Data encryption method, data encryption device and electronic equipment

Abstract

The invention provides a data encryption method, a data encryption device and electronic equipment, which can be applied to the technical field of data processing. The data encryption method comprises the following steps: under the condition that at least one mobile memory is connected with a control cluster system, generating a permanent key, an access management key and a data encryption key, and storing the permanent key in the mobile memory; packaging the permanent key, the access management key and the data encryption key to obtain a first data access key, and storing the first data access key in a control cluster system; in response to the first encryption instruction, performing data encryption by using a first data access key stored in the control cluster system; and in response to the second encryption instruction, performing data encryption by using a permanent key stored in the mobile memory and a first data access key stored in the control cluster system.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data encryption method, a data encryption device and electronic device, a computer-readable storage medium, and a computer program product. Background Art

[0002] With the acceleration of digital transformation, storage systems have become core infrastructure for businesses, governments, and individuals, with applications spanning cloud computing and big data, the Internet of Things, finance, and government affairs. Frequent data breaches have made storage encryption technology a core requirement, making the introduction of data encryption essential for systems dedicated to storage services.

[0003] However, the existing technology is prone to causing key leakage when performing data encryption, thereby reducing the security of the encrypted data. Summary of the Invention

[0004] In view of the above problems, the present application provides a data encryption method, a data encryption device and electronic device, a computer-readable storage medium and a computer program product.

[0005] According to a first aspect of the present application, a data encryption method is provided, which is applied to a control cluster system. The method includes:

[0006] generating a permanent key, an access management key, and a data encryption key when at least one mobile storage is connected to the control cluster system, and storing the permanent key in the mobile storage;

[0007] Encapsulating the permanent key, the access management key, and the data encryption key to obtain a first data access key, and storing the first data access key in the control cluster system;

[0008] In response to the first encryption instruction, encrypt the data using a first data access key stored in the control cluster system;

[0009] In response to the second encryption instruction, data encryption is performed using the permanent key stored in the mobile memory and the first data access key stored in the control cluster system.

[0010] A second aspect of the present application provides a data encryption device, comprising:

[0011] a key management module, configured to generate a permanent key, an access management key, and a data encryption key when at least one mobile storage is connected to the control cluster system, and store the permanent key in the mobile storage;

[0012] an encryption management module, configured to encapsulate the permanent key, the access management key, and the data encryption key to obtain a first data access key, and store the first data access key in the control cluster system;

[0013] The encryption processing module is used to encrypt data using the first data access key stored in the control cluster system in response to a first encryption instruction; and to encrypt data using the permanent key stored in the mobile memory and the first data access key stored in the control cluster system in response to a second encryption instruction.

[0014] The third aspect of the present application provides an electronic device, comprising: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0015] The fourth aspect of the present application further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the computer program or instructions are executed by a processor.

[0016] The fifth aspect of the present application further provides a computer program product, comprising a computer program or instructions, which implement the steps of the above method when executed by a processor.

[0017] According to an embodiment of the present application, a permanent key, an access management key, and a data encryption key are generated when a mobile storage device is connected to a control cluster system, and the permanent key is stored in the mobile storage device. At the same time, the permanent key, the access management key, and the data encryption key are encapsulated to obtain a first data access key stored in the control cluster system. In response to different encryption instructions, data encryption can be performed using the first data access key stored in the control cluster system or in combination with the permanent key stored in the mobile storage device. Since the permanent key and the first data access key are stored in the mobile storage device and the control cluster system, respectively, different keys can be used for data encryption under different encryption instructions. By storing the permanent key in the mobile storage device to separate the key and the data, data security can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above contents and other objects, features and advantages of the present application will become more apparent through the following description of the embodiments of the present application with reference to the accompanying drawings, in which:

[0019] Figure 1 The following schematically illustrates an application scenario of the data encryption method according to an embodiment of the present application;

[0020] Figure 2 The following schematically shows a flow chart of a data encryption method according to an embodiment of the present application;

[0021] Figure 3 Schematically shows a flow chart of a data encryption method according to another embodiment of the present application

[0022] Figure 4 Schematically shows a flow chart of a data encryption method according to another embodiment of the present application

[0023] Figure 5 Schematically shows a flow chart of a data encryption method according to another embodiment of the present application

[0024] Figure 6 The following schematically shows a structural block diagram of a data encryption device according to an embodiment of the present application;

[0025] Figure 7 The following schematically shows a logic diagram between a data encryption device and a control cluster system according to an embodiment of the present application;

[0026] Figure 8 A block diagram of an electronic device suitable for implementing the above method according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0027] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present application. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present application. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessarily confusing the concepts of the present application.

