

[0073] Specifically, in this embodiment, it is necessary to detect the access of Ukey first. After detecting the access of Ukey, it is necessary to detect whether the Ukey is accessed for the first time. If it is the first time, an encrypted disk image file needs to be generated to receive a virtual disk partition creation request.

[0074] Step S20: creating a virtual disk partition based on the virtual disk partition creation request.

[0075] After receiving the virtual disk partition request, the disk size is determined, and then the corresponding virtual disk partition is created according to the disk size. The disk size can be determined based on the size of the encrypted disk image file to be created. The file size can be MB or GB. The specific size can be set according to actual needs, and there is no restriction on this in this embodiment.

[0076] Step S30: Generate a blank image file based on the input file information, and write the preset file content structure into the blank image file to obtain a first image file.

[0077] The input file information in this embodiment includes the image file name, the image file path, and the image file size. Based on this information, a blank image file can be generated in this embodiment. The blank image file contains no file data and is not encrypted. Then, the preset file content structure is absorbed into the blank image file to obtain a first image file. The preset file content structure can be shown in Table 1 below.

[0078] Table 1:

[0079]

[0080]

[0081] The structure of the encrypted image file also consists of two parts, the first part is the file header, followed by the encrypted file body. In the encrypted image file, all integers use big-endian order and all lengths are in bytes.

[0082] Step S40: Export the encryption certificate from the connected Ukey.

[0083] In this embodiment, the key is stored in the Ukey device. Each connected Ukey has its corresponding encryption certificate, from which the corresponding encryption certificate can be derived.

[0084] Step S50: Generate a symmetric encryption key using a secure random number generator.

[0085] Step S60: Encrypt the symmetric encryption key based on the encryption certificate, and write the encrypted information obtained after encryption into the first image file to obtain a second image file.

[0086] Specifically, the encryption certificate has its corresponding encryption algorithm, such as the SM2 encryption algorithm. If it is the SM2 encryption algorithm, after encrypting the symmetric encryption key, the asymmetric encryption algorithm parameters, the length of the asymmetric encryption algorithm parameters, the symmetric encryption key and associated parameters, and the length of the symmetric encryption key and associated parameters are written into the first mirror file, thereby obtaining the second mirror file.

[0087] Step S70: Mount the second image file to the file system using the disk drive corresponding to the virtual disk partition for formatting. After the file system is formatted, decrypt the symmetric encryption key from the second image file, and use the symmetric encryption key to encrypt the formatted file data in the file system to obtain ciphertext data.

[0088] In a specific implementation, in this embodiment, the second image file is mounted to the file system using the disk drive corresponding to the virtual disk partition for formatting. Then, when encrypting, the symmetric encryption key is first encrypted from the second image file, and then the formatted data is encrypted.

[0089] Step S80: writing the ciphertext data into the second image file to generate an encrypted disk image file.

[0090] It should be noted that, in order to further improve data security, an isolation band is provided in this embodiment, and the isolation band is filled in the second image file. The isolation band size is 1024 bytes, and referring to the above-mentioned preset file content structure, it can be seen that the ciphertext data is filled after the isolation band.

[0091] For example, after the file system formats the disk, the virtual disk encryption driver uses the symmetric key to encrypt the file system initialization data content, generating the encrypted file body FileSystemEnc. The isolation band is filled in the image file, and the ciphertext data FileSystemEnc is filled in.

[0092] Furthermore, the above is for the first access situation. If the encrypted disk image file has been generated, the user can directly view it without repeating the above creation process. When viewing, decryption is required first. The decryption process is specifically to receive the input image file path and the virtual disk partition to be mounted; obtain the stored encrypted disk image file according to the image file path; map the stored encrypted disk image file to the virtual disk partition, and perform format parsing and conversion on the encrypted data in the stored encrypted disk image file to obtain structured format data; receive a read request, and obtain the certificate key pair that matches the Ukey through the virtual disk partition based on the read request; decrypt the structured format data based on the certificate key to obtain the decrypted file data.

[0093] It should be noted that decryption and encryption are opposite processes. Since encryption maps the file data of the virtual disk to the file system, during decryption, structured format data can be obtained based on the virtual disk partition that needs to be mounted. Since the key is stored in the Ukey device, when the structured format data is finally decrypted, the certificate key pair that matches the Ukey is required to complete the decryption.

[0094] In this embodiment, a verification process is also required. Specifically, the header information of the stored encrypted disk image file is obtained; the stored encrypted disk image file is verified based on the header information; if the verification passes, the subsequent decryption operation is performed. In actual situations, there may be situations where the certificate key pair that matches the Ukey is not obtained, or the obtained certificate key pair does not match the Ukey. In this case, the user will be reminded that the file data decryption loading failed. The mismatch can be determined by comparing the key identifier of the certificate key pair with the device identifier of the Ukey device.

