A data integrity verification method and system for an encrypted file system

Abstract

The present invention discloses a data integrity verification method and system for an encrypted file system. The method comprises utilizing a data encryption / decryption module and an integrity verification module in parallel within a kernel-mode encrypted file system to respond to user-mode access requests. When the access request is to write data, the encrypted file system performs an encryption operation on the plaintext data page of the target file to be written, obtaining a corresponding ciphertext data page. Simultaneously, the integrity verification module performs an integrity verification operation on the plaintext data page, obtaining a corresponding plaintext data page verification tag. The ciphertext data page and its plaintext data page verification tag are organized and stored in a specified format, saved to the underlying file system as encrypted files, and written to a disk block device. The present invention aims to systematically implement file encryption and data integrity verification functions, ensuring good performance, consistency, and key management requirements while ensuring data security and integrity.

Description

Technical Field

[0001] The present invention relates to a data security technology belonging to the field of data storage, and in particular to a data integrity verification method and system for an encrypted file system. Background Art

[0002] In the digital information age, data integrity and security have become particularly important. With the widespread use of the internet and electronic communications, files may face various security threats during transmission and storage, such as data tampering, loss, or corruption. Therefore, developing effective data integrity verification methods is crucial to ensuring the authenticity and integrity of information. Data integrity refers to the accuracy and consistency of data throughout its entire lifecycle. This encompasses not only accuracy during storage but also the integrity of data during transmission. For businesses and individuals, data integrity is fundamental to protecting privacy, maintaining business continuity, and complying with laws and regulations. Traditional data integrity verification methods primarily use techniques such as cyclic redundancy checks (CRCs), checksums, and hash functions. While these methods can effectively detect data modifications, their applicability to encrypted files is limited, particularly when the checksum value remains unchanged after tampering. Because encrypted files are encrypted and even contain additional metadata used for encryption, conventional verification methods may not be directly applicable to the encrypted data and struggle to ensure consistency between the file data and its checksum. Furthermore, factors such as the choice of encryption algorithm and key management can also impact data integrity verification. Summary of the Invention

[0003] The technical problem to be solved by the present invention is as follows: In response to the above-mentioned problems in the prior art, a data integrity verification method and system for an encrypted file system are provided. The present invention aims to systematically implement file encryption and data integrity verification functions, and on the basis of ensuring data security and integrity, it can achieve good performance, consistency and key management requirements.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0005] A data integrity verification method for an encrypted file system includes, in a kernel-state encrypted file system, using a data encryption / decryption module and an integrity verification module to respond in parallel to user-state access requests based on ciphertext data stored in an underlying file system; when an access request is to write data, the encrypted file system performs an encryption operation on a plaintext data page of a target file to be written through the data encryption / decryption module to obtain a corresponding ciphertext data page, and simultaneously performs an integrity verification operation on the plaintext data page through the integrity verification module to obtain a corresponding plaintext data page verification tag; organizes and stores the ciphertext data page and its plaintext data page verification tag in a specified format, saves them to the underlying file system in the form of encrypted files, and finally writes them to a disk block device through the underlying file system; when an access request is to read data, the encrypted file system reads an encrypted file from the disk block device through the underlying file system, obtains the ciphertext data page and its plaintext data page verification tag of the target file by parsing the data format of the encrypted file, decrypts the ciphertext data page through the data encryption / decryption module to obtain a plaintext data page, and calculates the plaintext data page verification tag for the plaintext data page through the integrity verification module. tmp , if the parsed plaintext data page check tag tag, the calculated plaintext data page check tag tag tmp If the two are consistent, the plaintext data page will be returned to the access request.

[0006] Optionally, the encryption operation on the plaintext data page of the target file being written by the data encryption and decryption module refers to the data encryption and decryption module calling the software implemented by the software or calling the algorithm module implemented by the hardware accelerator to perform the encryption operation, and the integrity verification operation on the plaintext data page by the integrity verification module refers to the integrity verification module calling the software implemented by the software or calling the algorithm module implemented by the hardware accelerator to perform the integrity verification operation on the plaintext data page; the decryption operation on the ciphertext data page to obtain the plaintext data page by the data encryption and decryption module refers to the data encryption and decryption module calling the software implemented by the software or calling the algorithm module implemented by the hardware accelerator to decrypt the ciphertext data page to obtain the plaintext data page.

[0007] Optionally, the storage area of ​​the encrypted file consists of an encryption header and at least one data storage unit, the encryption header contains file encryption context information and a file key, the data storage unit includes a label area and a data area, each plaintext data page verification tag tag in the label area is of a fixed length, and a label area contains N plaintext data page verification tags tags; a data area contains N blocks of data aligned at a fixed length, and each block of fixed-length data corresponds one-to-one to a plaintext data page verification tag tag stored in the label area, so that the plaintext data page verification tag tag after the integrity verification operation of the nth block of fixed-length data in the data area under each data storage unit is saved in the position of the nth plaintext data page verification tag tag in the label area under the same data storage unit.

[0008] Optionally, each plaintext data page check tag tag in the label area is 32 bytes in length, and a label area contains 128 plaintext data page check tag tags, so that the size of a label area is 4096 bytes; the data area contains N blocks of data aligned at a fixed length, which means that a data area contains 128 blocks of data aligned at 4096 bytes.

[0009] Optionally, the encrypted file system further includes a configurable system integrity check switch and a file integrity check switch. The system integrity check switch is used to control whether integrity check processing is required when performing IO operations on files under the file system. The file integrity check switch is used to control whether integrity check processing is required when performing IO operations on corresponding files. The integrity check module is started only when the system integrity check switch and the file integrity check switch of the encrypted file are both turned on, so that for the encrypted file, encryption operations are performed on the plaintext data pages of the target file written by the data encryption and decryption module, and integrity check operations are performed on the plaintext data pages by the integrity check module, and the encrypted file is stored in a manner that includes a label area in the data storage unit; and when any one of the system integrity check switch and the file integrity check switch of the encrypted file is turned off or both are turned off, the integrity check module is disabled, so that for the encrypted file, only encryption operations are performed on the plaintext data pages of the target file written by the data encryption and decryption module, and integrity check operations are not performed on the plaintext data pages by the integrity check module, and the encrypted file is stored in a manner that does not include a label area in the data storage unit.

