Data integrity verification method and system for encrypted file system

Abstract

The invention discloses a data integrity verification method and system for an encrypted file system, and the method comprises the steps: carrying out the parallel response of an access request of a user mode through a data encryption and decryption module and an integrity verification module in the encrypted file system of a kernel mode; the file encryption system performs encryption operation on a plaintext data page of a written target file through a data encryption and decryption module to obtain a corresponding ciphertext data page, and performs integrity verification operation on the plaintext data page through an integrity verification module to obtain a corresponding plaintext data page verification tag; and organizing and storing a ciphertext data page and a plaintext data page verification tag in a specified format, storing the ciphertext data page and the plaintext data page verification tag in a bottom-layer file system in a file encryption manner, and writing the ciphertext data page and the plaintext data page verification tag into disk block equipment. The invention aims to systematically realize the functions of file encryption and data integrity verification, and can realize good performance, consistency and key management requirements on the basis of ensuring data security and integrity.

Description

Technical Field

[0001] The present invention relates to a data security technology belonging to the field of data storage, and in particular to a data integrity verification method and system for an encrypted file system. Background Art

[0002] In the digital information age, data integrity and security have become particularly important. With the popularization of the Internet and electronic communications, files may encounter various security threats during transmission and storage, such as data tampering, loss or damage. Therefore, developing effective data integrity verification methods is crucial to ensure the authenticity and integrity of information. Data integrity refers to the accuracy and consistency of data throughout its life cycle. This includes not only the accuracy of data when it is stored, but also the fact that the data has not been tampered with during transmission. For enterprises and individual users, data integrity is the basis for protecting privacy, maintaining business continuity and complying with laws and regulations. Traditional data integrity verification methods mainly include the use of cyclic redundancy check (CRC), checksum, hash function and other technologies. These methods can effectively detect whether the data has been modified, but they have limited applicability to encrypted files, especially when the checksum value remains unchanged after the encrypted file has been tampered with. For encrypted files, since their content has been encrypted and even additional metadata for file encryption has been introduced, conventional verification methods may not be directly applied to the encrypted data, and it is difficult to ensure the consistency between the file data and its checksum data. In addition, factors such as the selection of encryption algorithms and key management will also affect data integrity verification. Summary of the invention

[0003] Technical problem to be solved by the present invention: In view of the above-mentioned problems in the prior art, a data integrity verification method and system for an encrypted file system are provided. The present invention aims to systematically implement file encryption and data integrity verification functions, and on the basis of ensuring data security and integrity, can achieve good performance, consistency and key management requirements.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is: A data integrity verification method for an encrypted file system includes, in a kernel-state encrypted file system, using a data encryption and decryption module and an integrity verification module to respond to a user-state access request in parallel based on ciphertext data stored in an underlying file system; when the access request is to write data, the encrypted file system performs encryption operations on the plaintext data pages of a written target file through the data encryption and decryption module to obtain corresponding ciphertext data pages, and at the same time performs integrity verification operations on the plaintext data pages through the integrity verification module to obtain corresponding plaintext data page verification tags, organizes and stores the ciphertext data pages and their plaintext data page verification tags in a specified format, and saves them to the underlying file system in the form of encrypted files, and finally writes them to a disk block device through the underlying file system; when the access request is to read data, the encrypted file system reads the encrypted file from the disk block device through the underlying file system, obtains the ciphertext data page and its plaintext data page verification tag of the target file by parsing the data format of the encrypted file, decrypts the ciphertext data page through the data encryption and decryption module to obtain the plaintext data page, and calculates the plaintext data page verification tag for the plaintext data page through the integrity verification module. tmp , if the parsed plaintext data page verification tag tag and the calculated plaintext data page verification tag tag tmp If the two are consistent, the plaintext data page will be returned to the access request.

[0005] Optionally, the encryption operation on the plaintext data page of the target file being written through the data encryption and decryption module refers to the data encryption and decryption module calling software implemented by software or calling an algorithm module implemented by a hardware accelerator to perform encryption operation, and the integrity verification operation on the plaintext data page through the integrity verification module refers to the integrity verification module calling software implemented by software or calling an algorithm module implemented by a hardware accelerator to perform integrity verification operation on the plaintext data page; the decryption operation on the ciphertext data page to obtain the plaintext data page through the data encryption and decryption module refers to the data encryption and decryption module calling software implemented by software or calling an algorithm module implemented by a hardware accelerator to decrypt the ciphertext data page to obtain the plaintext data page.

[0006] Optionally, the storage area of ​​the encrypted file consists of an encryption header and at least one data storage unit, the encryption header contains file encryption context information and a file key, the data storage unit includes a label area and a data area, each plaintext data page verification tag tag in the label area is of a fixed length, and a label area contains N plaintext data page verification tags tags; a data area contains N blocks of data aligned at a fixed length, and each block of fixed-length data corresponds one-to-one to a plaintext data page verification tag tag stored in the label area, so that the plaintext data page verification tag tag after the integrity verification operation of the nth block of fixed-length data in the data area under each data storage unit is saved at the position of the nth plaintext data page verification tag tag in the label area under the same data storage unit.

[0007] Optionally, each plaintext data page check tag tag in the tag area is 32 bytes in length, and a tag area contains 128 plaintext data page check tags, so that the size of a tag area is 4096 bytes; the data area contains N blocks of data aligned at a fixed length, which means that a data area contains 128 blocks of data aligned at 4096 bytes.

[0008] Optionally, the encrypted file system further includes a configurable system integrity check switch and a file integrity check switch, wherein the system integrity check switch is used to control whether integrity check processing is required when an IO operation is performed on a file under the file system, and the file integrity check switch is used to control whether integrity check processing is required when an IO operation is performed on a corresponding file, and the integrity check module is started only when both the system integrity check switch and the file integrity check switch of the encrypted file are turned on, so that for the encrypted file, encryption operation is performed on the plaintext data page of the written target file through the data encryption and decryption module at the same time, and integrity check operation is performed on the plaintext data page through the integrity check module, and the encrypted file is stored in a manner including a label area in the data storage unit; and when any one of the system integrity check switch and the file integrity check switch of the encrypted file is turned off or both are turned off, the integrity check module is disabled, so that for the encrypted file, only encryption operation is performed on the plaintext data page of the written target file through the data encryption and decryption module, and integrity check operation is not performed on the plaintext data page through the integrity check module, and the encrypted file is stored in a manner including a data storage unit not including a label area.

