Transparent file encryption and decryption method and device, equipment and readable storage medium

Abstract

The invention discloses a file transparent encryption and decryption method, device and equipment and a readable storage medium, and is applied to the field of data security, and the method comprises the following steps: when an application process initiates a file opening operation, the file opening operation is redirected to a stacked file system of a kernel layer; acquiring application process information of the application process through the stacked file system, and judging whether the application process is in the application process white list or not through the application process information; if the file is in the application process white list, opening the file, and judging whether to execute transparent encryption and decryption of the file; and if the file transparent encryption and decryption are executed, calling the cryptographic algorithm module of the kernel layer to execute the file transparent encryption and decryption operation. Transparent encryption and decryption are directly carried out on a file kernel layer, and work such as application adaptation and butt joint development is reduced. The problems that application adaptation difficulty is large, interfaces are not uniform, and system calling interface bypassing exists are solved, the application adaptation amount can be effectively reduced, and the problem that transparent encryption and decryption are invalid due to interface bypassing and the like can be effectively solved.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a file transparent encryption and decryption method, device, equipment and readable storage medium. Background Art

[0002] Sensitive data is stored in plaintext within the trusted computing system, which presents certain risks. Traditional solutions involve forcibly encrypting stored data without modifying user habits to achieve transparent encryption and decryption. Traditional transparent encryption and decryption methods rely on injecting custom dynamic libraries into the target process at the application layer to replace the system call interface, thereby implementing transparent file encryption and decryption technology. Because application-layer system call interfaces vary widely and different applications may have different calling methods, in-depth application adaptation is required. Therefore, traditional methods are difficult to adapt, have a long development cycle, are costly, and have many controllable factors. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide a file transparent encryption and decryption method, device, equipment and readable storage medium, which solves the problems in the existing technology such as the difficulty of application adaptation, inconsistent interfaces and the existence of system call interface bypass, and can effectively reduce the application adaptation amount and the problem of transparent encryption and decryption failure caused by interface bypass.

[0004] To solve the above technical problems, the present invention provides a file transparent encryption and decryption method, comprising:

[0005] When an application process initiates a file opening operation, the file opening operation is redirected to the stacked file system of the kernel layer;

[0006] obtaining application process information of the application process through the stackable file system, and determining whether the application process is in an application process whitelist based on the application process information;

[0007] If the file is in the application process whitelist, the file is opened and it is determined whether to perform transparent encryption and decryption of the file;

[0008] If transparent encryption and decryption of files is performed, the cryptographic algorithm module of the kernel layer is called to perform the transparent encryption and decryption operation of the files.

[0009] Optionally, determining whether the application process is in an application process whitelist according to the application process information includes:

[0010] Through the process access control module of the kernel layer, it is determined whether the application process name list in the application process whitelist and the application process information meet the matching conditions to obtain a matching result; the matching conditions include at least one or more of the process signature hash value, process path, user identity and digital certificate.

[0011] Optionally, if the file is in the application process whitelist, the file is opened and it is determined whether to perform transparent encryption and decryption of the file, including:

[0012] If the application process is in the application process whitelist, creating and maintaining an application process open file context through the stackable file system, generating a corresponding file handle and returning it to the application process, thereby completing the file open operation;

[0013] When the application process initiates a file data read / write request according to the file handle, querying the application process to open a file context through the stacked file system to obtain file encryption information and process information;

[0014] Whether to perform transparent encryption and decryption is determined based on the file encryption information and process information.

[0015] Optionally, if transparent file encryption and decryption is performed, the cryptographic algorithm module of the kernel layer is called to perform the transparent file encryption and decryption operation, including:

[0016] When the application process initiates a file data write request according to the file handle, the encrypted data is encrypted by the cryptographic algorithm module and returned to the stacked file system, so that the stacked file system transmits the encrypted data to the system lower layer file system and writes it to the disk;

[0017] When the application process initiates a file data read request according to the file handle, the cryptographic algorithm module decrypts the data and returns the decrypted data to the stackable file system, so that the stackable file system returns the decrypted data to the application process.

[0018] Optionally, when the application process initiates a file opening operation, before the file opening operation is redirected to the stacked file system of the kernel layer, the method further includes:

[0019] Configuring an application process whitelist through the file service process of the application layer; the application process whitelist is an application process that can access files in plain text;

[0020] The application process name list in the application process whitelist is sent to the process access control module of the kernel layer through the file service process and stored in the process access control module.