[0010] Optionally, when the access request is for writing data, the response of the encrypted file system includes:

[0011] S101, reading the status of the system integrity check switch and the file integrity check switch of the encrypted file. If both the system integrity check switch and the file integrity check switch are on, jump to step S102; if the system integrity check switch is off and the file integrity check switch of the encrypted file is on, jump to step S106; if the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or if the system integrity check switch is off and the file integrity check switch of the encrypted file is off, jump to step S109;

[0012] S102: When both the system integrity check switch and the encrypted file integrity check switch are on, the page number of the label area of ​​the encrypted file is calculated based on the page number corresponding to the ciphertext data page of the currently read / written encrypted file, and the corresponding label page is read into the memory page buffer;

[0013] S103, calculating the label index value n of the ciphertext data page of the currently read / written encrypted file in the label area to which it belongs based on the page number corresponding to the ciphertext data page of the currently read / written encrypted file;

[0014] S104: The encrypted file system uses the data encryption and decryption module to call a software algorithm module or a hardware accelerator to perform an encryption operation on the plaintext data page of the written target file to obtain a corresponding ciphertext data page. At the same time, the integrity check module performs an integrity check operation on the plaintext data page to obtain a corresponding plaintext data page verification tag.

[0015] S105: Calculate the file offsets of the ciphertext data page and its tag value corresponding to the underlying file system based on the page number and tag index value n of the ciphertext data page of the currently read / written encrypted file and the encrypted file data storage format with a tag area. Write the ciphertext data page and the plaintext data page check tag tag to the corresponding offsets of the underlying file system file. Finally, write the ciphertext data page and the plaintext data page check tag tag to the disk block device through the underlying file system. This write operation is completed and the program exits.

[0016] S106: When the system integrity check switch is off and the encrypted file integrity check switch is on, the file offset of the data page operated on by the encrypted file system relative to the underlying file system is calculated based on the page number corresponding to the ciphertext data page of the encrypted file currently being read or written and in accordance with the encrypted file data storage format with a label area;

[0017] S107, the encrypted file system uses the data encryption and decryption module to call a software algorithm module or a hardware accelerator to perform encryption operations on the plaintext data page of the written target file to obtain a corresponding ciphertext data page;

[0018] S108, calling the underlying file system interface, writing the ciphertext data page to the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally writing it to the disk block device through the underlying file system, completing this write operation and exiting;

[0019] S109: When the system integrity check switch is on and the file integrity check switch for the encrypted file is off, or when the system integrity check switch is off and the file integrity check switch for the encrypted file is off, calculating the file offset of the data page operated on the encrypted file system relative to the underlying file system according to the encrypted file data storage format in the unlabeled area;

[0020] S110, the encrypted file system calls a software algorithm module implemented by software or a hardware accelerator through a data encryption and decryption module to perform an encryption operation on the plaintext data page of the written target file to obtain a corresponding ciphertext data page;

[0021] S111, calling the underlying file system interface, writing the ciphertext data page to the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally writing it to the disk block device through the underlying file system. This write operation ends and exits.

[0022] Optionally, when the access request is for reading data, the response of the encrypted file system includes:

[0023] S201, reading the status of the system integrity check switch and the file integrity check switch of the encrypted file. If both the system integrity check switch and the file integrity check switch are on, jump to step S202; if the system integrity check switch is off and the file integrity check switch of the encrypted file is on, jump to step S208; if the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or if the system integrity check switch is off and the file integrity check switch of the encrypted file is off, jump to step S212;

[0024] S202: When both the system integrity check switch and the encrypted file integrity check switch are on, the page number of the label area of ​​the encrypted file is calculated based on the page number corresponding to the ciphertext data page of the encrypted file currently being read or written, and the corresponding label page is read into the memory page buffer;

[0025] S203, calculating the label index value n of the label area to which the ciphertext data page of the currently read / written encrypted file belongs based on the page number corresponding to the ciphertext data page of the currently read / written encrypted file;

[0026] S204, the encrypted file system calculates the data page offset position and the label value offset position relative to the underlying file system according to the read data page number and the encrypted file data storage format with the label area;

[0027] S205: The encrypted file system calls the underlying file system to read the ciphertext data page and its corresponding tag value. The encrypted file system uses the data encryption and decryption module to call a software algorithm module implemented in software or a hardware accelerator based on the file key to decrypt the ciphertext data page to obtain a plaintext data page.

[0028] S206: Decrypt the ciphertext data page using the data encryption and decryption module to obtain a plaintext data page, and calculate a plaintext data page verification tag for the plaintext data page using the integrity verification module. tmp ;

[0029] S207, compare the plaintext data page verification tag tag obtained by parsing and the plaintext data page verification tag tag obtained by calculation tmp The value of the plaintext data page verification tag tag obtained by parsing and the plaintext data page verification tag tag calculated tmp If the two are consistent, the corresponding plaintext data page is returned to the access request called to the upper layer. Otherwise, an error is returned to the access request called to the upper layer, and the read operation ends and exits.

[0030] S208: When the system integrity check switch of the encrypted file system is off and the file integrity check switch of the encrypted file is on, the file offset of the data page operated on by the encrypted file system relative to the underlying file system is calculated based on the page number corresponding to the ciphertext data page of the encrypted file currently being read or written and in accordance with the encrypted file data storage format with a label area;

[0031] S209, the encrypted file system calls the underlying file system and reads the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system;

[0032] S210, the encrypted file system uses a data encryption and decryption module to call a software algorithm module implemented in software or a hardware accelerator to decrypt the ciphertext data page according to the file key to obtain a plaintext data page;

[0033] S211: The encrypted file system returns the corresponding plaintext data page to the access request called by the upper layer. Otherwise, it returns an error to the access request called by the upper layer, and the read operation ends and exits.

[0034] S212: When the system integrity check switch is on and the file integrity check switch for the encrypted file is off, or when the system integrity check switch is off and the file integrity check switch for the encrypted file is off, calculating the file offset of the data page operated on the encrypted file system relative to the underlying file system according to the encrypted file data storage format in the unlabeled area;

[0035] S213, the encrypted file system calls the underlying file system and reads the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system;

[0036] S214, the encrypted file system uses the data encryption and decryption module to call a software algorithm module implemented in software or a hardware accelerator to decrypt the ciphertext data page according to the file key to obtain a plaintext data page;

[0037] S215 , the encrypted file system returns the corresponding plaintext data page to the access request called by the upper layer, otherwise it returns an error to the access request called by the upper layer, and the current read operation ends and exits.