[0009] Optionally, when the access request is to write data, the response of the encrypted file system includes: S101, read the status of the system integrity check switch and the file integrity check switch of the encrypted file, when the system integrity check switch and the file integrity check switch are both on, jump to step S102; when the system integrity check switch is off and the file integrity check switch of the encrypted file is on, jump to step S106; when the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or the system integrity check switch is off and the file integrity check switch of the encrypted file is off, jump to step S109; S102, when the system integrity check switch and the file integrity check switch of the encrypted file are both on, the page number of the label area of ​​the encrypted file is calculated according to the page number corresponding to the ciphertext data page of the encrypted file currently being read and written, and the corresponding label page is read into the memory page buffer; S103, calculating the label index value n of the ciphertext data page of the currently read / written encrypted file in the corresponding label area according to the page number corresponding to the ciphertext data page of the currently read / written encrypted file; S104, the encrypted file system uses the data encryption and decryption module to call the software algorithm module or the hardware accelerator to perform encryption operation on the plaintext data page of the written target file to obtain the corresponding ciphertext data page, and at the same time uses the integrity check module to perform integrity check operation on the plaintext data page to obtain the corresponding plaintext data page check tag; S105, according to the page number and label index value n corresponding to the ciphertext data page of the encrypted file currently being read and written, respectively calculate the file offset position of the underlying file system corresponding to the ciphertext data page and its label value according to the encrypted file data storage format with label area, write the ciphertext data page and the plaintext data page verification label tag to the corresponding offset position of the underlying file system file respectively, and finally write to the disk block device through the underlying file system, and then this write operation ends and exits; S106, when the system integrity check switch is off and the file integrity check switch of the encrypted file is on, the file offset position of the data page operated by the encrypted file system relative to the underlying file system is calculated according to the page number corresponding to the ciphertext data page of the encrypted file currently being read and written and in accordance with the encrypted file data storage format with the label area; S107, the encrypted file system calls the software algorithm module implemented by software or the hardware accelerator through the data encryption and decryption module to perform encryption operation on the plaintext data page of the written target file to obtain the corresponding ciphertext data page; S108, calling the underlying file system interface, writing the ciphertext data page into the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally writing it into the disk block device through the underlying file system, and the write operation ends and exits; S109, when the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or when the system integrity check switch is off and the file integrity check switch of the encrypted file is off, calculating the file offset position of the data page operated by the encrypted file system relative to the underlying file system according to the encrypted file data storage format of the unlabeled area; S110, the encrypted file system calls a software algorithm module implemented by software or a hardware accelerator through a data encryption and decryption module to perform encryption operations on the plaintext data page of the written target file to obtain a corresponding ciphertext data page; S111, calling the underlying file system interface, writing the ciphertext data page into the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally writing it into the disk block device through the underlying file system, and the write operation ends and exits.

[0010] Optionally, when the access request is to read data, the response of the encrypted file system includes: S201, reading the status of the system integrity check switch and the file integrity check switch of the encrypted file, when the system integrity check switch and the file integrity check switch are both on, jumping to step S202; when the system integrity check switch is off and the file integrity check switch of the encrypted file is on, jumping to step S208; when the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or the system integrity check switch is off and the file integrity check switch of the encrypted file is off, jumping to step S212; S202, when the system integrity check switch and the file integrity check switch of the encrypted file are both on, the page number of the label area of ​​the encrypted file is calculated according to the page number corresponding to the ciphertext data page of the encrypted file currently being read and written, and the corresponding label page is read into the memory page buffer; S203, calculating the label index value n of the ciphertext data page of the currently read / written encrypted file in the corresponding label area according to the page number corresponding to the ciphertext data page of the currently read / written encrypted file; S204, the encrypted file system calculates the data page offset position and the label value offset position relative to the underlying file system according to the read data page number and the encrypted file data storage format with the label area; S205, the encrypted file system calls the underlying file system to read out the ciphertext data page and its corresponding label value; the encrypted file system uses the data encryption and decryption module to call the software algorithm module implemented by the software or the hardware accelerator to decrypt the ciphertext data page according to the file key to obtain the plaintext data page; S206, decrypting the ciphertext data page by the data encryption and decryption module to obtain a plaintext data page, and calculating a plaintext data page verification tag tag for the plaintext data page by the integrity verification module tmp; S207, compare the plaintext data page verification tag tag obtained by parsing and the plaintext data page verification tag tag obtained by calculation tmp The value of the plaintext data page verification tag tag obtained by parsing and the plaintext data page verification tag tag calculated tmp If the two are consistent, the corresponding plaintext data page is returned to the access request called to the upper layer. Otherwise, an error is returned to the access request called to the upper layer, and the read operation ends and exits. S208, when the system integrity check switch of the encrypted file system is off and the file integrity check switch of the encrypted file is on, the file offset position of the data page operated by the encrypted file system relative to the underlying file system is calculated according to the page number corresponding to the ciphertext data page of the encrypted file currently being read and written and in accordance with the encrypted file data storage format with the label area; S209, the encrypted file system calls the underlying file system and reads out the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system; S210, the encrypted file system uses a data encryption and decryption module to call a software algorithm module implemented by software or a hardware accelerator to perform a decryption operation on the ciphertext data page according to the file key to obtain a plaintext data page; S211, the encrypted file system returns the corresponding plaintext data page to the access request called by the upper layer, otherwise it returns an error to the access request called by the upper layer, and the read operation ends and exits; S212, when the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or when the system integrity check switch is off and the file integrity check switch of the encrypted file is off, calculating the file offset position of the data page operated by the encrypted file system relative to the underlying file system according to the encrypted file data storage format of the unlabeled area; S213, the encrypted file system calls the underlying file system and reads out the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system; S214, the encrypted file system uses a data encryption and decryption module to call a software algorithm module implemented by software or a hardware accelerator to perform a decryption operation on the ciphertext data page according to the file key to obtain a plaintext data page; S215, the encrypted file system returns the corresponding plaintext data page to the access request called by the upper layer, otherwise it returns an error to the access request called by the upper layer, and the current read operation ends and exits.

[0011] In addition, the present invention also provides a data integrity verification system for an encrypted file system, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the data integrity verification method for the encrypted file system.