[0021] Optionally, if transparent file encryption and decryption is performed, the cryptographic algorithm module of the kernel layer is called to perform the transparent file encryption and decryption operation, including:

[0022] If transparent encryption and decryption of files is performed, the cryptographic algorithm module is used and the corresponding cryptographic algorithm is called according to the algorithm identifier in the file encryption information. When it is a national secret scenario, the SM4 symmetric encryption algorithm and the SM3 hash algorithm are preferentially selected for encryption and decryption operations.

[0023] Optionally, 128 bytes are added to the header of the file to describe the file information, wherein the first byte is the 128-byte format version of the file header, the second to eighth bytes are fixed magic strings, the ninth to sixteenth bytes are the file traceability ID, the seventeenth to twenty-second bytes are unit codes, the twenty-first to twenty-fourth bytes are file access control permissions, the twenty-fifth to thirty-second bytes are reserved for subsequent expansion, the thirty-third to sixty-fourth bytes are the file encryption and decryption keys, the sixty-fifth to ninety-sixth bytes are the hash values of the encrypted file, and the ninety-seventh to 128th bytes are the hash values of the first 96 bytes newly added to the file header.

[0024] The present invention also provides a file transparent encryption and decryption device, comprising:

[0025] A redirection module, configured to redirect a file opening operation initiated by an application process to a stacked file system in a kernel layer;

[0026] a first determining module, configured to obtain application process information of the application process through the stackable file system, and determine whether the application process is in an application process whitelist based on the application process information;

[0027] A second judgment module is used to open the file if it is in the application process whitelist and determine whether to perform transparent encryption and decryption of the file;

[0028] The encryption and decryption module is used to call the cryptographic algorithm module of the kernel layer to perform transparent encryption and decryption operations on files if transparent encryption and decryption is performed.

[0029] The present invention also provides a file transparent encryption and decryption device, comprising:

[0030] Memory for storing computer programs;

[0031] The processor is used to implement the above-mentioned file transparent encryption and decryption method when executing the computer program.

[0032] The present invention also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are loaded and executed by a processor, the above-mentioned file transparent encryption and decryption method is implemented.

[0033] It can be seen that the present invention redirects the file opening operation to the stacked file system of the kernel layer when the application process initiates the file opening operation; obtains the application process information of the application process through the stacked file system, and determines whether the application process is in the application process whitelist through the application process information; if it is in the application process whitelist, then the file is opened and it is determined whether to perform transparent encryption and decryption of the file; if transparent encryption and decryption of the file is performed, the cryptographic algorithm module of the kernel layer is called to perform the transparent encryption and decryption operation of the file. The present invention abandons the solution of replacing system calls at the application layer, and directly performs transparent encryption and decryption at the file kernel level, reducing the work of application adaptation, docking development, etc. It solves the problems of difficult application adaptation, inconsistent interfaces, and system call interface bypass, etc., and can effectively reduce the application adaptation amount, as well as the problem of transparent encryption and decryption failure caused by interface bypass.

[0034] In addition, the present invention also provides a file transparent encryption and decryption device, equipment and readable storage medium, which also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0036] Figure 1 This is a schematic diagram of a traditional file transparent encryption and decryption method;

[0037] Figure 2 A flowchart of a file transparent encryption and decryption method provided by an embodiment of the present invention;

[0038] Figure 3 A schematic diagram of a file transparent encryption and decryption method provided by an embodiment of the present invention;

[0039] Figure 4 A module operation sequence diagram of a file transparent encryption and decryption method provided by an embodiment of the present invention;

[0040] Figure 5 A schematic diagram of the structure of a file transparent encryption and decryption device provided by an embodiment of the present invention;

[0041] Figure 6 A schematic structural diagram of a file transparent encryption and decryption device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0042] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0043] The Xinchuang System (Information Technology Application Innovation System) is a complete information technology system covering hardware, software, security and services built by China under the guidance of national strategy, with independence, controllability, security and reliability as its core goals, through independent research and development or in-depth adaptation of domestic technologies.