[0038] In addition, the present invention also provides a data integrity verification system for an encrypted file system, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the data integrity verification method for the encrypted file system.

[0039] In addition, the present invention also provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the data integrity verification method of the encrypted file system through a processor.

[0040] In addition, the present invention also provides a computer program product, including a computer program or instructions, wherein the computer program or instructions are programmed or configured to execute the data integrity verification method of the encrypted file system through a processor.

[0041] Compared with the prior art, the present invention mainly has the following advantages:

[0042] 1. The present invention includes, within an encrypted file system architecture, a data encryption and integrity verification module, which simultaneously performs encryption operations and data integrity verification operations on encrypted file system data pages. This enables the encrypted file system to simultaneously support encrypted storage and integrity verification of files. Building upon existing encrypted file systems, the present invention introduces a file key-based integrity verification module. While the encrypted file system performs encryption and decryption operations and read and write operations on file pages, it also performs integrity verification operations and checks on data on a page-by-page basis. This provides the encrypted file system with data integrity verification capabilities while simultaneously encrypting and storing data. This allows the encrypted file system provided by this embodiment to both ensure ciphertext storage and prevent leakage of data and to detect and verify data integrity in real time, preventing data tampering or corruption, thereby further ensuring data security and reliability.

[0043] 2. The present invention utilizes the data encryption and decryption module and the integrity verification module to respond to user-mode access requests in parallel based on the ciphertext data stored in the underlying file system. The parallel processing method can effectively improve the encryption processing performance of the encrypted file system. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 Schematic diagram of the basic flow of the method of embodiment 1 of the present invention.

[0045] Figure 2 Schematic diagram of the storage format of the encrypted file in the first embodiment of the present invention.

[0046] Figure 3 The figure is a schematic diagram of the read and write access process based on the check switch in the first embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0048] Example 1:

[0049] like Figure 1 As shown, this embodiment provides a data integrity verification method for an encrypted file system, including, in a kernel-state encrypted file system, using a data encryption and decryption module and an integrity verification module to respond in parallel to user-state access requests based on ciphertext data stored in an underlying file system. When the access request is to write data, the encrypted file system performs an encryption operation on the plaintext data page of the target file to be written through the data encryption and decryption module to obtain a corresponding ciphertext data page, and at the same time performs an integrity verification operation on the plaintext data page through the integrity verification module to obtain a corresponding plaintext data page verification tag, organizes and stores the ciphertext data page and its plaintext data page verification tag in a specified format, saves it to the underlying file system in the form of an encrypted file, and finally writes it to a disk block device through the underlying file system. When the access request is to read data, the encrypted file system reads the encrypted file from the disk block device through the underlying file system, obtains the ciphertext data page and its plaintext data page verification tag of the target file by parsing the data format of the encrypted file, decrypts the ciphertext data page through the data encryption and decryption module to obtain a plaintext data page, and calculates the plaintext data page verification tag for the plaintext data page through the integrity verification module. tmp , if the parsed plaintext data page check tag tag, the calculated plaintext data page check tag tag tmpIf the two are consistent, the plaintext data page will be returned to the access request. Figure 1 As shown, in the encrypted file system system architecture, this embodiment uses the data encryption and decryption module and the integrity verification module to simultaneously perform encryption operations and data integrity verification operations on the encrypted file system data pages, so that the encrypted file system can simultaneously support encrypted storage and integrity verification functions for files. The encrypted file system provided by this embodiment can not only ensure the ciphertext storage of data and prevent leakage, but also detect and verify the integrity of data in real time to prevent data tampering or damage, thereby further ensuring the security and reliability of data.

[0050] In this embodiment, the encrypted file system processes files in units of plaintext data pages when performing read and write operations on them. When writing data, the encrypted file system uses the file key to perform encryption operations on the plaintext data pages through the encryption operation module, and obtains the corresponding ciphertext data pages. At the same time, the encrypted file system uses the file key to perform integrity verification operations on the plaintext data pages through the integrity verification module, and obtains the corresponding plaintext data page verification tag. Then, the encrypted file system organizes and stores the ciphertext data pages and their plaintext data page verification tags in a specific format. The ciphertext data pages and the plaintext data page verification tags are saved to the underlying file system in the form of files, and are finally written to the disk block device through the underlying file system. When reading data, the encrypted file system reads the encrypted file from the disk block device through the underlying file system, and obtains the file's ciphertext data page and its plaintext data page verification tag by parsing the data format of the encrypted file. The encrypted file system uses the file key to perform decryption operations on the ciphertext data pages through the data encryption and decryption module, and calculates the integrity verification tag of the plaintext data page through the integrity verification module. tmp , by comparing the plaintext data page verification tag tag and tag tmp value for integrity check.

[0051] like Figure 1As shown, in this embodiment, performing an encryption operation on the plaintext data page of the target file being written by the data encryption and decryption module refers to the data encryption and decryption module calling software implemented by software or calling an algorithm module implemented by a hardware accelerator to perform the encryption operation. Performing an integrity check operation on the plaintext data page by the integrity check module refers to the integrity check module calling software implemented by software or calling an algorithm module implemented by a hardware accelerator to perform the integrity check operation on the plaintext data page. Decrypting the ciphertext data page to obtain the plaintext data page by the data encryption and decryption module refers to the data encryption and decryption module calling software implemented by software or calling an algorithm module implemented by a hardware accelerator to decrypt the ciphertext data page to obtain the plaintext data page. The algorithm module can be a hardware acceleration engine in the form of a hardware card or a soft algorithm using CPU operations. Generally, the encryption operation and integrity operation are distributed and processed in parallel, which can significantly improve the processing performance of encryption, decryption, and integrity operations of the encrypted file system. It should be noted that the method of this embodiment is compatible with various encryption and decryption algorithms and integrity check algorithms, and is not dependent on the specific encryption and decryption algorithms and integrity check algorithms. Therefore, the specific implementation of the encryption and decryption algorithms and integrity check algorithms will not be described in detail here.