[0012] In addition, the present invention also provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the data integrity verification method of the encrypted file system through a processor.

[0013] In addition, the present invention also provides a computer program product, including a computer program or an instruction, wherein the computer program or the instruction is programmed or configured to execute the data integrity verification method of the encrypted file system through a processor.

[0014] Compared with the prior art, the present invention mainly has the following advantages: 1. The present invention includes an encrypted file system system architecture, and performs encryption operations and data integrity verification operations on encrypted file system data pages through a data encryption and decryption module and an integrity verification module, so that the encrypted file system can simultaneously support encrypted storage and integrity verification functions of files. On the basis of an existing encrypted file system, an integrity verification module based on a file key is introduced, and while the encrypted file system performs encryption and decryption operations and read and write operations on data according to file pages, integrity verification operations and checks are performed on data according to pages, so that the encrypted file system provides data integrity verification capabilities while encrypting and storing data, so that the encrypted file system provided by this embodiment can not only ensure the ciphertext storage of data and prevent leakage, but also detect and verify the integrity of data in real time to prevent data from being tampered with or damaged, and further ensure the security and reliability of data.

[0015] 2. The present invention utilizes a data encryption and decryption module and an integrity verification module to respond in parallel to user-mode access requests based on ciphertext data stored in the underlying file system. The parallel processing method can effectively improve the encryption processing performance of the encrypted file system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 The figure is a basic flow chart of a method according to a first embodiment of the present invention.

[0017] Figure 2 The figure is a schematic diagram of the storage format of the encrypted file in the first embodiment of the present invention.

[0018] Figure 3 The figure is a schematic diagram of the read and write access process based on the check switch in the first embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Embodiment 1: like Figure 1 As shown, this embodiment provides a data integrity verification method for an encrypted file system, including, in a kernel-state encrypted file system, using a data encryption and decryption module and an integrity verification module to respond to a user-state access request in parallel based on ciphertext data stored in an underlying file system; when the access request is to write data, the encrypted file system performs an encryption operation on the plaintext data page of the written target file through the data encryption and decryption module to obtain a corresponding ciphertext data page, and at the same time performs an integrity verification operation on the plaintext data page through the integrity verification module to obtain a corresponding plaintext data page verification tag, organizes and stores the ciphertext data page and its plaintext data page verification tag in a specified format, and saves it to the underlying file system in the form of an encrypted file, and finally writes it to a disk block device through the underlying file system; when the access request is to read data, the encrypted file system reads the encrypted file from the disk block device through the underlying file system, obtains the ciphertext data page and its plaintext data page verification tag of the target file by parsing the data format of the encrypted file, decrypts the ciphertext data page through the data encryption and decryption module to obtain a plaintext data page, and calculates the plaintext data page verification tag for the plaintext data page through the integrity verification module tmp , if the parsed plaintext data page verification tag tag and the calculated plaintext data page verification tag tag tmp If the two are consistent, the plaintext data page will be returned to the access request. Figure 1 As shown, in the encrypted file system system architecture, this embodiment simultaneously performs encryption operations and data integrity verification operations on the encrypted file system data pages through the data encryption and decryption module and the integrity verification module, so that the encrypted file system can simultaneously support the encrypted storage and integrity verification functions of the files, so that the encrypted file system provided by this embodiment can not only ensure the ciphertext storage of data and prevent leakage, but also detect and verify the integrity of the data in real time to prevent the data from being tampered with or damaged, and further ensure the security and reliability of the data.

[0021] In this embodiment, the encrypted file system processes files in units of plaintext data pages when performing read and write operations on files. When writing data, the encrypted file system uses the file key to perform encryption operations on the plaintext data pages through the encryption operation module, and the corresponding ciphertext data pages are obtained by the operation. At the same time, the encrypted file system uses the file key to perform integrity verification operations on the plaintext data pages through the integrity verification module, and the corresponding plaintext data page verification tag is obtained by the operation. Then, the encrypted file system organizes and stores the ciphertext data pages and their plaintext data page verification tags in a specific format. The ciphertext data pages and the plaintext data page verification tags are saved to the underlying file system in the form of files, and finally written to the disk block device through the underlying file system. When reading data, the encrypted file system reads the encrypted file from the disk block device through the underlying file system, and obtains the ciphertext data page and its plaintext data page verification tag of the file by parsing the data format of the encrypted file. The encrypted file system uses the file key to perform decryption operations on the ciphertext data pages through the data encryption and decryption module, and calculates the integrity verification tag of the plaintext data page through the integrity verification module. tmp , by comparing the plaintext data page verification tag and tag tmp value for integrity check.

[0022] like Figure 1 As shown, in this embodiment, the encryption operation of the plaintext data page of the written target file by the data encryption and decryption module refers to the encryption operation of the software implemented by the data encryption and decryption module or the algorithm module implemented by the hardware accelerator, and the integrity verification operation of the plaintext data page by the integrity verification module refers to the integrity verification module calling the software implemented by the software or calling the algorithm module implemented by the hardware accelerator to perform integrity verification operation on the plaintext data page; the decryption operation of the ciphertext data page by the data encryption and decryption module to obtain the plaintext data page refers to the software implemented by the data encryption and decryption module or the algorithm module implemented by the hardware accelerator to decrypt the ciphertext data page to obtain the plaintext data page. The algorithm module can be a hardware acceleration engine in the form of a hardware card or a soft algorithm using CPU operation. The encryption operation and the integrity operation are usually distributed to realize parallel processing, which can greatly improve the processing performance of the encryption file system for encryption and decryption and integrity operation. It should be noted that the method of this embodiment can be compatible with various encryption and decryption algorithms and integrity verification algorithms, and does not depend on the specific encryption and decryption algorithms and integrity verification algorithms. There is no doubt that the specific implementation of the encryption and decryption algorithms and integrity verification algorithms will not be described here.