[0044] Sensitive data is stored in plain text in the trusted computing system. For data security, transparent encryption and decryption of files is required. The traditional transparent encryption and decryption method is based on the application layer to inject custom dynamic libraries into the target process to replace the system call interface, thereby realizing transparent encryption and decryption technology for files. That is, the traditional method is based on replacing the system call interface to realize transparent encryption and decryption technology for files. The transparent encryption and decryption manufacturer injects the dynamic library into the target process, directly replaces the system call interface of the target process, encrypts the data when it is saved, and decrypts the data when it is read. The basic principles of traditional transparent encryption and decryption technology based on replacing the system call interface are as follows: Figure 1 As shown in the figure. The traditional method of transparent encryption and decryption of files based on replacing the system call interface can achieve transparent encryption and decryption of sensitive data, but it also has some problems, such as: 1) Limitations: The traditional method based on replacing the system call interface needs to be injected into the application process. If the application has protection functions or the operating system environment does not allow the use of injection technology, it is impossible to use the method based on replacing the system call interface to achieve transparent encryption and decryption; 2) Complexity: There is no completely unified system call interface at the application layer. The behavior of the application when performing file operations is often unpredictable. Application adaptation is required for different applications, and the development and maintenance costs are high; 3) Long cycle: Since the application layer system call interface varies greatly and different applications may have different calling methods, deep application adaptation is required, resulting in a long system development cycle and many uncontrollable factors.

[0045] Therefore, in order to solve the above problems, the present invention abandons the traditional method of replacing system calls at the application layer, and directly performs transparent encryption and decryption at the file system level, reducing the work of application adaptation, docking development, etc. Figure 1 , Figure 1 This is a flowchart of a method for transparent file encryption and decryption provided by an embodiment of the present invention. The method may include:

[0046] S101: When an application process initiates a file opening operation, the file opening operation is redirected to a stacked file system in a kernel layer.

[0047] The execution subject of this embodiment is a terminal. This embodiment does not limit the type of terminal, as long as it can complete the operation of the file transparent encryption and decryption method. It should be noted that this method can be applied to the Xinchuang operating system and the Linux operating system.

[0048] Specifically, when an application process initiates a file open operation, the file open operation is automatically redirected to the stacked file system. It should be further explained that the stacked file system in this embodiment is located at the kernel layer and is used to implement transparent file encryption and decryption. As can be seen from step S101, this method, unlike traditional methods, implements transparent file encryption and decryption at the kernel layer, eliminating the need for adaptation for different applications.

[0049] S102: Acquire application process information of the application process through the stackable file system, and determine whether the application process is in the application process whitelist based on the application process information.

[0050] This step verifies the security of the application process and whether it has permission to access files in plain text. When the stackable file system intercepts a file open operation initiated by an application, it obtains the application process information of the application process to determine whether it is on the application process whitelist. This embodiment does not explicitly limit the application process information. For example, it may include basic information such as the process ID (unique identifier), process name, user, host name, etc.; it may include process status and priority; and it may include resource usage such as CPU (central processing unit) usage, memory usage, and I / O (read / write) resources.

[0051] Furthermore, the above-mentioned determination of whether the application process is in the application process whitelist based on the application process information may include the following steps:

[0052] Through the process access control module of the kernel layer, it is determined whether the application process name list in the application process whitelist and the application process information meet the matching conditions to obtain the matching result; the matching conditions include at least one or more of the process signature hash value, process path, user identity and digital certificate.

[0053] Specifically, in this embodiment, the kernel layer also includes a process access control module, which is used to verify application processes. This module stores a whitelist of application processes and implements verification through matching. Specifically, verification can be performed using one or more of the following: signature hash value, process path, user identity, and digital certificate.

[0054] Furthermore, when the application process initiates a file opening operation, before the file opening operation is redirected to the stacked file system of the kernel layer, the following steps may be further included:

[0055] Step 11: Configure an application process whitelist through the file service process of the application layer; the application process whitelist is the application process that can access files in plain text;

[0056] Step 12: Send the application process name list in the application process whitelist to the process access control module of the kernel layer through the file service process, and store it in the process access control module.

[0057] Specifically, this embodiment pre-uses the file service process of the application layer to implement the configuration of the application process whitelist in the access control module in the kernel layer, such as sending the application process name list in the application process whitelist to the process access control module in the kernel layer through the file service process, and storing it in the process access control module.

[0058] S103: If the file is in the application process whitelist, open the file and determine whether to perform transparent encryption and decryption of the file.