[0028] The terms used herein are only for describing specific embodiments and are not intended to limit this application. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0029] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0030] When expressions such as "at least one of A, B, and C, etc." are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0031] Data encryption converts plaintext data into unreadable ciphertext data, ensuring that even if the data is intercepted, unauthorized users cannot understand its content, thereby protecting the confidentiality of the data.

[0032] Related technologies mainly rely on hardware encryption when using encryption algorithms to encrypt data. This method requires additional encryption and decryption devices to encrypt and decrypt data.

[0033] In view of this, an embodiment of the present application provides a data encryption method, a data encryption device and an electronic device, a computer-readable storage medium and a computer program product. The data encryption method includes generating a permanent key, an access management key and a data encryption key when at least one mobile storage is connected to a control cluster system, and storing the permanent key in the mobile storage; encapsulating the permanent key, the access management key and the data encryption key to obtain a first data access key, and storing the first data access key in the control cluster system; in response to a first encryption instruction, using the first data access key stored in the control cluster system to encrypt data; in response to a second encryption instruction, using the permanent key stored in the mobile storage and the first data access key stored in the control cluster system to encrypt data.

[0034] In the technical solution of this application, the data involved (including but not limited to data used for analysis, stored data, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0035] Figure 1 The following schematically illustrates an application scenario diagram of a data encryption method according to an embodiment of the present application.

[0036] like Figure 1As shown, the control cluster system includes a host 101, a controller 102, and a storage device 104. The host 101 can generate plaintext data, and the controller 102 can encrypt the plaintext data to obtain ciphertext data. The storage device 104 can store ciphertext data. The storage device 104 includes but is not limited to a hard disk. A mobile storage device 103 can be connected to the cluster system. The encryption method of the embodiment of the present disclosure can be executed by the controller 102 of the control cluster system. Figure 1 Although a single controller 102 and storage device 104 are used as an example for illustration, the embodiments of the present application are not limited thereto. A control cluster system may include multiple controllers 102 and multiple storage devices 104. The generated encrypted data may be stored in a storage pool of the cluster control system. A storage pool refers to the integration of multiple storage devices 104 into a single, logically large-capacity storage unit.

[0037] According to an embodiment of the present application, a multiple controller system (MCS) is a distributed system architecture primarily characterized by centralized management and control of multiple nodes through multiple controllers 102. MCSs are typically used to improve system reliability and flexibility and are suitable for scenarios requiring high concurrency processing and fault recovery capabilities.

[0038] The following will be based on Figure 1 The scene described by Figures 2 to 5 The data encryption method of the disclosed embodiment is described in detail.

[0039] Figure 2 The flowchart of the data encryption method according to the embodiment of the present application is schematically shown.

[0040] like Figure 2 As shown, the data encryption method applied to the control cluster system of this embodiment includes operations S210 to S240.

[0041] In operation S210 , when at least one mobile storage is connected to the control cluster system, a permanent key, an access management key, and a data encryption key are generated, and the permanent key is stored in the mobile storage.

[0042] In operation S220 , the permanent key, the access management key, and the data encryption key are encapsulated to obtain a first data access key, and the first data access key is stored in the control cluster system.

[0043] In operation S230 , in response to the first encryption instruction, data encryption is performed using a first data access key stored in the control cluster system.

[0044] In operation S240 , in response to the second encryption instruction, data encryption is performed using the permanent key stored in the mobile memory and the first data access key stored in the control cluster system.

[0045] According to the embodiments of the present application, a mobile memory is a convenient medium for information exchange, which has the characteristics of small size and large capacity, such as a universal serial bus memory, a mobile hard disk, a floppy disk, an optical disk, a memory card, etc.

[0046] According to an embodiment of the present application, a permanent key (Persistent Master Key, PMK) is a key with a long validity period. It will not expire automatically by default and is suitable for application scenarios that require long-term stable operation. The Master Access Key (MAK) is a random number generated by the system. The Master Access Key (MAK) is used as the master key to encrypt the Data Encryption Key (DEK). The Data Encryption Key (DEK) is the key used by the encryption and decryption algorithm to encrypt data. It is a string of characters used to change data to make it appear random, similar to a physical key. Only people with a matching key can decrypt the data. The Data Access Key (DAK) refers to the key used to access data. The Data Access Key is generated by encrypting the Data Encryption Key.

[0047] According to an embodiment of the present application, when it is confirmed that at least one mobile storage device (for example, three) is connected to the control cluster system, a permanent key, an access management key, and a data encryption key are generated, and the permanent key is stored in the mobile storage device. After the permanent key is stored in the mobile storage device, the connection between the mobile storage device and the control cluster system can be disconnected to ensure the security of the permanent key.

[0048] According to an embodiment of the present application, a data encryption key (DEK) is encapsulated based on a permanent key and an access management key to obtain a first data access key (DAK). The first data access key is a key used to access data. The first data access key is stored in the memory of the control cluster system.