[0095] Furthermore, when the user needs to modify the data, this embodiment will first receive a write request, obtain the corresponding symmetric encryption key and updated file information based on the write request, update the decrypted file data based on the updated file information; encrypt the updated file data based on the symmetric encryption key to obtain new ciphertext data; format and store the new ciphertext data to obtain an updated encrypted disk image file. Through the above method, real-time encryption can be achieved after the modification, and it should be emphasized that the modification process is after the viewing process. Therefore, when the user has no permission to view, he has no permission to modify. The viewing permission is limited to the certificate key pair stored in the connected Ukey device. This method can avoid the leakage of file data and prevent the file data from being tampered with.

[0096] In this embodiment, after detecting the access of Ukey, a virtual disk partition creation request is received; a virtual disk partition is created based on the virtual disk partition creation request; a blank image file is generated based on the input file information, and a preset file content structure is written into the blank image file to obtain a first image file; an encryption certificate is derived from the connected Ukey; a symmetric encryption key is generated using a secure random number generator; the symmetric encryption key is encrypted based on the encryption certificate, and the encrypted information obtained after encryption is written into the first image file to obtain a second image file; the second image file is mounted to the file system using the disk drive corresponding to the virtual disk partition for formatting, and after the file system is formatted, the symmetric encryption key is decrypted from the second image file, and the formatted file data in the file system is encrypted using the symmetric encryption key to obtain ciphertext data; the ciphertext data is written into the second image file to generate an encrypted disk image file. The UKey device is used to realize the separation management of keys and data. The keys are stored in the UKey and a physical chip is used to protect the keys, which greatly reduces the risk of key leakage and improves data security. At the same time, the encrypted image file data in a unified format can be seamlessly used between different platforms, with higher flexibility and convenience.

[0097] Reference Figure 6 , Figure 6 This is a structural block diagram of the first embodiment of the virtual disk encryption device based on Ukey of the present invention.

[0098] like Figure 6 As shown, the Ukey-based virtual disk encryption device proposed in an embodiment of the present invention includes:

[0099] The request receiving module 10 is used to receive a virtual disk partition creation request after detecting that the Ukey is connected;

[0100] A partition creation module 20, configured to create a virtual disk partition based on the virtual disk partition creation request;

[0101] A file generation module 30 is configured to generate a blank image file based on the input file information, and write a preset file content structure into the blank image file to obtain a first image file, wherein the file information includes an image file name, an image file path, and an image file size;

[0102] The certificate acquisition module 40 is used to derive the encryption certificate from the connected Ukey;

[0103] A key generation module 50 is used to generate a symmetric encryption key using a secure random number generator;

[0104] A file encryption module 60 is configured to encrypt the symmetric encryption key based on the encryption certificate, and write the encrypted information obtained after encryption into the first image file to obtain a second image file;

[0105] The file encryption module 60 is configured to mount the second image file to a file system using a disk drive corresponding to the virtual disk partition for formatting, and after the file system is formatted, decrypt the symmetric encryption key from the second image file, and encrypt the formatted file data in the file system using the symmetric encryption key to obtain ciphertext data;

[0106] The file generation module 30 is configured to write the ciphertext data into the second image file to generate an encrypted disk image file.

[0107] In this embodiment, after detecting the access of Ukey, a virtual disk partition creation request is received; a virtual disk partition is created based on the virtual disk partition creation request; a blank image file is generated based on the input file information, and a preset file content structure is written into the blank image file to obtain a first image file; an encryption certificate is derived from the connected Ukey; a symmetric encryption key is generated using a secure random number generator; the symmetric encryption key is encrypted based on the encryption certificate, and the encrypted information obtained after encryption is written into the first image file to obtain a second image file; the second image file is mounted to the file system using the disk drive corresponding to the virtual disk partition for formatting, and after the file system is formatted, the symmetric encryption key is decrypted from the second image file, and the formatted file data in the file system is encrypted using the symmetric encryption key to obtain ciphertext data; the ciphertext data is written into the second image file to generate an encrypted disk image file. The UKey device is used to realize the separation management of keys and data. The keys are stored in the UKey and a physical chip is used to protect the keys, which greatly reduces the risk of key leakage and improves data security. At the same time, the encrypted image file data in a unified format can be seamlessly used between different platforms, with higher flexibility and convenience.

[0108] In some embodiments, the file encryption module 60 is used to determine the encryption algorithm corresponding to the encryption certificate;

[0109] If the encryption algorithm is the SM2 encryption algorithm, the symmetric encryption key is encrypted using the SM2 asymmetric encryption algorithm, and after the encryption is completed, the asymmetric encryption algorithm parameters, the length of the asymmetric encryption algorithm parameters, the symmetric encryption key and associated parameters, and the length of the symmetric encryption key and associated parameters are written into the first image file, wherein the encryption structure of the symmetric encryption key includes a 16-byte key, a 4-byte counter bit occupancy, and a 32-byte formatting vector.