[0059] When the application is in the application whitelist, it means that the application process whitelist can access the file in plain text, and the stacked file system opens the file and further determines whether to perform transparent encryption and decryption of the file.

[0060] Furthermore, if the file is in the application process whitelist, the process of opening the file and determining whether to perform transparent encryption and decryption of the file may include the following steps:

[0061] Step 21: If the application process is in the application process whitelist, the stacked file system is used to create and maintain the application process's file opening context, generate a corresponding file handle, and return it to the application process to complete the file opening operation;

[0062] Step 22: When the application process initiates a file data read / write request based on the file handle, the stacked file system queries the application process to open the file context and obtains the file encryption information and process information;

[0063] Step 23: Determine whether to perform transparent encryption and decryption based on the file encryption information and process information.

[0064] Specifically, when the application process is in the application process whitelist, the stackable file system creates and maintains the application process open file context, and returns the file handle to the application process, thus completing the file opening. Among them, the file handle is a unique identifier (such as an integer descriptor) assigned by the operating system kernel to the file opened by the process, which is used for subsequent read and write operations; the application process open file context refers to additional information when the file is opened, such as file path, access mode, process information, timestamp and environment information. When the application receives the file handle sent by the stackable file system, the application can initiate a file data read and write request. The stackable file system intercepts the data read and write request, and obtains the file encryption information and process information by querying the application process open file context. It determines whether to perform transparent encryption and decryption based on the file encryption information and process information.

[0065] S104: If transparent encryption and decryption of the file is to be performed, the cryptographic algorithm module of the kernel layer is called to perform the transparent encryption and decryption operation of the file.

[0066] When transparent encryption and decryption of files is required, the cryptographic algorithm module of the kernel layer is used for execution. As can be seen, the kernel layer in this embodiment also includes a cryptographic algorithm module.

[0067] Furthermore, if transparent encryption and decryption of files is performed, the cryptographic algorithm module of the kernel layer is called to perform transparent encryption and decryption of files, which may include the following steps:

[0068] Step 31: When the application process initiates a file data write request based on the file handle, the cryptographic algorithm module encrypts the data and returns the encrypted data to the stacked file system, so that the stacked file system transmits the encrypted data to the lower file system of the system and writes it to the disk;

[0069] Step 32: When the application process initiates a file data read request according to the file handle, the cryptographic algorithm module performs decryption and returns the decrypted data to the stackable file system, so that the stackable file system returns the decrypted data to the application process.

[0070] Specifically, if transparent encryption and decryption are required for the application process, the cryptographic algorithm module is invoked to perform the encryption and decryption calculations. Decryption occurs during reading and encryption occurs during writing. If decryption is required, the decrypted data is returned to the stacked file system, which then returns the plaintext data to the application process. If encryption is required, the encrypted data is returned to the stacked file system, which then passes the ciphertext data to the underlying file system of the operating system and writes it to disk.

[0071] Furthermore, if transparent encryption and decryption of files is performed, the cryptographic algorithm module of the kernel layer is called to perform transparent encryption and decryption of files, which may include the following steps:

[0072] If transparent file encryption and decryption is performed, the cryptographic algorithm module is used to call the corresponding cryptographic algorithm according to the algorithm identifier in the file encryption information. In national security scenarios, the SM4 symmetric encryption algorithm and SM3 hash algorithm are preferred for encryption and decryption operations.

[0073] Specifically, in this embodiment, the cryptographic algorithm module can perform data encryption and decryption by selecting an appropriate cryptographic algorithm. For example, the corresponding cryptographic algorithm is called according to the algorithm identifier in the file encryption information, and in the case of national security scenarios, the SM4 symmetric encryption algorithm and the SM3 hash algorithm are preferentially selected for encryption and decryption operations.

[0074] Furthermore, 128 bytes are added to the header of the above file to describe the file information, where the first byte is the 128-byte format version of the file header, the second to eighth bytes are fixed magic strings, the ninth to sixteenth bytes are the file traceability ID, the seventeenth to 20th bytes are unit codes, the twenty-first to twenty-fourth bytes are file access control permissions, the twenty-fifth to 32nd bytes are reserved for subsequent expansion, the thirty-third to sixty-fourth bytes are the file encryption and decryption keys, the sixty-fifth to ninety-sixth bytes are the hash value of the encrypted file, and the ninety-seventh to 128th bytes are the hash value of the first 96 bytes newly added to the file header.