[0049] According to an embodiment of the present application, during the data encryption process, it is necessary to determine the type of encryption instruction and use different keys for data encryption according to different encryption instructions. For example, when the encryption instruction is a first encryption instruction, the data access key stored in the memory of the control cluster system can be used to encrypt the data. When the encryption instruction is a second encryption instruction, the permanent key stored in the mobile memory and the first data access key stored in the control cluster system can be used to encrypt the data.

[0050] According to an embodiment of the present application, a permanent key, an access management key, and a data encryption key are generated when a mobile storage device is connected to a control cluster system, and the permanent key is stored in the mobile storage device. At the same time, the permanent key, the access management key, and the data encryption key are encapsulated to obtain a first data access key stored in the control cluster system. In response to different encryption instructions, data encryption can be performed using the first data access key stored in the control cluster system or in combination with the permanent key stored in the mobile storage device. Since the permanent key and the first data access key are stored in the mobile storage device and the control cluster system, respectively, different keys can be used for data encryption under different encryption instructions. By storing the permanent key in the mobile storage device to separate the key and the data, data security can be improved.

[0051] Figure 3 The following schematically shows a flow chart of a data encryption method according to another embodiment of the present application.

[0052] According to an embodiment of the present application, the permanent key, the access management key and the data encryption key are encapsulated to obtain a first data access key, including: encapsulating the permanent key and the access management key to obtain a first key encryption key; and using the first key encryption key to encapsulate the data encryption key to obtain a first data access key.

[0053] According to an embodiment of the present application, a Key Encryption Key (KEK) refers to a key used to encrypt other keys.

[0054] According to the embodiments of this application, see Figure 3 In operation S301, the key management module (Key Manager, KeyMgr) first generates a permanent key PMK and an access management key MAK, and then in operation S302 stores the permanent key PMK in at least one mobile storage. Thereafter, in the encapsulation process, first in operation S303, the encryption processing module calls the encryption management module (OpenSSL) to encapsulate the permanent key and the access management key to obtain the first key encryption key, i.e. Figure 3 After the key management module generates the data encryption key, in operation S304, the encryption processing module calls the encryption management module to use the first key encryption key to encapsulate the data encryption key DEK, thereby obtaining the first data access key, that is, Figure 3 Finally, in operation S305, the first data access key is stored in the control cluster system.

[0055] According to an embodiment of the present application, by encapsulating the permanent key and the access management key into a first key encryption key and using the first key encryption key to perform secondary encryption on the data encryption key, the risk of data leakage can be reduced, thereby improving data security.

[0056] According to an embodiment of the present application, the first encryption instruction is an instruction to store target data in the storage pool of the control cluster system when the control cluster system is working, and the data is encrypted using the first data access key stored in the control cluster system, including: encrypting the target data using the first data access key, and storing the encrypted target data in the storage pool of the control cluster system.

[0057] According to an embodiment of the present application, when performing data encryption, if it is necessary to store the target data in the storage pool of the control cluster system, the control cluster system sends the target data to the storage pool, thereby encrypting the target data using the first data access key stored in the control cluster system, and then storing the encrypted target data in the storage pool of the control cluster system.

[0058] Figure 4 The following schematically shows a flow chart of a data encryption method according to another embodiment of the present application.

[0059] According to an embodiment of the present application, target data is encrypted using a first data access key, including: upon confirming that the storage pool has a pool encryption label, parsing the first data access key to obtain a data encryption key encapsulated in the data access key, wherein the pool encryption label indicates that the storage pool is a storage pool in which data needs to be stored encrypted; and encrypting the target data using the parsed data encryption key.

[0060] According to the embodiments of this application, see Figure 4During data encryption, the target data is first delivered to the storage pool in operation S401. In operation S402, the volume group (VG) management module determines whether the storage pool has a pool encryption tag (dak-tag). If the pool encryption tag is confirmed, the encryption call module uses the encryption processing module to request a key. In operation S403, the encryption processing module obtains a first data access key (DAK) from the control cluster system and sends the DAK to the encryption call module. The encryption call module parses the DAK to obtain the data encryption key (DEK) encapsulated in the DAK. In operation S404, the encryption algorithm in the encryption management module uses the DEK to encrypt the target data, obtaining the encrypted target data. In operation S405, the encrypted target data is stored in the storage pool (i.e., the encryption pool). Similarly, the encryption management module can use the data encryption key encapsulated in the first DAK to decrypt the encrypted target data stored in the storage pool.

[0061] According to embodiments of the present application, the pool management module is a key component of the Logical Volume Manager (LVM). It is used to combine multiple physical volumes (PVs) into a large logical storage pool for more flexible management and allocation of storage space. A physical volume refers to a physical storage device or its partitions, such as a hard disk or solid-state drive.