[0052] like Figure 2As shown, in this embodiment, the storage area for encrypted files consists of an encryption header and at least one data storage unit. The encryption header contains file encryption context information and a file key. The data storage unit includes a label area and a data area. Each plaintext data page check tag in the label area is of a fixed length, and each label area contains N plaintext data page check tags. A data area contains N blocks of fixed-length aligned data, and each fixed-length data block corresponds one-to-one with a plaintext data page check tag stored in the label area. The plaintext data page check tag after the integrity check operation on the nth block of fixed-length data in the data area under each data storage unit is stored at the location of the nth plaintext data page check tag in the label area under the same data storage unit. In the encrypted file data storage format, the encryption header, label area, and data area are stored consecutively. Relative to the underlying file system, I / O operations on the label and data areas correspond to operations on multiple page caches of the same file. This implementation avoids synchronization issues when processing labels and data, reduces inconsistencies in the storage of the label and data areas, and better ensures data consistency between the label and data areas. To accommodate special scenarios where integrity checking is not enabled, the encrypted file data storage format can be trimmed. When all label areas are trimmed, the encrypted file data format degenerates to a format without integrity checking. The encrypted file storage area consists of an encryption header and at least one data storage unit, each containing only a single data area (no label area). In this case, integrity checking is not performed on file I / O operations.

[0053] As an optional implementation, in this embodiment, each plaintext data page check tag in the label area is 32 bytes long, and a label area contains 128 plaintext data page check tags, resulting in a label area size of 4096 bytes. The phrase "a data area contains N blocks of fixed-length aligned data" means that a data area contains 128 blocks of 4096-byte aligned data. Each encrypted file in the encrypted file system begins with a 4096-byte aligned encryption header, which contains file encryption context information, a specially processed file key, and so on. Following the encryption header is the first label area. Each tag (plaintext data page check tag) in the label area is 32 bytes long, and a label area contains 128 tags. Following the label area is the data area, which is aligned to 4096 bytes. That is, each data block in the data area is 4096 bytes long, and a data area contains 128 data blocks, the same number of tags in a label area. The tag value after the integrity check operation for the nth 4096-byte block of data in each data area is stored in the nth tag position of the previous adjacent label area. After the data area, the next label area is followed, and then the data area corresponding to the next label area, and so on. In the encrypted file data storage format, the encryption header, label area, and data area are all integer multiples of 4096 bytes, consistent with the file page size of the encrypted file system and the size of a single page cache buffer in the operating system. This design can better utilize the buffer acceleration and file pre-reading functions of the virtual file system in the operating system, minimizing the impact of the labels introduced by the encrypted file system integrity check on file I / O performance.

[0054] As an optional implementation, in order to achieve compatibility with the encrypted file system, such as Figure 3As shown, the encryption file system integrity check compatibility switch in this embodiment includes two levels, one is the integrity check switch at the encryption file system level (i.e., the system integrity check switch of the encryption file system), and the other is the integrity check switch at the encryption file level (i.e., the file integrity check switch of the encryption file). Specifically, the encryption file system in this embodiment also includes a configurable system integrity check switch and a file integrity check switch. The system integrity check switch is used to control whether integrity check processing is required when IO operations are performed on files under the file system (for application scenarios with low data integrity requirements or performance-sensitive applications, the integrity check function can be turned off through the encryption file system integrity check switch). The file integrity check switch is used to control whether integrity check processing is required when IO operations are performed on corresponding files (taking into account the encryption file system upgrade scenario, when upgrading to a version that supports integrity check function when encrypted files have already been implemented, the encryption file system uses the file integrity check switch of the encrypted files to identify whether integrity check processing is required for the current file, thereby enabling the encryption file system to simultaneously support encrypted files before the upgrade and support integrity check function after the upgrade). The system performs IO processing that can encrypt files), and the integrity verification module is started only when the system integrity verification switch and the file integrity verification switch of the encrypted file are both turned on, so that for the encrypted file, the plaintext data pages of the target file written in the data encryption and decryption module are encrypted, the plaintext data pages are checked for integrity by the integrity verification module, and the encrypted file is stored in a manner that includes a label area in the data storage unit; and the integrity verification module is disabled when any one of the system integrity verification switch and the file integrity verification switch of the encrypted file is turned off or both are turned off, so that for the encrypted file, the plaintext data pages of the target file written in the data encryption and decryption module are encrypted, the plaintext data pages are not checked for integrity by the integrity verification module, and the encrypted file is stored in a manner that includes a data storage unit that does not include a label area.

[0055] In this embodiment, when reading and writing files, the encrypted file system first identifies the integrity check compatibility switches of the encrypted file system and the encrypted file, and determines whether to perform integrity check processing on the encrypted file data page based on the combination of the compatibility switches. The encrypted file system then parses the encrypted file's encryption header, extracts the encrypted file's file key, and uses the file key to perform encryption and decryption operations and integrity check operations on the encrypted file data page based on the combination of the integrity check compatibility switches. The operation results are stored according to the encrypted file data storage format or returned to the upper layer call. The encrypted file system then submits the encrypted file in a specific storage format to the underlying file system, which then submits it to the disk block device to complete the data storage. Among them, the four combinations of the system integrity check switch and the file integrity check switch of the encrypted file include: when the encrypted file system performs file IO, it first reads the integrity check switch of the file system super block, then parses the encryption header of the encrypted file, extracts the file key and the file integrity check switch of the encrypted file; if the system integrity check switch of the encrypted file system is on, and the file integrity check switch of the encrypted file is also on, then the read and write operations respectively perform encryption and decryption operations and integrity check operations on the file data, and the data storage format is based on the encrypted file data with a tag area; if the system integrity check switch of the encrypted file system is on, and the file integrity check switch of the encrypted file is off, then during the read and write operations, only encryption and decryption processing is performed, and no integrity check operation is performed, and the data storage format is based on the encrypted file data without a tag area. If the system integrity check switch of the encrypted file system is off, and the file integrity check switch of the encrypted file is also off, then during the read and write operations, only encryption and decryption processing is performed, and no integrity check operation is performed, and the data storage format is based on the encrypted file data without a tag area. If the system integrity check switch of the encrypted file system is off and the file integrity check switch of the encrypted file is on, only encryption and decryption are performed during read and write operations, and no integrity check is performed. The data storage and parsing format is the same as that of encrypted file data with a tag area.