[0023] like Figure 2As shown, in this embodiment, the storage area of ​​the encrypted file is composed of an encryption header and at least one data storage unit, the encryption header contains file encryption context information and file key, the data storage unit includes a label area and a data area, each plaintext data page check tag tag in the label area is of fixed length, and a label area contains N plaintext data page check tags; a data area contains N blocks of data aligned at a fixed length, and each block of fixed-length data corresponds to a plaintext data page check tag tag stored in the label area, so that the plaintext data page check tag tag after the integrity check operation of the nth block of fixed-length data in the data area under each data storage unit is stored at the position of the nth plaintext data page check tag tag in the label area under the same data storage unit. In the encrypted file data storage format, the encryption header, label area and data area are stored continuously, and belong to the same file relative to the underlying file system, that is, when the label area and the data area are IO operated, it corresponds to operating multiple page caches of the same file. This implementation method can avoid some synchronization problems when processing labels and data, reduce the inconsistency problem of the label area and the data area falling to the disk, and better ensure the data consistency of the label area and the data area. In order to adapt to some special application scenarios where integrity check is not enabled, the above encrypted file data storage format can be trimmed. When all label areas are trimmed, the encrypted file data format degenerates into a form without integrity check. The storage area of ​​the encrypted file consists of an encryption header and at least one data storage unit. The data storage unit only contains one data area (no label area). At this time, integrity check processing will not be performed during file IO operations.

[0024] As an optional implementation, in this embodiment, each plaintext data page check tag tag in the tag area is 32 bytes long, and a tag area contains 128 plaintext data page check tags, so that the size of a tag area is 4096 bytes; the data area contains N blocks of data aligned at a fixed length, which means that a data area contains 128 blocks of data aligned at 4096 bytes. The starting position of each encrypted file in the encrypted file system is an encryption header aligned at 4096 bytes, and the encryption header contains file encryption context information, special processing file keys, etc. After the encryption header is the first tag area, each tag (plaintext data page check tag tag) in the tag area is 32 bytes long, and a tag area contains 128 tags. After the tag area is the data area, the data area is aligned with 4096 bytes, that is, the length of each block of data in the data area is 4096 bytes, and a data area contains 128 blocks of data, which is consistent with the number of tags in a tag area. The tag value after the integrity check operation of the nth block of 4096 bytes of data in each data area is stored in the nth tag position of the previous adjacent tag area. After the data area, there is the next label area, and then the data area corresponding to the next label area, and so on. In the encrypted file data storage format, the encryption header, label area, and data area are all integer multiples of 4096 bytes, which is consistent with the file page size of the encrypted file system and the size of a single page cache buffer of the operating system. This design can better utilize the buffer acceleration function and file pre-reading function of the virtual file system in the operating system, and minimize the impact of the label introduced by the integrity check of the encrypted file system on the file IO performance.

[0025] As an optional implementation, in order to achieve compatibility with the encrypted file system, such as Figure 3As shown, in this embodiment, the encryption file system integrity check compatibility switch includes two levels, one is the integrity check switch at the encryption file system level (i.e., the system integrity check switch of the encryption file system), and the other is the integrity check switch at the encryption file level (i.e., the file integrity check switch of the encryption file). Specifically, in this embodiment, the encryption file system also includes a configurable system integrity check switch and a file integrity check switch. The system integrity check switch is used to control whether integrity check processing is required when the file under the file system is subjected to IO operation (for application scenarios with low data integrity requirements or performance-sensitive, the integrity check function can be turned off through the encryption file system integrity check switch), and the file integrity check switch is used to control whether integrity check processing is required when the corresponding file is subjected to IO (taking into account the encryption file system upgrade scenario, when upgrading to a version that supports the integrity check function when the encrypted file has already been implemented, the encryption file system uses the file integrity check switch of the encrypted file to identify whether integrity check processing is required for the current file, thereby enabling the encryption file system to simultaneously support the encrypted files before the upgrade and the integrity check function after the upgrade. The system can process IO of encrypted files), and the integrity verification module is started only when the system integrity verification switch and the file integrity verification switch of the encrypted file are both turned on, so that the plaintext data page of the written target file is encrypted by the data encryption and decryption module at the same time, and the integrity verification operation is performed on the plaintext data page by the integrity verification module, and the encrypted file is stored in a manner that includes a label area in the data storage unit; and when any one of the system integrity verification switch and the file integrity verification switch of the encrypted file is turned off or all are turned off, the integrity verification module is disabled, so that the plaintext data page of the written target file is encrypted by the data encryption and decryption module only, and the integrity verification operation is not performed on the plaintext data page by the integrity verification module, and the encrypted file is stored in a manner that includes a data storage unit that does not include a label area.

[0026] In this embodiment, when reading and writing files, the encryption file system first identifies the integrity check compatibility switches of the encryption file system and the encryption file respectively, and decides whether to perform integrity check processing on the encrypted file data page according to the combination of the compatibility switches; the encryption file system parses the encryption header of the encrypted file, extracts the file key of the encrypted file, uses the file key to perform encryption and decryption operations and integrity check operations on the encrypted file data page according to the combination of the integrity check compatibility switches, and stores the operation results according to the encrypted file data storage format or returns them to the upper layer call; the encryption file system submits the encrypted file in a specific storage format to the underlying file system, and the underlying file system finally submits it to the disk block device to complete the data storage. Among them, the four combinations of the system integrity check switch and the file integrity check switch of the encrypted file include: when the encrypted file system performs file IO, first read the integrity check switch of the file system super block, then parse the encrypted header of the encrypted file, extract the file key and the file integrity check switch of the encrypted file; if the system integrity check switch of the encrypted file system is on, and the file integrity check switch of the encrypted file is also on, then the read and write operations respectively perform encryption and decryption operations and integrity check operations on the file data, and the data storage format is based on the encrypted file data with tag area storage and parsing; if the system integrity check switch of the encrypted file system is on, and the file integrity check switch of the encrypted file is off, then only encryption and decryption processing is performed during the read and write operations, and integrity check operations are not performed, and the data storage format is based on the encrypted file data without tag area storage and parsing. If the system integrity check switch of the encrypted file system is off, and the file integrity check switch of the encrypted file is also off, then only encryption and decryption processing is performed during the read and write operations, and integrity check operations are not performed, and the data storage format is based on the encrypted file data without tag area storage and parsing. If the system integrity check switch of the encrypted file system is off and the file integrity check switch of the encrypted file is on, only encryption and decryption are performed during read and write operations, and no integrity check operation is performed. The data storage and parsing format is based on the encrypted file data with a tag area.