[0062] According to an embodiment of the present application, in operation S402, if the pool management module determines that the storage pool does not have a pool encryption tag dak-tag, it means that the storage pool is a storage pool for storing non-encrypted data. At this time, the target data can be not encrypted, and the target data is directly stored in the non-encrypted storage pool, that is, the non-encrypted pool, in operation S406.

[0063] According to an embodiment of the present application, by determining whether a pool encryption tag exists when data is encrypted, the encrypted and non-encrypted target data are stored in an encryption pool or a non-encrypted storage pool, thereby achieving the coexistence of encrypted and non-encrypted services, thereby improving the storage convenience during data storage.

[0064] According to an embodiment of the present application, the data encryption method further includes: in response to a received encryption activation instruction, determining whether the encryption authorization license is activated; and generating a permanent key, an access management key, and a data encryption key if the encryption authorization license is activated.

[0065] According to the embodiments of this application, see Figure 3After a user enters an encryption configuration instruction on the user interface of the client, requiring encryption of target data, the client responds to the encryption configuration instruction by activating the encryption authorization license through the license manager in operation S311, thereby enabling the encryption function in operation S312. In operation S313, if the license manager confirms the activation of the encryption authorization license, the encryption module (IC encryption) in the license manager converts the encryption configuration instruction format and then transmits the converted encryption configuration instruction to the encryption processing module. In operation S314, if the mobile storage device is connected to the control cluster system, the encryption processing module calls the key management module to generate a permanent key, an access management key, and a data encryption key.

[0066] According to an embodiment of the present application, the user interface may refer to a graphical user interface (GUI) or a command-line interface (CLI), etc.

[0067] According to an embodiment of the present application, after the key management module generates the key, the key management module can also generate an instruction execution result for the encryption configuration instruction, save the instruction execution result in the control cluster system, and transmit it to the encryption processing module through a message queue, and then feed it back to the user interface.

[0068] According to an embodiment of the present application, a license manager authorizes users in need to encrypt data, thereby improving the convenience of data encryption.

[0069] Figure 5 The following schematically shows a flow chart of a data encryption method according to another embodiment of the present application.

[0070] According to an embodiment of the present application, the second encryption instruction is an instruction to store target data in the storage pool of the control cluster system when the control cluster system is restarted, and data encryption is performed using the permanent key stored in the mobile memory and the first data access key stored in the control cluster system, including: generating a second data access key based on the permanent key stored in the mobile memory and the access management key and the first data access key stored in the control cluster system; encrypting the target data using the second data access key, and storing the encrypted target data in the storage pool of the control cluster system.

[0071] According to the embodiments of this application, see Figure 5When the control cluster system is turned on or restarted, the system disk of the control cluster system only retains the access management key MAK and data access key DAK when the control cluster system was working normally last time. After the restart, the data access key DAK can no longer be used for data encryption. At this time, the control cluster system responds to the second encryption instruction and can obtain the permanent key from the mobile storage and the access management key and the first data access key from the control cluster system.

[0072] According to an embodiment of the present application, a second data access key DAK is generated based on the permanent key PMK, the access management key MAK and the data access key DAK stored in the control cluster system, so that the target data is encrypted using the second data access key DAK, and the encrypted target data is stored in the storage pool of the control cluster system.

[0073] According to an embodiment of the present application, if the control cluster system is not connected to the mobile storage after restarting, the encrypted storage pool in the control cluster system is offline and cannot be used, thereby ensuring the security of encrypted data.

[0074] According to an embodiment of the present application, a second data access key is generated based on the permanent key stored in the mobile memory and the access management key and the first data access key stored in the control cluster system, including: generating a second key encryption key based on the permanent key stored in the mobile memory and the access management key stored in the control cluster system; parsing the first data access key in the control cluster system based on the second key encryption key to obtain a data encryption key; encapsulating the data encryption key using the second key encryption key to obtain a second data access key, and storing the second data access key in the control cluster system.

[0075] According to the embodiments of this application, see Figure 5 Since data encryption and decryption requires the use of the data encryption key in the data access key DAK, and the key encryption key stored in the memory of the control cluster system is lost when the control cluster system is restarted, the key encryption key cannot be used to parse the data encryption key from the first data access key DAK during data encryption and decryption. Therefore, the second key encryption key KEK can be generated based on the permanent key PMK stored in the mobile memory and the access management key MAK stored in the control cluster system.

[0076] According to an embodiment of the present application, the first data access key DAK in the control cluster system is parsed using the second key encryption key KEK to obtain a data encryption key, and then the data encryption key DEK is encapsulated using the second key encryption key KEK to generate a second data access key DAK, and the second data access key DAK is stored in the control cluster system, and then the second data access key DAK can be used to encrypt and decrypt data.