[0075] Specifically, taking the SM3 algorithm for encryption and decryption as an example, 128 bytes are added to the file header to describe the file information, of which the first byte is the format version of the 128-byte file header; bytes 2 to 8 are a fixed magic string used to indicate whether the file is encrypted by the present invention; bytes 9 to 16 are the file traceability ID; bytes 17 to 20 are the unit code; bytes 21 to 24 are the file access control permissions; bytes 25 to 32 are reserved for subsequent expansion; bytes 33 to 64 are salted with a fixed length of 20 bytes and then the SM3 is calculated to obtain the file encryption and decryption key; bytes 65 to 96 are the SM3 hash value after file encryption, and whether the SM3 hash value has changed can be used to verify whether the file has been maliciously tampered with or damaged; bytes 97 to 128 are the SM3 hash value of the first 96 bytes added to the file header, and whether the SM3 hash value has changed can be used to verify whether the file has been maliciously tampered with or damaged. To address the issue of secure transfer of trusted files, transparent encryption and decryption based on the trusted system is adopted, which can effectively prevent information leakage caused by malicious copying of files and transmission of files over the network.

[0076] The file transparent encryption and decryption method provided by the embodiment of the present invention is applied. When the application process initiates a file opening operation, the file opening operation is redirected to the stacked file system of the kernel layer; the application process information of the application process is obtained through the stacked file system, and the application process information is used to determine whether the application process is in the application process whitelist; if it is in the application process whitelist, the file is opened, and it is determined whether to perform file transparent encryption and decryption; if file transparent encryption and decryption is performed, the cryptographic algorithm module of the kernel layer is called to perform the file transparent encryption and decryption operation. The present invention abandons the solution of replacing system calls at the application layer, and directly performs transparent encryption and decryption at the file kernel level, reducing the work of application adaptation, docking development, etc. It solves the problems of difficult application adaptation, inconsistent interfaces, and system call interface bypass, which can effectively reduce the application adaptation amount and the problem of transparent encryption and decryption failure caused by interface bypass.

[0077] In order to make the present invention easier to understand, please refer to Figure 3 and Figure 4 , Figure 3 A schematic diagram of a file transparent encryption and decryption method provided by an embodiment of the present invention; Figure 4 This is a module working sequence diagram of a file transparent encryption and decryption method provided by an embodiment of the present invention. Figure 3 As can be seen, compared to traditional transparent file encryption and decryption methods, this method adds a stacked file system, process access control policies, and a cryptographic algorithm module to the kernel layer (kernel space), and a file service process to the user layer (user space). The stacked file system is used to implement transparent encryption and decryption, the process access control policy is used for whitelist verification, the cryptographic algorithm module is used for encryption and decryption, and the file service module is used to set policies. Figure 4In steps 1 and 2, the file service process first configures a whitelist of application processes (application processes that can access files in plain text), sends the list of application process names to the process access control module, and stores it internally. After the configuration is complete, the process access control module responds. When the application process initiates a file open operation in step 3, the file open operation is automatically redirected to the stacked file system. The stacked file system obtains the application process information from the application process and calls step 4 to determine whether the application process is a whitelisted process based on the application process information. The process access control module calls step 5 to perform a match based on the internally maintained whitelist information and returns the judgment result to the stacked file system in step 6. The stacked file system maintains the process open file context based on the return result of the process access control module and returns the file handle in step 7; at this point, the file is opened. The application process obtains the file handle in step 8 and uses this file handle to read the file data in step 9. The stacked file system queries the process to open the file context based on the file handle, obtains the file encryption information and process information, and determines whether transparent file encryption and decryption is required. If transparent file encryption and decryption is not required, the data is directly returned through step 13; if transparent file encryption and decryption is required, the cryptographic algorithm module is called through step 10 to perform encryption and decryption calculations. The cryptographic algorithm module selects a suitable cryptographic algorithm to perform data encryption and decryption through step 11. If decryption is required, the decrypted data is returned to the stacked file system through step 12, and the stacked file system returns the plaintext data to the application process again; if encryption is required, the encrypted data is returned to the stacked file system through step 12, and the stacked file system passes the ciphertext data to the lower file system of the operating system and writes it to the disk.