[0056] When the access request is for writing data, the response of the encrypted file system in this embodiment includes:

[0057] S101, reading the status of the system integrity check switch and the file integrity check switch of the encrypted file. If both the system integrity check switch and the file integrity check switch are on, jump to step S102; if the system integrity check switch is off and the file integrity check switch of the encrypted file is on, jump to step S106; if the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or if the system integrity check switch is off and the file integrity check switch of the encrypted file is off, jump to step S109;

[0058] S102: When both the system integrity check switch and the encrypted file integrity check switch are on, the page number of the label area of ​​the encrypted file is calculated based on the page number corresponding to the ciphertext data page of the currently read / written encrypted file, and the corresponding label page is read into the memory page buffer;

[0059] S103, calculating the label index value n of the ciphertext data page of the currently read / written encrypted file in the label area to which it belongs based on the page number corresponding to the ciphertext data page of the currently read / written encrypted file;

[0060] S104: The encrypted file system uses the data encryption and decryption module to call a software algorithm module or a hardware accelerator to perform an encryption operation on the plaintext data page of the written target file to obtain a corresponding ciphertext data page. At the same time, the integrity check module performs an integrity check operation on the plaintext data page to obtain a corresponding plaintext data page verification tag.

[0061] S105: Calculate the file offsets of the ciphertext data page and its tag value corresponding to the underlying file system based on the page number and tag index value n of the ciphertext data page of the currently read / written encrypted file and the encrypted file data storage format with a tag area. Write the ciphertext data page and the plaintext data page check tag tag to the corresponding offsets of the underlying file system file. Finally, write the ciphertext data page and the plaintext data page check tag tag to the disk block device through the underlying file system. This write operation is completed and the program exits.

[0062] S106: When the system integrity check switch is off and the encrypted file integrity check switch is on, the file offset of the data page operated on by the encrypted file system relative to the underlying file system is calculated based on the page number corresponding to the ciphertext data page of the encrypted file currently being read or written and in accordance with the encrypted file data storage format with a label area;

[0063] S107, the encrypted file system uses the data encryption and decryption module to call a software algorithm module or a hardware accelerator to perform encryption operations on the plaintext data page of the written target file to obtain a corresponding ciphertext data page;

[0064] S108, calling the underlying file system interface, writing the ciphertext data page to the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally writing it to the disk block device through the underlying file system, completing this write operation and exiting;

[0065] S109: When the system integrity check switch is on and the file integrity check switch for the encrypted file is off, or when the system integrity check switch is off and the file integrity check switch for the encrypted file is off, calculating the file offset of the data page operated on the encrypted file system relative to the underlying file system according to the encrypted file data storage format in the unlabeled area;

[0066] S110, the encrypted file system calls a software algorithm module implemented by software or a hardware accelerator through a data encryption and decryption module to perform an encryption operation on the plaintext data page of the written target file to obtain a corresponding ciphertext data page;

[0067] S111, calling the underlying file system interface, writing the ciphertext data page to the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally writing it to the disk block device through the underlying file system. This write operation ends and exits.

[0068] When the access request is for reading data, the response of the encrypted file system in this embodiment includes:

[0069] S201, reading the status of the system integrity check switch and the file integrity check switch of the encrypted file. If both the system integrity check switch and the file integrity check switch are on, jump to step S202; if the system integrity check switch is off and the file integrity check switch of the encrypted file is on, jump to step S208; if the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or if the system integrity check switch is off and the file integrity check switch of the encrypted file is off, jump to step S212;

[0070] S202: When both the system integrity check switch and the encrypted file integrity check switch are on, the page number of the label area of ​​the encrypted file is calculated based on the page number corresponding to the ciphertext data page of the encrypted file currently being read or written, and the corresponding label page is read into the memory page buffer;

[0071] S203, calculating the label index value n of the label area to which the ciphertext data page of the currently read / written encrypted file belongs based on the page number corresponding to the ciphertext data page of the currently read / written encrypted file;

[0072] S204, the encrypted file system calculates the data page offset position and the label value offset position relative to the underlying file system according to the read data page number and the encrypted file data storage format with the label area;

[0073] S205: The encrypted file system calls the underlying file system to read the ciphertext data page and its corresponding tag value. The encrypted file system uses the data encryption and decryption module to call a software algorithm module implemented in software or a hardware accelerator based on the file key to decrypt the ciphertext data page to obtain a plaintext data page.

[0074] S206: Decrypt the ciphertext data page using the data encryption and decryption module to obtain a plaintext data page, and calculate a plaintext data page verification tag for the plaintext data page using the integrity verification module. tmp ;

[0075] S207, compare the plaintext data page verification tag tag obtained by parsing and the plaintext data page verification tag tag obtained by calculation tmp The value of the plaintext data page verification tag tag obtained by parsing and the plaintext data page verification tag tag calculated tmp If the two are consistent, the corresponding plaintext data page is returned to the access request called to the upper layer. Otherwise, an error is returned to the access request called to the upper layer, and the read operation ends and exits.

[0076] S208: When the system integrity check switch of the encrypted file system is off and the file integrity check switch of the encrypted file is on, the file offset of the data page operated on by the encrypted file system relative to the underlying file system is calculated based on the page number corresponding to the ciphertext data page of the encrypted file currently being read or written and in accordance with the encrypted file data storage format with a label area;

[0077] S209, the encrypted file system calls the underlying file system and reads the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system;

[0078] S210, the encrypted file system uses a data encryption and decryption module to call a software algorithm module implemented in software or a hardware accelerator to decrypt the ciphertext data page according to the file key to obtain a plaintext data page;

[0079] S211: The encrypted file system returns the corresponding plaintext data page to the access request called by the upper layer. Otherwise, it returns an error to the access request called by the upper layer, and the read operation ends and exits.

[0080] S212: When the system integrity check switch is on and the file integrity check switch for the encrypted file is off, or when the system integrity check switch is off and the file integrity check switch for the encrypted file is off, calculating the file offset of the data page operated on the encrypted file system relative to the underlying file system according to the encrypted file data storage format in the unlabeled area;

[0081] S213, the encrypted file system calls the underlying file system and reads the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system;

[0082] S214, the encrypted file system uses the data encryption and decryption module to call a software algorithm module implemented in software or a hardware accelerator to decrypt the ciphertext data page according to the file key to obtain a plaintext data page;

[0083] S215 , the encrypted file system returns the corresponding plaintext data page to the access request called by the upper layer, otherwise it returns an error to the access request called by the upper layer, and the current read operation ends and exits.