[0077] According to an embodiment of the present application, target data is encrypted using a second data access key, including: upon confirming that the storage pool has a pool encryption label, parsing the second data access key to obtain a data encryption key encapsulated in the second data access key, wherein the pool encryption label indicates that the storage pool is a storage pool in which data needs to be stored encrypted; and encrypting the target data using the parsed data encryption key.

[0078] According to an embodiment of the present application, when using the second data access key for data encryption, it is also necessary to determine whether the storage pool has a pool encryption tag (dak-tag). If the pool encryption tag is confirmed, the second data access key is obtained from the control cluster system to parse the second data access key to obtain the data encryption key encapsulated in the second data access key. The encryption algorithm uses the data encryption key to encrypt the target data to obtain the encrypted target data, and then the encrypted target data is stored in the storage pool. Similarly, the data encryption key encapsulated in the second data access key can be used to decrypt the encrypted target data stored in the storage pool.

[0079] According to an embodiment of the present application, if it is determined that the storage pool does not have a pool encryption tag dak-tag, it means that the storage pool is a storage pool for storing non-encrypted data. At this time, the target data may not be encrypted, but may be directly stored in the storage pool.

[0080] According to an embodiment of the present application, before storing the encrypted target data in the encrypted storage pool, the storage pool needs to be encrypted configured to obtain a configured storage pool so that the encrypted data to be stored can be stored in the storage pool.

[0081] According to the embodiments of this application, see Figure 4 The specific process of configuring encryption for a storage pool is as follows:

[0082] If it is confirmed in operation S411 that the storage pool is to be encrypted, an encryption function of the storage pool may be started in operation S412 .

[0083] In operation S413 , a pool address label dak-id and a pool encryption label dak-tag of the storage pool are generated by using a key management module, wherein the pool address label dak-id indicates a storage address of the storage pool.

[0084] In operation S414 , the pool address tag dak-id and the pool encryption tag dak-tag are transmitted to the pool management module.

[0085] In operation S415 , the pool management module transmits the pool encryption tag dak-tag to the encryption calling module, thereby obtaining the storage pool configured in operation S416 , ie, the encryption pool.

[0086] In operation S417 , if it is determined that the storage pool is not to be encrypted, the storage pool is confirmed as a non-encrypted storage pool, so that the non-encrypted storage pool can be used to store target data that does not require encryption.

[0087] Figure 6 The structural block diagram of the data encryption device according to an embodiment of the present application is schematically shown.

[0088] like Figure 6 As shown, the data encryption device 600 of this embodiment includes a key management module 610 , an encryption management module 620 , and an encryption processing module 630 .

[0089] The key management module 610 is configured to generate a permanent key, an access management key, and a data encryption key when at least one mobile storage is connected to the control cluster system, and store the permanent key in the mobile storage.

[0090] The encryption management module 620 is configured to encapsulate the permanent key, the access management key, and the data encryption key to obtain a first data access key, and store the first data access key in the control cluster system.

[0091] The encryption processing module 630 is used to encrypt data using the first data access key stored in the control cluster system in response to the first encryption instruction; and to encrypt data using the permanent key stored in the mobile memory and the first data access key stored in the control cluster system in response to the second encryption instruction.

[0092] According to an embodiment of the present application, a permanent key, an access management key, and a data encryption key are generated when a mobile storage device is connected to a control cluster system, and the permanent key is stored in the mobile storage device. At the same time, the permanent key, the access management key, and the data encryption key are encapsulated to obtain a first data access key stored in the control cluster system. In response to different encryption instructions, data encryption can be performed using the first data access key stored in the control cluster system or in combination with the permanent key stored in the mobile storage device. Since the permanent key and the first data access key are stored in the mobile storage device and the control cluster system, respectively, different keys can be used for data encryption under different encryption instructions. By storing the permanent key in the mobile storage device to separate the key and the data, data security can be improved.

[0093] According to an embodiment of the present application, the encryption management module 620 includes a first encapsulation unit and a second encapsulation unit.

[0094] The first encapsulation unit is used to encapsulate the permanent key and the access management key to obtain a first key encryption key.

[0095] The second encapsulation unit is used to encapsulate the data encryption key using the first key encryption key to obtain a first data access key.

[0096] According to an embodiment of the present application, the first encryption instruction is an instruction for storing target data in a storage pool of the control cluster system when the control cluster system is operating.

[0097] According to an embodiment of the present application, the encryption processing module 630 includes a first encryption unit.

[0098] The first encryption unit is configured to encrypt target data using a first data access key, and store the encrypted target data in a storage pool of the control cluster system.

[0099] According to an embodiment of the present application, the first encryption unit includes a first parsing subunit and a first encryption subunit.