[0078] It can be seen that the present invention implements file transparent encryption and decryption technology based on the kernel level of the trusted computing system, which can shield the specific interface implementations of different application manufacturers when making system calls, and directly intercept the file reading and writing interfaces at the file system level, thereby realizing transparent file encryption and decryption, effectively solving the dependency problem of traditional technologies at the operating environment level, without any external dependencies and restrictions; docking does not require adaptation with application manufacturers, only needs to implement the file system according to the kernel interface requirements, which can intercept the file reading and writing process and reduce docking work and maintenance costs; solves the problem of inconsistent application layer system call interfaces, and does not need to be developed for different applications, effectively reducing development and maintenance costs; transparent encryption and decryption is realized based on the trusted computing operating system kernel, which is superior to traditional technical solutions in performance; user layer file services only need to configure process access policies, without considering other dependent environments, and transparently encrypt and decrypt file access for specified application processes according to user layer configuration policies.

[0079] The following is an introduction to a file transparent encryption and decryption device provided by an embodiment of the present invention. The file transparent encryption and decryption device described below and the file transparent encryption and decryption method described above can be referenced to each other.

[0080] Please refer to Figure 5 , Figure 5 A schematic structural diagram of a file transparent encryption and decryption device provided in an embodiment of the present invention may include:

[0081] The redirection module 100 is used to redirect the file opening operation to the stacked file system of the kernel layer when the application process initiates the file opening operation;

[0082] A first determining module 200 is configured to obtain application process information of the application process through the stackable file system, and determine whether the application process is in an application process whitelist based on the application process information;

[0083] The second judgment module 300 is used to open the file and determine whether to perform transparent encryption and decryption of the file if the file is in the application process whitelist;

[0084] The encryption and decryption module 400 is used to call the cryptographic algorithm module of the kernel layer to perform transparent encryption and decryption operations on the file if transparent encryption and decryption of the file is performed.

[0085] Based on the above embodiment, the first determination module 200 may include:

[0086] The first judgment unit is used to determine whether the application process name list in the application process whitelist and the application process information meet the matching conditions through the process access control module of the kernel layer, and obtain a matching result; the matching conditions include at least one or more of the process signature hash value, process path, user identity and digital certificate.

[0087] Based on the above embodiment, the second determination module 300 may include:

[0088] A file opening operation unit is configured to create and maintain an application process file opening context through the stackable file system if the application process is in the application process whitelist, generate a corresponding file handle and return it to the application process to complete the file opening operation;

[0089] an information acquisition unit, configured to query the application process's file opening context through the stacked file system to acquire file encryption information and process information when the application process initiates a file data read / write request according to the file handle;

[0090] The second judgment unit is used to judge whether to perform transparent encryption and decryption based on the file encryption information and process information.

[0091] Based on the above embodiment, the encryption and decryption module 400 may include:

[0092] an encryption unit, configured to, when the application process initiates a file data write request according to the file handle, encrypt the data using the cryptographic algorithm module and return the encrypted data to the stacked file system, so that the stacked file system transmits the encrypted data to a lower file system of the system and writes the encrypted data to a disk;

[0093] a decryption unit, configured to decrypt the data through the cryptographic algorithm module when the application process initiates a file data read request according to the file handle, and return the decrypted data to the stackable file system, so that the stackable file system returns the decrypted data to the application process.

[0094] Based on the above embodiment, the file transparent encryption and decryption device may further include:

[0095] A configuration module is used to configure an application process whitelist through a file service process of an application layer; the application process whitelist is an application process that can access files in plain text;

[0096] The storage module is used to send the application process name list in the application process whitelist to the process access control module of the kernel layer through the file service process, and store it in the process access control module.

[0097] Based on the above embodiment, the encryption and decryption module 400 may include:

[0098] The encryption and decryption unit is used to call the corresponding cryptographic algorithm through the cryptographic algorithm module and according to the algorithm identifier in the file encryption information if transparent encryption and decryption of the file is performed. When it is a national secret scenario, the SM4 symmetric encryption algorithm and the SM3 hash algorithm are preferentially selected for encryption and decryption operations.