[0084] As an optional implementation, this embodiment further provides a read-write fusion implementation step, which specifically includes:

[0085] a) When the system integrity check switch of the encrypted file system and the file integrity check switch of the encrypted file are both on, the page number of the encrypted file tag area is calculated according to the page number corresponding to the encrypted file data page currently read and written, and the corresponding tag page is read into the memory page buffer page cache; b) According to the page number corresponding to the encrypted file data page currently read and written, the tag index value n of the page in the tag area to which it belongs is calculated; c) If the IO operation is to write data, the data encryption and decryption module of the encrypted file system calls the algorithm module, and performs encryption operation on the plaintext data page according to the file key and encryption algorithm type to obtain the ciphertext data page; d) The integrity check module of the encrypted file system calls the algorithm module, performs hmac-256 operation on the plaintext data page according to the file key, and obtains the integrity check tag of the plaintext data; e) According to the page number of the encrypted file data page and the tag index value n, the file offset position of the encrypted file data page and its tag value corresponding to the underlying file system is calculated respectively according to the encrypted file data storage format with a tag area, and the ciphertext data page and tag are written to the underlying file system respectively. The corresponding offset position of the file system file is finally written to the disk by the underlying file system, and the write operation is completed; f) If the IO operation is to read data, the encrypted file system first calculates the data page offset position and tag value offset position relative to the underlying file system according to the read data page number and the encrypted file data storage format with the tag area; g) The encrypted file system calls the underlying file system to read the ciphertext data page and its corresponding tag value; h) The data encryption and decryption module of the encrypted file system calls the algorithm module, decrypts the ciphertext data page according to the file key and encryption algorithm type, and obtains the plaintext data page; i) The integrity check module of the encrypted file system calls the algorithm module, performs HMAC-256 operation on the plaintext data page according to the file key, and obtains the integrity check tag of the plaintext data tmp ;j) Compare tag and tag tmp If the values ​​are the same, it means that the integrity check is correct and the corresponding plaintext data page is returned to the upper layer. Otherwise, an error is returned to the upper layer and the read operation ends.

[0086] k) When the system integrity check switch of the encrypted file system is off and the file integrity check switch of the encrypted file is on, the file offset position of the data page of the encrypted file operation relative to the underlying file system is calculated according to the page number corresponding to the encrypted file data page currently read and written and the encrypted file data storage format with a tag area; l) If the IO operation is to write data, the data encryption and decryption module of the encrypted file system calls the algorithm module, performs encryption operation on the plaintext data page according to the file key and encryption algorithm type, and obtains the ciphertext data page; m) Calls the underlying file system interface, writes the ciphertext data page to the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally writes it to the disk by the underlying file system, and this write operation ends; n) If the IO operation is to read data, the encrypted file system calls the underlying file system, reads the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system; o) The data encryption and decryption module of the encrypted file system calls the algorithm module, performs decryption operation on the ciphertext data page according to the file key and encryption algorithm type, and obtains the plaintext data page; p) The encrypted file system returns the corresponding plaintext data page to the upper layer, and this read operation ends.

[0087] q) When the system integrity check switch of the encrypted file system is on and the file integrity check switch of the encrypted file is off, or when the system integrity check switch of the encrypted file system is off and the file integrity check switch of the encrypted file is off, the file offset position of the data page of the encrypted file system operation relative to the underlying file system is calculated according to the encrypted file data storage format without the tag area. r) If the IO operation is to write data, the data encryption and decryption module of the encrypted file system calls the algorithm module, performs encryption operation on the plaintext data page according to the file key and encryption algorithm type, and obtains the ciphertext data page; s) Calls the underlying file system interface, writes the ciphertext data page to the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally writes it to the disk by the underlying file system, and this write operation ends; t) If the IO operation is to read data, the encrypted file system calls the underlying file system, reads the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system; u) The data encryption and decryption module of the encrypted file system calls the algorithm module, performs decryption operation on the ciphertext data page according to the file key and encryption algorithm type, and obtains the plaintext data page; v) The encrypted file system returns the corresponding plaintext data page to the upper layer, and this read operation ends.

[0088] In summary, the present embodiment introduces a file key-based integrity check module based on an existing encrypted file system. While the encrypted file system performs data encryption and decryption operations and read and write operations on a per-page basis, it also performs integrity check operations and checks on the data, providing the encrypted file system with data integrity verification capabilities while simultaneously encrypting and storing the data. The present embodiment expands the existing encrypted file data storage format of the encrypted file system by introducing a tag area for integrity verification. The tag area and the data area are both aligned to 4096 bytes, and the tag area is elastically scalable. This encrypted file data storage format effectively utilizes the operating system's page cache and its pre-reading capabilities, reducing the performance impact of the integrity check function and enabling the encrypted file system to handle both non-integrity-checked encrypted files and integrity-checked encrypted files. The present embodiment introduces an encryption file system integrity check switch and an encryption file integrity check switch. Different combinations of these two switches differentiate the data storage format and integrity check of files, enabling the encrypted file system to compatibly handle files generated before and after version upgrades. It also adapts to application scenarios where the integrity check function may need to be disabled or enabled under special circumstances.

[0089] In addition, this embodiment also provides a data integrity verification system for an encrypted file system, comprising an interconnected microprocessor and memory, wherein the microprocessor is programmed or configured to execute the data integrity verification method for the encrypted file system. This embodiment also provides a computer-readable storage medium storing a computer program or instructions, wherein the computer program or instructions are programmed or configured to execute the data integrity verification method for the encrypted file system via a processor. This embodiment also provides a computer program product, comprising a computer program or instructions, wherein the computer program or instructions are programmed or configured to execute the data integrity verification method for the encrypted file system via a processor.

[0090] Example 2:

[0091] This embodiment is essentially the same as the first embodiment, with the main difference being that the encrypted file data storage format is modified to store the data and plaintext data page check tags contiguously for each data page. That is, each 4096-byte page contains a 32-byte plaintext data page check tag and 4064 bytes of data. This approach causes each page cache in the encrypted file system to contain both data and plaintext data page check tags. This significantly impacts the existing encrypted file system code architecture, increases the difficulty of file integrity verification compatibility between versions, and reduces processing performance.

[0092] In addition, this embodiment also provides a data integrity verification system for an encrypted file system, comprising an interconnected microprocessor and memory, wherein the microprocessor is programmed or configured to execute the data integrity verification method for the encrypted file system. This embodiment also provides a computer-readable storage medium storing a computer program or instructions, wherein the computer program or instructions are programmed or configured to execute the data integrity verification method for the encrypted file system via a processor. This embodiment also provides a computer program product, comprising a computer program or instructions, wherein the computer program or instructions are programmed or configured to execute the data integrity verification method for the encrypted file system via a processor.