[0100] The first parsing subunit is configured to parse the first data access key to obtain a data encryption key encapsulated in the data access key when confirming that the storage pool has a pool encryption tag, wherein the pool encryption tag indicates that the storage pool is a storage pool requiring encrypted data storage.

[0101] The first encryption subunit is used to encrypt the target data using the data encryption key obtained by parsing.

[0102] According to an embodiment of the present application, the data encryption device 600 further includes a judgment module.

[0103] The determination module is configured to determine whether the encryption authorization license is activated in response to receiving the encryption activation instruction.

[0104] The key management module is used to generate permanent keys, access management keys, and data encryption keys when the encryption authorization license is activated.

[0105] According to an embodiment of the present application, the second encryption instruction is an instruction to store target data in a storage pool of the control cluster system when the control cluster system is restarted.

[0106] According to an embodiment of the present application, the encryption processing module 630 further includes a generation unit and a second encryption unit.

[0107] The generating unit is configured to generate a second data access key according to the permanent key stored in the mobile storage and the access management key and the first data access key stored in the control cluster system.

[0108] The second encryption unit is configured to encrypt the target data using the second data access key, and store the encrypted target data in the storage pool of the control cluster system.

[0109] According to an embodiment of the present application, the generating unit includes a generating subunit, a parsing subunit, and an obtaining subunit.

[0110] The generating subunit is used to generate a second key encryption key according to the permanent key stored in the mobile storage and the access management key stored in the control cluster system.

[0111] The parsing subunit is configured to parse the first data access key in the control cluster system based on the second key encryption key to obtain a data encryption key.

[0112] The obtaining subunit is configured to encapsulate the data encryption key using the second key encryption key to obtain a second data access key, and store the second data access key in the control cluster system.

[0113] According to an embodiment of the present application, the second encryption unit includes a second parsing subunit and a second encryption subunit.

[0114] The second parsing subunit is configured to parse the second data access key to obtain the data encryption key encapsulated in the second data access key when confirming that the storage pool has a pool encryption tag, wherein the pool encryption tag indicates that the storage pool is a storage pool requiring encrypted data storage.

[0115] The second encryption subunit is used to encrypt the target data using the data encryption key obtained by parsing.

[0116] According to embodiments of the present application, any multiple modules among the key management module 610, encryption management module 620, and encryption processing module 630 may be combined into a single module, or any one of these modules may be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of other modules and implemented in a single module. According to embodiments of the present application, at least one of the key management module 610, encryption management module 620, and encryption processing module 630 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or may be implemented in hardware or firmware through any other reasonable means of circuit integration or packaging, or may be implemented in any one of the three implementation methods of software, hardware, and firmware, or any appropriate combination of these. Alternatively, at least one of the key management module 610, encryption management module 620, and encryption processing module 630 may be at least partially implemented as a computer program module that, when executed, performs the corresponding functionality.

[0117] Figure 7 The following schematically shows a logic diagram between a data encryption device and a control cluster system according to an embodiment of the present application.

[0118] like Figure 7 As shown, after the user enters the encryption configuration instruction that requires encrypting the target data on the user interface of the user end, the compatibility support module (IC Compatibility Support Module, IC CSM) of the user end responds to the encryption configuration instruction and retrieves the license from the software authorization license (Encryption License) module, and activates the encryption authorization license through the encryption module (IC_encryption_csm) of the license manager. After that, the compatibility support module parses the encryption configuration instruction and converts it into an internal processing format, and then sends the command to the encryption processing module for execution.

[0119] Among them, the compatibility support module is connected to the encryption processing module and the encryption management module through the pool management module (VG CSM), the management monitoring module (RAID CSM) and the protocol management module (VL CSM) respectively. The pool management module (VG CSM), the management monitoring module (RAID CSM) and the protocol management module (VL CSM) process data based on the pool management program (VG Agent), the management monitoring program (RAID Agen) and the protocol management program (VL Agent) respectively.

[0120] According to an embodiment of the present application, the encryption processing module receives the encryption configuration command transmitted from the license manager, sends the encryption configuration command to the key management module through an asynchronous message queue (Message Queue, MQ), processes the returned result, records the command execution result to the control cluster system, and feeds back to the user end.

[0121] According to an embodiment of the present application, the key management module receives and processes encryption configuration commands from the encryption processing module to locally generate keys (permanent keys, access management keys, data encryption keys, etc.), and returns the results of the key generation or management operation to the encryption processing module through a message queue.

[0122] According to an embodiment of the present application, the encryption management module provides a hardware-supported random number generation function to ensure the security of encryption operations.

[0123] According to the embodiments of the present application, encryption and decryption of target data involve an encryption call module (PLIF_encryption), an encryption processing module, and an encryption management module, ensuring the security and high performance of the data encryption service.