[0110] In some embodiments, the file generation module 30 is configured to fill an isolation band in the second image file, wherein the isolation band has a size of 1024 bytes;

[0111] The ciphertext data is filled after the isolation band.

[0112] In some embodiments, the device further includes a determination module and a file decryption module;

[0113] The judgment module is used to judge whether the Ukey is accessed for the first time;

[0114] The partition creation module 20 is configured to execute the step of receiving a virtual disk partition creation request if it is the first access;

[0115] The file decryption module is used to decrypt the stored encrypted disk image file to obtain the decrypted file data if it is not the first access;

[0116] The file encryption module 60 is configured to receive a write request, update the decrypted file data based on the write request, and re-encrypt the updated file data.

[0117] In some embodiments, the file decryption module is used to receive an input image file path and a virtual disk partition to be mounted;

[0118] Obtaining the stored encrypted disk image file according to the image file path;

[0119] Mapping the stored encrypted disk image file to the virtual disk partition, and performing format parsing and conversion on the encrypted data in the stored encrypted disk image file to obtain structured format data;

[0120] Receiving a read request, and obtaining a certificate key pair matching the Ukey through the virtual disk partition based on the read request;

[0121] The structured format data is decrypted based on the certificate key to obtain decrypted file data.

[0122] In some embodiments, the apparatus further comprises a verification module;

[0123] The verification module is used to obtain the header information of the stored encrypted disk image file;

[0124] Verifying the stored encrypted disk image file based on the header information;

[0125] The file decryption module is configured to execute the step of mapping the stored encrypted disk image file to the virtual disk partition if the verification passes;

[0126] Accordingly, the device further includes an alarm reminder module:

[0127] The alarm reminder module is used to remind the user that the file data decryption loading fails if the certificate key pair matching the Ukey is not obtained, or the obtained certificate key pair does not match the Ukey.

[0128] In some embodiments, the file encryption module 60 is configured to obtain a corresponding symmetric encryption key and updated file information based on the write request;

[0129] updating the decrypted file data based on the updated file information;

[0130] Encrypting the updated file data based on the symmetric encryption key to obtain new ciphertext data;

[0131] The new ciphertext data is formatted and stored to obtain an updated encrypted disk image file.

[0132] An embodiment of the present application also provides a Ukey-based virtual disk encryption device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus, and the memory is used to store a Ukey-based virtual disk encryption program; the processor is used to implement the above-mentioned Ukey-based virtual disk encryption method when executing the program stored in the memory.

[0133] The communication bus mentioned in the Ukey-based virtual disk encryption device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0134] The communication interface is used for communication between the Ukey-based virtual disk encryption device and other devices.

[0135] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage. Alternatively, the memory may be at least one storage device located remote from the processor.

[0136] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0137] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0138] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0139] Each embodiment in this specification is described in a related manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiment is generally similar to the method embodiment, so the description is relatively simple. For related parts, refer to the description of the method embodiment.

[0140] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

[0141] It should be understood that the above is only an example and does not constitute any limitation to the technical solution of the present invention. In specific applications, those skilled in the art can make settings as needed, and the present invention does not impose any limitation on this.

[0142] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of it according to actual needs to achieve the purpose of the embodiment scheme, and no limitation is made here.

[0143] In addition, for technical details not fully described in this embodiment, please refer to the Ukey-based virtual disk encryption method provided in any embodiment of the present invention, and will not be repeated here.

[0144] In addition, it should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0145] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0146] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, or of course by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0147] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0148] It is understandable that the system provided by the embodiment of the present invention corresponds to the method provided by the embodiment of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts of the above method.

Claims

1. A virtual disk encryption method based on Ukey, characterized in that: The virtual disk encryption method based on Ukey includes: After detecting the Ukey connection, receive the virtual disk partition creation request; Creating a virtual disk partition based on the virtual disk partition creation request; Generate a blank image file based on the input file information, and write a preset file content structure into the blank image file to obtain a first image file, wherein the file information includes an image file name, an image file path, and an image file size; Export the encryption certificate from the connected Ukey; Generate symmetric encryption keys using a secure random number generator; Encrypting the symmetric encryption key based on the encryption certificate, and writing the encrypted information obtained after encryption into the first image file to obtain a second image file; Mounting the second image file to a file system using a disk drive corresponding to the virtual disk partition for formatting, and after the file system is formatted, decrypting the symmetric encryption key from the second image file, and encrypting the formatted file data in the file system using the symmetric encryption key to obtain ciphertext data; The ciphertext data is written into the second image file to generate an encrypted disk image file.