[0093] Example 3:

[0094] This embodiment is essentially the same as the first embodiment, with the primary difference being that the encrypted file system data and the plaintext data page check tags are stored completely separately. For example, the plaintext data page check tags are configured in a separate file system or disk area for storage. This approach flexibly adapts to scenarios where integrity checking is enabled or disabled, and offers excellent forward and backward compatibility. However, this approach significantly reduces the performance of the encrypted file system after the integrity check function is introduced, and it is difficult to ensure data consistency between the encrypted file system's encrypted file data pages and their plaintext data page check tags.

[0095] In addition, this embodiment also provides a data integrity verification system for an encrypted file system, comprising an interconnected microprocessor and memory, wherein the microprocessor is programmed or configured to execute the data integrity verification method for the encrypted file system. This embodiment also provides a computer-readable storage medium storing a computer program or instructions, wherein the computer program or instructions are programmed or configured to execute the data integrity verification method for the encrypted file system via a processor. This embodiment also provides a computer program product, comprising a computer program or instructions, wherein the computer program or instructions are programmed or configured to execute the data integrity verification method for the encrypted file system via a processor.

[0096] Example 4:

[0097] This embodiment is basically the same as the first embodiment, with the main difference being the type of integrity verification algorithm. For example, depending on the selected hash algorithm (data integrity verification algorithm), plaintext data page verification tags of different lengths are used, or the file key is not introduced as a parameter of the hash algorithm when performing integrity verification. However, this approach may reduce the randomness and accuracy of the hash algorithm.

[0098] In addition, this embodiment also provides a data integrity verification system for an encrypted file system, comprising an interconnected microprocessor and memory, wherein the microprocessor is programmed or configured to execute the data integrity verification method for the encrypted file system. This embodiment also provides a computer-readable storage medium storing a computer program or instructions, wherein the computer program or instructions are programmed or configured to execute the data integrity verification method for the encrypted file system via a processor. This embodiment also provides a computer program product, comprising a computer program or instructions, wherein the computer program or instructions are programmed or configured to execute the data integrity verification method for the encrypted file system via a processor.

[0099] Those skilled in the art should understand that the technical solutions provided by the embodiments of the present application may be in the form of methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including the instruction device, which implements the function specified in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0100] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiment. All technical solutions based on the concept of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A data integrity verification method for an encrypted file system, characterized in that: The invention includes an encrypted file system in kernel state, which utilizes a data encryption and decryption module and an integrity check module to respond to user state access requests in parallel based on the ciphertext data stored in the underlying file system. When the access request is to write data, the encrypted file system performs an encryption operation on the plaintext data page of the target file to be written through the data encryption and decryption module to obtain the corresponding ciphertext data page, and at the same time performs an integrity check operation on the plaintext data page through the integrity check module to obtain the corresponding plaintext data page check tag, organizes and stores the ciphertext data page and its plaintext data page check tag in a specified format, saves it to the underlying file system in the form of an encrypted file, and finally writes it to the disk block device through the underlying file system; when the access request is to read data, the encrypted file system reads the encrypted file from the disk block device through the underlying file system, obtains the ciphertext data page and its plaintext data page check tag of the target file by parsing the data format of the encrypted file, decrypts the ciphertext data page through the data encryption and decryption module to obtain the plaintext data page, and calculates the plaintext data page check tag for the plaintext data page through the integrity check module. tmp , if the parsed plaintext data page check tag tag, the calculated plaintext data page check tag tag tmp If the two are consistent, the obtained plaintext data page will be returned to the access request; the encrypted file system also includes a configurable system integrity check switch and a file integrity check switch, the system integrity check switch is used to control whether integrity check processing is required when an IO operation is performed on a file under the file system, and the file integrity check switch is used to control whether integrity check processing is required when an IO operation is performed on the corresponding file, and the integrity check module is started only when the system integrity check switch and the file integrity check switch of the encrypted file are both turned on, so that the plaintext data page of the written target file is encrypted by the data encryption and decryption module, the plaintext data page is integrity checked by the integrity check module, and the encrypted file is stored in a manner that includes a label area in the data storage unit; and when any one of the system integrity check switch and the file integrity check switch of the encrypted file is turned off or both are turned off, the integrity check module is disabled, so that the plaintext data page of the written target file is encrypted by the data encryption and decryption module only, the plaintext data page is not integrity checked by the integrity check module, and the encrypted file is stored in a manner that does not include a label area in the data storage unit.

2. The data integrity verification method for an encrypted file system according to claim 1, wherein: The encryption operation on the plaintext data page of the written target file through the data encryption and decryption module refers to the data encryption and decryption module calling the software implemented by the software or calling the algorithm module implemented by the hardware accelerator to perform the encryption operation; the integrity verification operation on the plaintext data page through the integrity verification module refers to the integrity verification module calling the software implemented by the software or calling the algorithm module implemented by the hardware accelerator to perform the integrity verification operation on the plaintext data page; the decryption operation on the ciphertext data page to obtain the plaintext data page through the data encryption and decryption module refers to the data encryption and decryption module calling the software implemented by the software or calling the algorithm module implemented by the hardware accelerator to decrypt the ciphertext data page to obtain the plaintext data page.

3. The data integrity verification method for an encrypted file system according to claim 1, wherein: The storage area of ​​the encrypted file consists of an encryption header and at least one data storage unit. The encryption header contains file encryption context information and a file key. The data storage unit includes a label area and a data area. Each plaintext data page check tag in the label area has a fixed length. A label area contains N plaintext data page check tags. A data area contains N blocks of data aligned with a fixed length. Each block of fixed-length data corresponds one-to-one to a plaintext data page check tag stored in the tag area, so that the plaintext data page check tag after the integrity check operation of the n-th block of fixed-length data in the data area under each data storage unit is stored in the position of the n-th plaintext data page check tag in the tag area under the same data storage unit.

4. The data integrity verification method for an encrypted file system according to claim 3, wherein: Each plaintext data page check tag tag in the label area is 32 bytes in length, and a label area contains 128 plaintext data page check tag tags, so that the size of a label area is 4096 bytes; the data area containing N blocks of data aligned at a fixed length means that a data area contains 128 blocks of data aligned at 4096 bytes.