[0124] According to an embodiment of the present application, the encryption calling module inserts encryption and decryption operations in the target data IO, requests a data encryption key from the encryption processing module, and uses the obtained key to perform target data encryption and decryption operations by calling the encryption engine of the encryption management module.

[0125] According to an embodiment of the present application, the encryption processing module receives a key acquisition request from the encryption calling module, calls the encryption management module to acquire or generate the required key, and passes the acquired key to the encryption calling module.

[0126] According to an embodiment of the present application, the encryption management module provides a unified encryption and decryption interface for the encryption calling module to call, and performs encryption and decryption operations on the target data through an integrated encryption algorithm (such as AES, SM4 and other encryption algorithms).

[0127] According to an embodiment of the present application, the key management unit in the key management module transmits the keys (such as the first data access key and the permanent key) obtained or generated by the encryption processing module to the control cluster system and the mobile storage or memory based on the KMIP (Key Management Interoperability) protocol or the USB protocol.

[0128] In a specific embodiment, when it is confirmed that at least one mobile storage device (for example, three) is connected to the control cluster system, the encryption processing module sends a key generation request to the key management module through an asynchronous message queue. The key management module generates a permanent key, an access management key, and a data encryption key in response to the key generation request. The encryption processing module sends a key write request to the key management module so that the key management module stores the permanent key in the mobile storage device, and sends write feedback information to the encryption processing module. After the permanent key is stored in the mobile storage device, the connection between the mobile storage device and the control cluster system can be disconnected to ensure the security of the permanent key.

[0129] According to an embodiment of the present application, the key management module calls the encryption management module to encapsulate the data encryption key DEK based on the permanent key and the access management key, thereby obtaining a first data access key. After obtaining the first data access key, the module generates feedback information and transmits it to the encryption processing module. The first data access key is a key used to access data. After confirming the generation of the first data access key, the encryption processing module stores the first data access key in the memory of the control cluster system. When performing data encryption and decryption, the pool management module (VG CSM) can be used to determine whether the storage pool has a pool encryption tag dak-tag. If the pool encryption tag dak-tag is present, the encryption calling module is used to request a key from the encryption processing module, so that the encryption processing module obtains the first data access key DAK from the control cluster system for data encryption and decryption.

[0130] Figure 8 A block diagram of an electronic device suitable for implementing the above method according to an embodiment of the present application is schematically shown.

[0131] like Figure 8 As shown, an electronic device 800 according to an embodiment of the present application includes a processor 801, which can perform various appropriate actions and processes based on a program stored in a read-only memory (ROM) 802 or a program loaded from a storage unit 808 into a random access memory (RAM) 803. The processor 801 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 801 may also include onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present application.

[0132] Various programs and data required for the operation of the electronic device 800 are stored in the RAM 803. The processor 801, ROM 802, and RAM 803 are connected to each other via a bus 804. The processor 801 performs various operations of the method flow according to the embodiment of the present application by executing the programs in the ROM 802 and / or RAM 803. It should be noted that the programs can also be stored in one or more memories other than the ROM 802 and RAM 803. The processor 801 can also perform various operations of the method flow according to the embodiment of the present application by executing the programs stored in one or more memories.

[0133] According to an embodiment of the present application, electronic device 800 can function as a controller connected to a control cluster system. Each node in the control cluster system synchronizes a first data access key and a first key encryption key. When some nodes restart, the restarted nodes can synchronize the first data access key and the first key encryption key from other nodes, allowing target data to continue to be encrypted and decrypted without requiring a removable storage device to be connected to the control cluster system. When all nodes restart, data encryption is performed using a permanent key stored on the removable storage device. According to an embodiment of the present application, electronic device 800 may also include an input / output (I / O) interface 805, which is also connected to bus 804. Electronic device 800 may also include one or more of the following components connected to I / O interface 805: an input portion 806 including a keyboard, mouse, etc.; an output portion 807 including a cathode ray tube (CRT), liquid crystal display (LCD), and speakers; a storage portion 808 including a hard disk; and a communication portion 809 including a network interface card, such as a LAN card or modem. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the input / output (I / O) interface 805 as needed. A removable medium 811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like, is mounted on the drive 810 as needed, so that a computer program read therefrom can be installed into the storage section 808 as needed.

[0134] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when the one or more programs are executed, the method according to the embodiments of this application is implemented.

[0135] According to an embodiment of the present application, a computer-readable storage medium may be a non-volatile computer-readable storage medium, and may include, for example, but not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present application, a computer-readable storage medium may include the ROM 802 and / or RAM 803 described above and / or one or more memories other than ROM 802 and RAM 803.

[0136] The embodiments of the present application also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method provided in the embodiments of the present application.