2. The virtual disk encryption method based on Ukey according to claim 1, characterized in that: The encrypting the symmetric encryption key based on the encryption certificate and writing the encrypted information obtained after encryption into the first image file includes: Determining the encryption algorithm corresponding to the encryption certificate; If the encryption algorithm is the SM2 encryption algorithm, the symmetric encryption key is encrypted using the SM2 asymmetric encryption algorithm, and after the encryption is completed, the asymmetric encryption algorithm parameters, the length of the asymmetric encryption algorithm parameters, the symmetric encryption key and associated parameters, and the length of the symmetric encryption key and associated parameters are written into the first image file, wherein the encryption structure of the symmetric encryption key includes a 16-byte key, a 4-byte counter bit occupancy, and a 32-byte formatting vector.

3. The virtual disk encryption method based on Ukey according to claim 1, characterized in that: Writing the ciphertext data into the second image file includes: Filling an isolation band in the second image file, wherein the isolation band has a size of 1024 bytes; The ciphertext data is filled after the isolation band.

4. The virtual disk encryption method based on Ukey according to claim 1, characterized in that: The method further comprises: Determine whether the Ukey is accessed for the first time; If it is the first access, the step of receiving the virtual disk partition creation request is performed; If it is not the first access, the stored encrypted disk image file is decrypted to obtain the decrypted file data; A write request is received, the decrypted file data is updated based on the write request, and the updated file data is re-encrypted.

5. The virtual disk encryption method based on Ukey according to claim 4, characterized in that: Decrypting the stored encrypted disk image file includes: Receive the input image file path and the virtual disk partition to be mounted; Obtaining the stored encrypted disk image file according to the image file path; Mapping the stored encrypted disk image file to the virtual disk partition, and performing format parsing and conversion on the encrypted data in the stored encrypted disk image file to obtain structured format data; Receiving a read request, and obtaining a certificate key pair matching the Ukey through the virtual disk partition based on the read request; The structured format data is decrypted based on the certificate key to obtain decrypted file data.

6. The virtual disk encryption method based on Ukey according to claim 5, characterized in that: The method further comprises: Obtaining header information of the stored encrypted disk image file; Verifying the stored encrypted disk image file based on the header information; If the verification passes, the step of mapping the stored encrypted disk image file to the virtual disk partition is performed; Accordingly, the method further comprises: If the certificate key pair that matches the Ukey is not obtained, or the obtained certificate key pair does not match the Ukey, the user is reminded that the file data decryption loading failed.

7. The virtual disk encryption method based on Ukey according to claim 5, characterized in that: The updating of the decrypted file data based on the write request and re-encrypting the updated file data includes: Obtaining a corresponding symmetric encryption key and updated file information based on the write request; updating the decrypted file data based on the updated file information; Encrypting the updated file data based on the symmetric encryption key to obtain new ciphertext data; The new ciphertext data is formatted and stored to obtain an updated encrypted disk image file.

8. A virtual disk encryption device based on Ukey, characterized in that: The virtual disk encryption device based on Ukey includes: The request receiving module is used to receive a virtual disk partition creation request after detecting that the Ukey is connected; A partition creation module, configured to create a virtual disk partition based on the virtual disk partition creation request; A file generation module, configured to generate a blank image file based on input file information, and write a preset file content structure into the blank image file to obtain a first image file, wherein the file information includes an image file name, an image file path, and an image file size; The certificate acquisition module is used to export the encryption certificate from the connected Ukey; A key generation module, configured to generate symmetric encryption keys using a secure random number generator; A file encryption module, configured to encrypt the symmetric encryption key based on the encryption certificate, and write the encrypted information obtained after encryption into the first image file to obtain a second image file; The file encryption module is configured to mount the second image file to a file system using a disk drive corresponding to the virtual disk partition for formatting, and after the file system is formatted, decrypt the symmetric encryption key from the second image file, and encrypt the formatted file data in the file system using the symmetric encryption key to obtain ciphertext data; The file generation module is used to write the ciphertext data into the second image file to generate an encrypted disk image file.

9. The virtual disk encryption device based on Ukey according to claim 8, characterized in that: The file encryption module is used to determine the encryption algorithm corresponding to the encryption certificate; If the encryption algorithm is the SM2 encryption algorithm, the symmetric encryption key is encrypted using the SM2 asymmetric encryption algorithm, and after the encryption is completed, the asymmetric encryption algorithm parameters, the length of the asymmetric encryption algorithm parameters, the symmetric encryption key and associated parameters, and the length of the symmetric encryption key and associated parameters are written into the first image file, wherein the encryption structure of the symmetric encryption key includes a 16-byte key, a 4-byte counter bit occupancy, and a 32-byte formatting vector.

10. The virtual disk encryption device based on Ukey according to claim 8, characterized in that: The file generation module is configured to fill an isolation band in the second image file, wherein the isolation band has a size of 1024 bytes; The ciphertext data is filled after the isolation band.

Images