[0027] When the access request is to write data, the response of the encrypted file system in this embodiment includes: S101, read the status of the system integrity check switch and the file integrity check switch of the encrypted file, when the system integrity check switch and the file integrity check switch are both on, jump to step S102; when the system integrity check switch is off and the file integrity check switch of the encrypted file is on, jump to step S106; when the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or the system integrity check switch is off and the file integrity check switch of the encrypted file is off, jump to step S109; S102, when the system integrity check switch and the file integrity check switch of the encrypted file are both on, the page number of the label area of ​​the encrypted file is calculated according to the page number corresponding to the ciphertext data page of the encrypted file currently being read and written, and the corresponding label page is read into the memory page buffer; S103, calculating the label index value n of the ciphertext data page of the currently read / written encrypted file in the corresponding label area according to the page number corresponding to the ciphertext data page of the currently read / written encrypted file; S104, the encrypted file system uses the data encryption and decryption module to call the software algorithm module or the hardware accelerator to perform encryption operation on the plaintext data page of the written target file to obtain the corresponding ciphertext data page, and at the same time uses the integrity check module to perform integrity check operation on the plaintext data page to obtain the corresponding plaintext data page check tag; S105, according to the page number and label index value n corresponding to the ciphertext data page of the encrypted file currently being read and written, respectively calculate the file offset position of the underlying file system corresponding to the ciphertext data page and its label value according to the encrypted file data storage format with label area, write the ciphertext data page and the plaintext data page verification label tag to the corresponding offset position of the underlying file system file respectively, and finally write to the disk block device through the underlying file system, and then this write operation ends and exits; S106, when the system integrity check switch is off and the file integrity check switch of the encrypted file is on, the file offset position of the data page operated by the encrypted file system relative to the underlying file system is calculated according to the page number corresponding to the ciphertext data page of the encrypted file currently being read and written and in accordance with the encrypted file data storage format with the label area; S107, the encrypted file system calls the software algorithm module implemented by software or the hardware accelerator through the data encryption and decryption module to perform encryption operation on the plaintext data page of the written target file to obtain the corresponding ciphertext data page; S108, calling the underlying file system interface, writing the ciphertext data page into the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally writing it into the disk block device through the underlying file system, and the write operation ends and exits; S109, when the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or when the system integrity check switch is off and the file integrity check switch of the encrypted file is off, calculating the file offset position of the data page operated by the encrypted file system relative to the underlying file system according to the encrypted file data storage format of the unlabeled area; S110, the encrypted file system calls a software algorithm module implemented by software or a hardware accelerator through a data encryption and decryption module to perform encryption operations on the plaintext data page of the written target file to obtain a corresponding ciphertext data page; S111, calling the underlying file system interface, writing the ciphertext data page into the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally writing it into the disk block device through the underlying file system, and the write operation ends and exits.

[0028] When the access request is to read data, the response of the encrypted file system in this embodiment includes: S201, reading the status of the system integrity check switch and the file integrity check switch of the encrypted file, when the system integrity check switch and the file integrity check switch are both on, jumping to step S202; when the system integrity check switch is off and the file integrity check switch of the encrypted file is on, jumping to step S208; when the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or the system integrity check switch is off and the file integrity check switch of the encrypted file is off, jumping to step S212; S202, when the system integrity check switch and the file integrity check switch of the encrypted file are both on, the page number of the label area of ​​the encrypted file is calculated according to the page number corresponding to the ciphertext data page of the encrypted file currently being read and written, and the corresponding label page is read into the memory page buffer; S203, calculating the label index value n of the ciphertext data page of the currently read / written encrypted file in the corresponding label area according to the page number corresponding to the ciphertext data page of the currently read / written encrypted file; S204, the encrypted file system calculates the data page offset position and the label value offset position relative to the underlying file system according to the read data page number and the encrypted file data storage format with the label area; S205, the encrypted file system calls the underlying file system to read out the ciphertext data page and its corresponding label value; the encrypted file system uses the data encryption and decryption module to call the software algorithm module implemented by the software or the hardware accelerator to decrypt the ciphertext data page according to the file key to obtain the plaintext data page; S206, decrypting the ciphertext data page by the data encryption and decryption module to obtain a plaintext data page, and calculating a plaintext data page verification tag tag for the plaintext data page by the integrity verification module tmp ; S207, compare the plaintext data page verification tag tag obtained by parsing and the plaintext data page verification tag tag obtained by calculation tmp The value of the plaintext data page verification tag tag obtained by parsing and the plaintext data page verification tag tag calculated tmp If the two are consistent, the corresponding plaintext data page is returned to the access request called to the upper layer. Otherwise, an error is returned to the access request called to the upper layer, and the read operation ends and exits. S208, when the system integrity check switch of the encrypted file system is off and the file integrity check switch of the encrypted file is on, the file offset position of the data page operated by the encrypted file system relative to the underlying file system is calculated according to the page number corresponding to the ciphertext data page of the encrypted file currently being read and written and in accordance with the encrypted file data storage format with the label area; S209, the encrypted file system calls the underlying file system and reads out the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system; S210, the encrypted file system uses a data encryption and decryption module to call a software algorithm module implemented by software or a hardware accelerator to perform a decryption operation on the ciphertext data page according to the file key to obtain a plaintext data page; S211, the encrypted file system returns the corresponding plaintext data page to the access request called by the upper layer, otherwise it returns an error to the access request called by the upper layer, and the read operation ends and exits; S212, when the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or when the system integrity check switch is off and the file integrity check switch of the encrypted file is off, calculating the file offset position of the data page operated by the encrypted file system relative to the underlying file system according to the encrypted file data storage format of the unlabeled area; S213, the encrypted file system calls the underlying file system and reads out the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system; S214, the encrypted file system uses a data encryption and decryption module to call a software algorithm module implemented by software or a hardware accelerator to perform a decryption operation on the ciphertext data page according to the file key to obtain a plaintext data page; S215, the encrypted file system returns the corresponding plaintext data page to the access request called by the upper layer, otherwise it returns an error to the access request called by the upper layer, and the current read operation ends and exits.