[0137] The computer program executes the above functions defined in the system / device of the embodiment of the present application when the processor 801 executes the computer program. According to the embodiment of the present application, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0138] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 809, and / or installed from a removable medium 811. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0139] In such an embodiment, the computer program can be downloaded and installed from the network via the communication section 809, and / or installed from the removable medium 811. When the computer program is executed by the processor 801, the above-mentioned functions defined in the system of the embodiment of the present application are performed. According to the embodiment of the present application, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0140] According to an embodiment of the present application, the program code for executing the computer program provided by the embodiment of the present application can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages include, but are not limited to, languages such as Java, C++, Python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0141] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of the boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0142] Those skilled in the art will appreciate that the features described in the various embodiments of this application may be combined and / or coupled in various ways, even if such combinations or couplings are not explicitly described in this application. In particular, the features described in the various embodiments of this application may be combined and / or coupled in various ways without departing from the spirit and teachings of this application. All such combinations and / or couplings fall within the scope of this application.

[0143] The embodiments of the present application have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present application. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be advantageously used in combination. Without departing from the scope of the present application, those skilled in the art may make various substitutions and modifications, and these substitutions and modifications should all fall within the scope of the present application.

Claims

1. A data encryption method, applied to a control cluster system, characterized in that: The method comprises: generating a permanent key, an access management key, and a data encryption key when at least one mobile storage is connected to the control cluster system, and storing the permanent key in the mobile storage; Encapsulating the permanent key, the access management key, and the data encryption key to obtain a first data access key, and storing the first data access key in the control cluster system; In response to the first encryption instruction, encrypt the data using a first data access key stored in the control cluster system; In response to the second encryption instruction, data encryption is performed using the permanent key stored in the mobile memory and the first data access key stored in the control cluster system.

2. The method according to claim 1, wherein Encapsulating the permanent key, the access management key, and the data encryption key to obtain a first data access key includes: Encapsulating the permanent key and the access management key to obtain a first key encryption key; The data encryption key is encapsulated using a first key encryption key to obtain the first data access key.

3. The method according to claim 1, wherein The first encryption instruction is an instruction for storing target data in a storage pool of the control cluster system when the control cluster system is working, and the data encryption using the first data access key stored in the control cluster system includes: The target data is encrypted using the first data access key, and the encrypted target data is stored in a storage pool of the control cluster system.

4. The method according to claim 3, wherein: Encrypting the target data using the first data access key includes: If it is confirmed that the storage pool has a pool encryption tag, parsing the first data access key to obtain a data encryption key encapsulated in the data access key, wherein the pool encryption tag indicates that the storage pool is a storage pool that requires data to be encrypted for storage; The target data is encrypted using the data encryption key obtained by parsing.

5. The method according to claim 1, wherein Also includes: In response to receiving the encryption activation instruction, determining whether the encryption authorization license is activated; When the encryption authorization license is activated, the permanent key, the access management key, and the data encryption key are generated.

6. The method according to claim 1, wherein The second encryption instruction is an instruction to store target data in a storage pool of the control cluster system when the control cluster system is restarted, and the data encryption is performed using a permanent key stored in the mobile storage and a first data access key stored in the control cluster system, including: Generate a second data access key according to the permanent key stored in the mobile storage, the access management key stored in the control cluster system, and the first data access key; The target data is encrypted using the second data access key, and the encrypted target data is stored in a storage pool of the control cluster system.

7. The method according to claim 6, wherein: Generating a second data access key according to the permanent key stored in the mobile storage, the access management key stored in the control cluster system, and the first data access key includes: generating a second key encryption key according to the permanent key stored in the mobile storage and the access management key stored in the control cluster system; parsing the first data access key in the control cluster system based on the second key encryption key to obtain the data encryption key; The data encryption key is encapsulated using the second key encryption key to obtain the second data access key, and the second data access key is stored in the control cluster system.

8. The method according to claim 7, wherein: Encrypting the target data using the second data access key includes: If it is confirmed that the storage pool has a pool encryption tag, parsing the second data access key to obtain a data encryption key encapsulated in the second data access key, wherein the pool encryption tag indicates that the storage pool is a storage pool that requires data to be encrypted for storage; The target data is encrypted using the data encryption key obtained by parsing.

9. A data encryption device comprising: a key management module, configured to generate a permanent key, an access management key, and a data encryption key when at least one mobile storage is connected to the control cluster system, and store the permanent key in the mobile storage; an encryption management module, configured to encapsulate the permanent key, the access management key, and the data encryption key to obtain a first data access key, and store the first data access key in the control cluster system; an encryption processing module, configured to, in response to a first encryption instruction, perform data encryption using a first data access key stored in the control cluster system; In response to the second encryption instruction, data encryption is performed using the permanent key stored in the mobile memory and the first data access key stored in the control cluster system.

10. An electronic device comprising: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method according to any one of claims 1 to 8.

Images