5. The data integrity verification method for an encrypted file system according to claim 1, wherein: When the access request is for writing data, the response of the encrypted file system includes: S101, reading the status of the system integrity check switch and the file integrity check switch of the encrypted file. If both the system integrity check switch and the file integrity check switch are on, jump to step S102; if the system integrity check switch is off and the file integrity check switch of the encrypted file is on, jump to step S106; if the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or if the system integrity check switch is off and the file integrity check switch of the encrypted file is off, jump to step S109; S102: When both the system integrity check switch and the encrypted file integrity check switch are on, the page number of the label area of ​​the encrypted file is calculated based on the page number corresponding to the ciphertext data page of the currently read / written encrypted file, and the corresponding label page is read into the memory page buffer; S103, calculating the label index value n of the ciphertext data page of the currently read / written encrypted file in the label area to which it belongs based on the page number corresponding to the ciphertext data page of the currently read / written encrypted file; S104: The encrypted file system uses the data encryption and decryption module to call a software algorithm module or a hardware accelerator to perform an encryption operation on the plaintext data page of the written target file to obtain a corresponding ciphertext data page. At the same time, the integrity check module performs an integrity check operation on the plaintext data page to obtain a corresponding plaintext data page verification tag. S105: Calculate the file offsets of the ciphertext data page and its tag value corresponding to the underlying file system based on the page number and tag index value n of the ciphertext data page of the currently read / written encrypted file and the encrypted file data storage format with a tag area. Write the ciphertext data page and the plaintext data page check tag tag to the corresponding offsets of the underlying file system file. Finally, write the ciphertext data page and the plaintext data page check tag tag to the disk block device through the underlying file system. This write operation is completed and the program exits. S106: When the system integrity check switch is off and the encrypted file integrity check switch is on, the file offset of the data page operated on by the encrypted file system relative to the underlying file system is calculated based on the page number corresponding to the ciphertext data page of the encrypted file currently being read or written and in accordance with the encrypted file data storage format with a label area; S107, the encrypted file system uses the data encryption and decryption module to call a software algorithm module or a hardware accelerator to perform encryption operations on the plaintext data page of the written target file to obtain a corresponding ciphertext data page; S108, calling the underlying file system interface, writing the ciphertext data page to the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally writing it to the disk block device through the underlying file system, completing this write operation and exiting; S109: When the system integrity check switch is on and the file integrity check switch for the encrypted file is off, or when the system integrity check switch is off and the file integrity check switch for the encrypted file is off, calculating the file offset of the data page operated on the encrypted file system relative to the underlying file system according to the encrypted file data storage format in the unlabeled area; S110, the encrypted file system calls a software algorithm module implemented by software or a hardware accelerator through a data encryption and decryption module to perform an encryption operation on the plaintext data page of the written target file to obtain a corresponding ciphertext data page; S111, calling the underlying file system interface, writing the ciphertext data page to the underlying file system according to the file offset of the ciphertext data page relative to the underlying file system, and finally writing it to the disk block device through the underlying file system. This write operation ends and exits.

6. The data integrity verification method for an encrypted file system according to claim 1, wherein: When the access request is for reading data, the response of the encrypted file system includes: S201, reading the status of the system integrity check switch and the file integrity check switch of the encrypted file. If both the system integrity check switch and the file integrity check switch are on, jump to step S202; if the system integrity check switch is off and the file integrity check switch of the encrypted file is on, jump to step S208; if the system integrity check switch is on and the file integrity check switch of the encrypted file is off, or if the system integrity check switch is off and the file integrity check switch of the encrypted file is off, jump to step S212; S202: When both the system integrity check switch and the encrypted file integrity check switch are on, the page number of the label area of ​​the encrypted file is calculated based on the page number corresponding to the ciphertext data page of the encrypted file currently being read or written, and the corresponding label page is read into the memory page buffer; S203, calculating the label index value n of the label area to which the ciphertext data page of the currently read / written encrypted file belongs based on the page number corresponding to the ciphertext data page of the currently read / written encrypted file; S204, the encrypted file system calculates the data page offset position and the label value offset position relative to the underlying file system according to the read data page number and the encrypted file data storage format with the label area; S205: The encrypted file system calls the underlying file system to read the ciphertext data page and its corresponding tag value. The encrypted file system uses the data encryption and decryption module to call a software algorithm module implemented in software or a hardware accelerator based on the file key to decrypt the ciphertext data page to obtain a plaintext data page. S206: Decrypt the ciphertext data page using the data encryption and decryption module to obtain a plaintext data page, and calculate a plaintext data page verification tag for the plaintext data page using the integrity verification module. tmp ; S207, compare the plaintext data page verification tag tag obtained by parsing and the plaintext data page verification tag tag obtained by calculation tmp The value of the plaintext data page verification tag tag obtained by parsing and the plaintext data page verification tag tag calculated tmp If the two are consistent, the corresponding plaintext data page is returned to the access request called to the upper layer. Otherwise, an error is returned to the access request called to the upper layer, and the read operation ends and exits. S208: When the system integrity check switch of the encrypted file system is off and the file integrity check switch of the encrypted file is on, the file offset of the data page operated on by the encrypted file system relative to the underlying file system is calculated based on the page number corresponding to the ciphertext data page of the encrypted file currently being read or written and in accordance with the encrypted file data storage format with a label area; S209, the encrypted file system calls the underlying file system and reads the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system; S210, the encrypted file system uses a data encryption and decryption module to call a software algorithm module implemented in software or a hardware accelerator to decrypt the ciphertext data page according to the file key to obtain a plaintext data page; S211: The encrypted file system returns the corresponding plaintext data page to the access request called by the upper layer. Otherwise, it returns an error to the access request called by the upper layer, and the read operation ends and exits. S212: When the system integrity check switch is on and the file integrity check switch for the encrypted file is off, or when the system integrity check switch is off and the file integrity check switch for the encrypted file is off, calculating the file offset of the data page operated on the encrypted file system relative to the underlying file system according to the encrypted file data storage format in the unlabeled area; S213, the encrypted file system calls the underlying file system and reads the ciphertext data page according to the file offset position of the currently accessed data page relative to the underlying file system; S214, the encrypted file system uses the data encryption and decryption module to call a software algorithm module implemented in software or a hardware accelerator to decrypt the ciphertext data page according to the file key to obtain a plaintext data page; S215 , the encrypted file system returns the corresponding plaintext data page to the access request called by the upper layer, otherwise it returns an error to the access request called by the upper layer, and the current read operation ends and exits.

7. A data integrity verification system for an encrypted file system, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the data integrity verification method of the encrypted file system according to any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the data integrity verification method of the encrypted file system according to any one of claims 1 to 6 through a processor.

9. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the data integrity verification method of the encrypted file system according to any one of claims 1 to 6 through a processor.

Images