[0029] As an optional implementation mode, this embodiment further provides a read-write fusion implementation step, which specifically includes: a) When the system integrity check switch of the encrypted file system and the file integrity check switch of the encrypted file are both on, the page number of the encrypted file tag area is calculated according to the page number corresponding to the encrypted file data page currently read and written, and the corresponding tag page is read into the memory page buffer page cache; b) According to the page number corresponding to the encrypted file data page currently read and written, the tag index value n of the page in the tag area to which it belongs is calculated; c) If the IO operation is to write data, the data encryption and decryption module of the encrypted file system calls the algorithm module, and performs encryption operation on the plaintext data page according to the file key and the encryption algorithm type to obtain the ciphertext data page; d) The integrity check module of the encrypted file system calls the algorithm module, performs HMAC-256 operation on the plaintext data page according to the file key, and obtains the integrity check tag of the plaintext data; e) According to the encrypted file data page page number and tag index value n, the file offset position of the encrypted file data page and its tag value corresponding to the underlying file system is calculated respectively according to the encrypted file data storage format with tag area, and the ciphertext data page and tag are written to the underlying file system respectively. The corresponding offset position of the file system file is finally written to the disk by the underlying file system, and the write operation ends; f) If the IO operation is to read data, the encrypted file system first calculates the data page offset position and tag value offset position relative to the underlying file system according to the page number of the read data page and the encrypted file data storage format with the tag area; g) The encrypted file system calls the underlying file system to read the ciphertext data page and its corresponding tag value; h) The data encryption and decryption module of the encrypted file system calls the algorithm module, and performs decryption operation on the ciphertext data page according to the file key and encryption algorithm type to obtain the plaintext data page; i) The integrity verification module of the encrypted file system calls the algorithm module, and performs hmac-256 operation on the plaintext data page according to the file key to obtain the integrity verification tag of the plaintext data tmp ; j) Compare tags and tags tmp If the values ​​are the same, it means that the integrity check is correct, and the corresponding plaintext data page is returned to the upper layer. Otherwise, an error is returned to the upper layer and the read operation ends.

[0030] k) When the system integrity check switch of the encrypted file system is off and the file integrity check switch of the encrypted file is on, the file offset position of the data page operated by the encrypted file system relative to the underlying file system is calculated according to the page number corresponding to the encrypted file data page currently read and written and the encrypted file data storage format with a tag area; l) If the IO operation is to write data, the data encryption and decryption module of the encrypted file system calls the algorithm module, performs encryption operation on the plaintext data page according to the file key and the encryption algorithm type, and obtains the ciphertext data page; m) Calls the underlying file system interface, writes the ciphertext data page to the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally writes it to the disk by the underlying file system, and this write operation ends; n) If the IO operation is to read data, the encrypted file system calls the underlying file system, and reads the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system; o) The data encryption and decryption module of the encrypted file system calls the algorithm module, performs decryption operation on the ciphertext data page according to the file key and the encryption algorithm type, and obtains the plaintext data page; p) The encrypted file system returns the corresponding plaintext data page to the upper layer, and this read operation ends.

[0031] q) When the system integrity check switch of the encrypted file system is on and the file integrity check switch of the encrypted file is off, or the system integrity check switch of the encrypted file system is off and the file integrity check switch of the encrypted file is off, the file offset position of the data page operated by the encrypted file system relative to the underlying file system is calculated according to the encrypted file data storage format without tag area. r) If the IO operation is to write data, the data encryption and decryption module of the encrypted file system calls the algorithm module, performs encryption operation on the plaintext data page according to the file key and encryption algorithm type, and obtains the ciphertext data page; s) Call the underlying file system interface, write the ciphertext data page to the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally write it to the disk by the underlying file system, and this write operation ends; t) If the IO operation is to read data, the encrypted file system calls the underlying file system, and reads the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system; u) The data encryption and decryption module of the encrypted file system calls the algorithm module, performs decryption operation on the ciphertext data page according to the file key and encryption algorithm type, and obtains the plaintext data page; v) The encrypted file system returns the corresponding plaintext data page to the upper layer, and this read operation ends.

[0032] In summary, the method of this embodiment introduces an integrity check module based on a file key on the basis of an existing encrypted file system. While the encrypted file system performs encryption and decryption operations and read and write operations on data according to file pages, it performs integrity check operations and checks on data according to pages, providing the encrypted file system with data integrity check capabilities while encrypting and storing data. The method of this embodiment expands the encrypted file data storage format of the existing encrypted file system, introduces a tag area for integrity check, the tag area and the data area are aligned with 4096 bytes, and the tag area is elastically scalable. This encrypted file data storage format can better utilize the page cache cache of the operating system and its pre-reading capabilities, reduce the impact of the introduction of the integrity check function on performance, and enable the encrypted file system to simultaneously process non-integrity-checked encrypted files and integrity-checked encrypted files. The method of this embodiment introduces an encrypted file system integrity check switch and an encrypted file integrity check switch. Different combinations of the two switches distinguish between the data storage format and integrity check of the file, so that the encrypted file system can compatibly process the files generated before and after the version upgrade, and can also adapt to application scenarios where the integrity check function may need to be turned off or on under special circumstances.

[0033] In addition, this embodiment also provides a data integrity verification system for an encrypted file system, including a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the data integrity verification method for the encrypted file system. This embodiment also provides a computer-readable storage medium, wherein a computer program or instruction is stored in the computer-readable storage medium, wherein the computer program or instruction is programmed or configured to execute the data integrity verification method for the encrypted file system through a processor. This embodiment also provides a computer program product, including a computer program or instruction, wherein the computer program or instruction is programmed or configured to execute the data integrity verification method for the encrypted file system through a processor.

[0034] Embodiment 2: This embodiment is basically the same as the first embodiment, and the main difference is that the encrypted file data storage format is changed to store the data and the plaintext data page check tag of each data page continuously, that is, each 4096 bytes contains 32 bytes of plaintext data page check tag and 4064 bytes of data. This method makes each page cache of the encrypted file system contain both data and plaintext data page check tag, which has a greater impact on the code architecture of the existing encrypted file system, and at the same time increases the difficulty of file integrity check compatibility between versions and reduces processing performance.

[0035] In addition, this embodiment also provides a data integrity verification system for an encrypted file system, including a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the data integrity verification method for the encrypted file system. This embodiment also provides a computer-readable storage medium, wherein a computer program or instruction is stored in the computer-readable storage medium, wherein the computer program or instruction is programmed or configured to execute the data integrity verification method for the encrypted file system through a processor. This embodiment also provides a computer program product, including a computer program or instruction, wherein the computer program or instruction is programmed or configured to execute the data integrity verification method for the encrypted file system through a processor.