[0099] Based on the above embodiment, 128 bytes are added to the header of the file for describing file information, wherein the first byte is the 128-byte format version of the file header, the second to eighth bytes are fixed magic strings, the ninth to sixteenth bytes are the file traceability ID, the seventeenth to 20th bytes are unit codes, the twenty-first to twenty-fourth bytes are file access control permissions, the twenty-fifth to thirty-second bytes are reserved for subsequent expansion, the thirty-third to sixty-fourth bytes are the file encryption and decryption keys, the sixty-fifth to ninety-sixth bytes are the hash values after file encryption, and the ninety-seventh to 128th bytes are the hash values of the first 96 bytes newly added to the file header.

[0100] It should be noted that the order of the modules and units in the above-mentioned file transparent encryption and decryption device can be changed without affecting the logic.

[0101] The file transparent encryption and decryption device provided by the embodiment of the present invention comprises a redirection module 100 for redirecting the file opening operation to the stacked file system of the kernel layer when the application process initiates a file opening operation; a first judgment module 200 for obtaining the application process information of the application process through the stacked file system and judging whether the application process is in the application process whitelist based on the application process information; a second judgment module 300 for opening the file and judging whether to perform transparent file encryption and decryption if the application process is in the application process whitelist; and an encryption and decryption module 400 for calling the cryptographic algorithm module of the kernel layer to perform the transparent file encryption and decryption operation if transparent file encryption and decryption is to be performed. The present invention abandons the solution of replacing system calls at the application layer and directly performs transparent encryption and decryption at the file kernel level, reducing the work of application adaptation, docking development, etc. The present invention solves the problems of difficult application adaptation, inconsistent interfaces, and system call interface bypass, which can effectively reduce the application adaptation amount and the problem of transparent encryption and decryption failure caused by interface bypass.

[0102] The following introduces a file transparent encryption and decryption device provided by an embodiment of the present invention. The file transparent encryption and decryption device described below and the file transparent encryption and decryption method described above can refer to each other.

[0103] Please refer to Figure 6 , Figure 6 A schematic structural diagram of a file transparent encryption and decryption device provided in an embodiment of the present invention may include:

[0104] Memory 10, for storing computer programs;

[0105] The processor 20 is configured to execute a computer program to implement the above-mentioned file transparent encryption and decryption method.

[0106] The memory 10 , the processor 20 , and the communication interface 31 all communicate with each other via the communication bus 32 .

[0107] In the embodiment of the present invention, the memory 10 is used to store one or more programs. The program may include program code, and the program code includes computer operation instructions. In the embodiment of the present invention, the memory 10 may store programs for implementing the following functions:

[0108] When an application process initiates a file open operation, the file open operation is redirected to the stacked file system in the kernel layer;

[0109] Obtain application process information of the application process through the stacked file system, and determine whether the application process is in the application process whitelist based on the application process information;

[0110] If the file is in the application process whitelist, the system opens the file and determines whether to perform transparent encryption and decryption of the file.

[0111] If transparent encryption and decryption of files is performed, the cryptographic algorithm module of the kernel layer is called to perform the transparent encryption and decryption operation of the files.

[0112] In one possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function, etc.; the data storage area may store data created during use.

[0113] In addition, the memory 10 may include a read-only memory and a random access memory, and provides instructions and data to the processor. A portion of the memory may also include NVRAM. The memory stores an operating system and operating instructions, executable modules or data structures, or a subset or an extended set thereof. The operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and processing hardware-based tasks.

[0114] The processor 20 may be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field programmable gate array, or other programmable logic device. The processor 20 may be a microprocessor or any conventional processor. The processor 20 may call a program stored in the memory 10 .

[0115] The communication interface 31 may be an interface of a communication module, used for connecting to other devices or systems.

[0116] Of course, it needs to be explained that Figure 6 The structure shown does not constitute a limitation on the file transparent encryption and decryption device in the embodiment of the present invention. In actual applications, the file transparent encryption and decryption device may include Figure 5 More or fewer components than shown, or combinations of certain components.

[0117] The following introduces a computer-readable storage medium provided by an embodiment of the present invention. The computer-readable storage medium described below and the file transparent encryption and decryption method described above can be referenced to each other.

[0118] The present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned file transparent encryption and decryption method are implemented.

[0119] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., which can store program codes.

[0120] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0121] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0122] Finally, it should be noted that, in this document, relationships such as first and second, etc., are used solely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0123] The above is a detailed introduction to a file transparent encryption and decryption method, device, equipment and computer-readable storage medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A file transparent encryption and decryption method, characterized in that: include: When an application process initiates a file opening operation, the file opening operation is redirected to the stacked file system of the kernel layer; obtaining application process information of the application process through the stackable file system, and determining whether the application process is in an application process whitelist based on the application process information; If the file is in the application process whitelist, the file is opened and it is determined whether to perform transparent encryption and decryption of the file; If transparent encryption and decryption of files is performed, the cryptographic algorithm module of the kernel layer is called to perform the transparent encryption and decryption operation of the files.

2. The file transparent encryption and decryption method according to claim 1, characterized in that: Determining whether the application process is in the application process whitelist based on the application process information includes: Through the process access control module of the kernel layer, it is determined whether the application process name list in the application process whitelist and the application process information meet the matching conditions to obtain a matching result; the matching conditions include at least one or more of the process signature hash value, process path, user identity and digital certificate.

3. The file transparent encryption and decryption method according to claim 1, characterized in that: If the application is in the whitelist, the file is opened and a determination is made as to whether transparent encryption and decryption of the file is performed, including: If the application process is in the application process whitelist, creating and maintaining an application process open file context through the stackable file system, generating a corresponding file handle and returning it to the application process, thereby completing the file open operation; When the application process initiates a file data read / write request according to the file handle, querying the application process to open a file context through the stacked file system to obtain file encryption information and process information; Whether to perform transparent encryption and decryption is determined based on the file encryption information and process information.

4. The file transparent encryption and decryption method according to claim 1, characterized in that: If transparent file encryption and decryption is performed, the cryptographic algorithm module of the kernel layer is called to perform the transparent file encryption and decryption operations, including: When the application process initiates a file data write request according to the file handle, the encrypted data is encrypted by the cryptographic algorithm module and returned to the stacked file system, so that the stacked file system transmits the encrypted data to the system lower layer file system and writes it to the disk; When the application process initiates a file data read request according to the file handle, the cryptographic algorithm module decrypts the data and returns the decrypted data to the stackable file system, so that the stackable file system returns the decrypted data to the application process.

5. The file transparent encryption and decryption method according to claim 1, characterized in that: When the application process initiates a file opening operation, before the file opening operation is redirected to the stacked file system of the kernel layer, the method further includes: Configuring an application process whitelist through the file service process of the application layer; the application process whitelist is an application process that can access files in plain text; The application process name list in the application process whitelist is sent to the process access control module of the kernel layer through the file service process and stored in the process access control module.

6. The file transparent encryption and decryption method according to claim 1, characterized in that: If transparent file encryption and decryption is performed, the cryptographic algorithm module of the kernel layer is called to perform the transparent file encryption and decryption operations, including: If transparent encryption and decryption of files is performed, the cryptographic algorithm module is used and the corresponding cryptographic algorithm is called according to the algorithm identifier in the file encryption information. When it is a national secret scenario, the SM4 symmetric encryption algorithm and the SM3 hash algorithm are preferentially selected for encryption and decryption operations.

7. The file transparent encryption and decryption method according to claim 1, characterized in that: The file header adds 128 bytes to describe the file information, where the first byte is the 128-byte format version of the file header, the second to eighth bytes are fixed magic strings, the ninth to sixteenth bytes are the file traceability ID, the seventeenth to 20th bytes are unit codes, the twenty-first to twenty-fourth bytes are file access control permissions, the twenty-fifth to 32nd bytes are reserved for subsequent expansion, the thirty-third to sixty-fourth bytes are the file encryption and decryption keys, the sixty-fifth to ninety-sixth bytes are the hash value after file encryption, and the ninety-seventh to 128th bytes are the hash value of the first 96 bytes newly added to the file header.

8. A file transparent encryption and decryption device, characterized in that: include: A redirection module, configured to redirect a file opening operation initiated by an application process to a stacked file system in a kernel layer; a first determining module, configured to obtain application process information of the application process through the stackable file system, and determine whether the application process is in an application process whitelist based on the application process information; A second judgment module is used to open the file if it is in the application process whitelist and determine whether to perform transparent encryption and decryption of the file; The encryption and decryption module is used to call the cryptographic algorithm module of the kernel layer to perform transparent encryption and decryption operations on files if transparent encryption and decryption is performed.

9. A file transparent encryption and decryption device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the file transparent encryption and decryption method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by the processor, the file transparent encryption and decryption method according to any one of claims 1 to 7 is implemented.

Images