[0036] Embodiment three: This embodiment is basically the same as the first embodiment, and the main difference is that the encrypted file system data and the plaintext data page check tag are stored completely separately, for example, the plaintext data page check tag is configured in a separate file system or disk area for storage. This method can flexibly adapt to the scenario of the switch integrity check function and has good forward and backward compatibility. However, this method will greatly reduce the performance of the encrypted file system after the integrity check function is introduced, and it is difficult to ensure the data consistency of the encrypted file file data page and its plaintext data page check tag when the encrypted file system is stored.

[0037] In addition, this embodiment also provides a data integrity verification system for an encrypted file system, including a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the data integrity verification method for the encrypted file system. This embodiment also provides a computer-readable storage medium, wherein a computer program or instruction is stored in the computer-readable storage medium, wherein the computer program or instruction is programmed or configured to execute the data integrity verification method for the encrypted file system through a processor. This embodiment also provides a computer program product, including a computer program or instruction, wherein the computer program or instruction is programmed or configured to execute the data integrity verification method for the encrypted file system through a processor.

[0038] Embodiment 4: This embodiment is basically the same as the first embodiment, and the main difference is the type of integrity verification algorithm. For example, depending on the selected hash algorithm (data integrity verification algorithm), plaintext data page verification tags of different lengths are used, or the file key is not introduced as a parameter of the hash algorithm when performing integrity verification. However, this method may reduce the randomness and accuracy of the hash algorithm.

[0039] In addition, this embodiment also provides a data integrity verification system for an encrypted file system, including a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the data integrity verification method for the encrypted file system. This embodiment also provides a computer-readable storage medium, wherein a computer program or instruction is stored in the computer-readable storage medium, wherein the computer program or instruction is programmed or configured to execute the data integrity verification method for the encrypted file system through a processor. This embodiment also provides a computer program product, including a computer program or instruction, wherein the computer program or instruction is programmed or configured to execute the data integrity verification method for the encrypted file system through a processor.

[0040] Those skilled in the art should understand that the technical solutions provided by the embodiments of the present application may be in the form of methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0041] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A data integrity verification method for an encrypted file system, characterized in that: The invention includes a kernel-mode encrypted file system, which utilizes a data encryption and decryption module and an integrity verification module to respond to user-mode access requests in parallel based on ciphertext data stored in the underlying file system. When the access request is to write data, the encrypted file system performs encryption operations on the plaintext data pages of the target file to be written through the data encryption and decryption module to obtain corresponding ciphertext data pages, and at the same time performs integrity verification operations on the plaintext data pages through the integrity verification module to obtain corresponding plaintext data page verification tags, organizes and stores ciphertext data pages and their plaintext data page verification tags in a specified format, and saves them to the underlying file system in the form of encrypted files, and finally writes them to a disk block device through the underlying file system. When the access request is to read data, the encrypted file system reads the encrypted file from the disk block device through the underlying file system, obtains the ciphertext data page and its plaintext data page verification tag of the target file by parsing the data format of the encrypted file, decrypts the ciphertext data page through the data encryption and decryption module to obtain the plaintext data page, and calculates the plaintext data page verification tag for the plaintext data page through the integrity verification module. tmp , if the parsed plaintext data page verification tag tag and the calculated plaintext data page verification tag tag tmp If the two are consistent, the plaintext data page will be returned to the access request.

2. The data integrity verification method of the encrypted file system according to claim 1, characterized in that: The encryption operation on the plaintext data page of the written target file through the data encryption and decryption module refers to the encryption operation performed by the data encryption and decryption module calling the software implemented by the software or calling the algorithm module implemented by the hardware accelerator; the integrity verification operation on the plaintext data page through the integrity verification module refers to the integrity verification module calling the software implemented by the software or calling the algorithm module implemented by the hardware accelerator to perform the integrity verification operation on the plaintext data page; the decryption operation on the ciphertext data page to obtain the plaintext data page through the data encryption and decryption module refers to the decryption operation on the ciphertext data page to obtain the plaintext data page by calling the software implemented by the data encryption and decryption module or calling the algorithm module implemented by the hardware accelerator.

3. The data integrity verification method of the encrypted file system according to claim 1, characterized in that: The storage area of ​​the encrypted file is composed of an encryption header and at least one data storage unit, the encryption header contains file encryption context information and a file key, the data storage unit includes a label area and a data area, each plaintext data page check tag tag in the label area is of a fixed length, and a label area contains N plaintext data page check tags tags; A data area contains N blocks of data aligned with a fixed length. Each block of fixed-length data corresponds one-to-one to a plaintext data page verification tag stored in the tag area, so that the plaintext data page verification tag after the integrity check operation of the nth block of fixed-length data in the data area under each data storage unit is saved at the position of the nth plaintext data page verification tag in the tag area under the same data storage unit.

4. The data integrity verification method of the encrypted file system according to claim 3, characterized in that: Each plaintext data page check tag tag in the tag area is 32 bytes in length, and a tag area contains 128 plaintext data page check tags, so that the size of a tag area is 4096 bytes; the data area contains N blocks of data aligned at a fixed length, which means that a data area contains 128 blocks of data aligned at 4096 bytes.

5. The data integrity verification method of the encrypted file system according to claim 3, characterized in that: The encrypted file system further includes a configurable system integrity check switch and a file integrity check switch. The system integrity check switch is used to control whether integrity check processing is required when an IO operation is performed on a file under the file system. The file integrity check switch is used to control whether integrity check processing is required when an IO operation is performed on a corresponding file. The integrity check module is started only when both the system integrity check switch and the file integrity check switch of the encrypted file are turned on, so that the plaintext data page of the written target file is encrypted by the data encryption and decryption module at the same time, and the plaintext data page is integrity checked by the integrity check module, and the encrypted file is stored in a manner that the data storage unit includes a label area; and when any one of the system integrity check switch and the file integrity check switch of the encrypted file is turned off or all of them are turned off, the integrity check module is disabled, so that the plaintext data page of the written target file is encrypted by the data encryption and decryption module only, and the plaintext data page is not integrity checked by the integrity check module, and the encrypted file is stored in a manner that the data storage unit does not include a label area.

6. The data integrity verification method of the encrypted file system according to claim 5, characterized in that: When the access request is to write data, the response of the encrypted file system includes: S101, read the status of the system integrity check switch and the file integrity check switch of the encrypted file, when the system integrity check switch and the file integrity check switch are both on, jump to step S102; when the system integrity check switch is off and the file integrity check switch of the encrypted file is on, jump to step S106; when the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or the system integrity check switch is off and the file integrity check switch of the encrypted file is off, jump to step S109; S102, when the system integrity check switch and the file integrity check switch of the encrypted file are both on, the page number of the label area of ​​the encrypted file is calculated according to the page number corresponding to the ciphertext data page of the encrypted file currently being read and written, and the corresponding label page is read into the memory page buffer; S103, calculating the label index value n of the ciphertext data page of the currently read / written encrypted file in the corresponding label area according to the page number corresponding to the ciphertext data page of the currently read / written encrypted file; S104, the encrypted file system uses the data encryption and decryption module to call the software algorithm module or the hardware accelerator to perform encryption operation on the plaintext data page of the written target file to obtain the corresponding ciphertext data page, and at the same time uses the integrity check module to perform integrity check operation on the plaintext data page to obtain the corresponding plaintext data page check tag; S105, according to the page number and label index value n corresponding to the ciphertext data page of the encrypted file currently being read and written, respectively calculate the file offset position of the underlying file system corresponding to the ciphertext data page and its label value according to the encrypted file data storage format with label area, write the ciphertext data page and the plaintext data page verification label tag to the corresponding offset position of the underlying file system file respectively, and finally write to the disk block device through the underlying file system, and then this write operation ends and exits; S106, when the system integrity check switch is off and the file integrity check switch of the encrypted file is on, the file offset position of the data page operated by the encrypted file system relative to the underlying file system is calculated according to the page number corresponding to the ciphertext data page of the encrypted file currently being read and written and in accordance with the encrypted file data storage format with the label area; S107, the encrypted file system calls the software algorithm module implemented by software or the hardware accelerator through the data encryption and decryption module to perform encryption operation on the plaintext data page of the written target file to obtain the corresponding ciphertext data page; S108, calling the underlying file system interface, writing the ciphertext data page into the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally writing it into the disk block device through the underlying file system, and the write operation ends and exits; S109, when the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or when the system integrity check switch is off and the file integrity check switch of the encrypted file is off, calculating the file offset position of the data page operated by the encrypted file system relative to the underlying file system according to the encrypted file data storage format of the unlabeled area; S110, the encrypted file system calls a software algorithm module implemented by software or a hardware accelerator through a data encryption and decryption module to perform encryption operations on the plaintext data page of the written target file to obtain a corresponding ciphertext data page; S111, calling the underlying file system interface, writing the ciphertext data page into the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally writing it into the disk block device through the underlying file system, and the write operation ends and exits.

7. The data integrity verification method of the encrypted file system according to claim 5, characterized in that: When the access request is to read data, the response of the encrypted file system includes: S201, reading the status of the system integrity check switch and the file integrity check switch of the encrypted file, when the system integrity check switch and the file integrity check switch are both on, jumping to step S202; when the system integrity check switch is off and the file integrity check switch of the encrypted file is on, jumping to step S208; when the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or the system integrity check switch is off and the file integrity check switch of the encrypted file is off, jumping to step S212; S202, when the system integrity check switch and the file integrity check switch of the encrypted file are both on, the page number of the label area of ​​the encrypted file is calculated according to the page number corresponding to the ciphertext data page of the encrypted file currently being read and written, and the corresponding label page is read into the memory page buffer; S203, calculating the label index value n of the ciphertext data page of the currently read / written encrypted file in the corresponding label area according to the page number corresponding to the ciphertext data page of the currently read / written encrypted file; S204, the encrypted file system calculates the data page offset position and the label value offset position relative to the underlying file system according to the read data page number and the encrypted file data storage format with the label area; S205, the encrypted file system calls the underlying file system to read out the ciphertext data page and its corresponding label value; the encrypted file system uses the data encryption and decryption module to call the software algorithm module implemented by the software or the hardware accelerator to decrypt the ciphertext data page according to the file key to obtain the plaintext data page; S206, decrypting the ciphertext data page by the data encryption and decryption module to obtain a plaintext data page, and calculating a plaintext data page verification tag tag for the plaintext data page by the integrity verification module tmp ; S207, compare the plaintext data page verification tag tag obtained by parsing and the plaintext data page verification tag tag obtained by calculation tmp The value of the plaintext data page verification tag tag obtained by parsing and the plaintext data page verification tag tag calculated tmp If the two are consistent, the corresponding plaintext data page is returned to the access request called to the upper layer. Otherwise, an error is returned to the access request called to the upper layer, and the read operation ends and exits. S208, when the system integrity check switch of the encrypted file system is off and the file integrity check switch of the encrypted file is on, the file offset position of the data page operated by the encrypted file system relative to the underlying file system is calculated according to the page number corresponding to the ciphertext data page of the encrypted file currently being read and written and in accordance with the encrypted file data storage format with the label area; S209, the encrypted file system calls the underlying file system and reads out the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system; S210, the encrypted file system uses a data encryption and decryption module to call a software algorithm module implemented by software or a hardware accelerator to perform a decryption operation on the ciphertext data page according to the file key to obtain a plaintext data page; S211, the encrypted file system returns the corresponding plaintext data page to the access request called by the upper layer, otherwise it returns an error to the access request called by the upper layer, and the read operation ends and exits; S212, when the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or when the system integrity check switch is off and the file integrity check switch of the encrypted file is off, calculating the file offset position of the data page operated by the encrypted file system relative to the underlying file system according to the encrypted file data storage format of the unlabeled area; S213, the encrypted file system calls the underlying file system and reads out the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system; S214, the encrypted file system uses a data encryption and decryption module to call a software algorithm module implemented by software or a hardware accelerator to perform a decryption operation on the ciphertext data page according to the file key to obtain a plaintext data page; S215, the encrypted file system returns the corresponding plaintext data page to the access request called by the upper layer, otherwise it returns an error to the access request called by the upper layer, and the current read operation ends and exits.

8. A data integrity verification system for an encrypted file system, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the data integrity verification method of the encrypted file system according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the data integrity verification method of the encrypted file system according to any one of claims 1 to 7 through a processor.

10. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the data integrity verification method of the encrypted file system according to any one of claims 1 to 7 through a processor.

Images