A data management method and system for multi-user encrypted mobile storage media

Abstract

The application discloses a kind of data management methods of multi-user encrypted mobile storage medium.The method is by using hierarchical key management mechanism, set up a main encryption key and carry out unified encryption to entire storage partition, simultaneously generate independent user key for each client user, for encrypting the copy of main encryption key.At the time of client login, mobile storage medium first authenticates its identity, and derives the corresponding user key by user password, then decrypts the pre-stored copy of main encryption key using the user key, to obtain the main encryption key.Mobile storage medium then decrypts the storage partition in real time using the main encryption key, and constructs the corresponding virtual file system and exclusive directory for the user, to realize the isolation and management of user data.The application can solve the technical problem that traditional encrypted mobile storage medium does not support multi-user access permission management.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information security, and more particularly, relates to a data management method and system for multi-user encrypted mobile storage media. BACKGROUND

[0002] With the rapid development of computer technology and data storage devices, mobile storage media, such as mobile storage media, mobile hard disks, etc., have become an indispensable tool for daily data exchange and backup due to their portability and large capacity. However, this convenience also brings major data security risks. Once the mobile storage media is lost or stolen, the confidential information, personal privacy or business sensitive data stored therein may face the risk of leakage. Therefore, encrypting the data on the mobile storage media to ensure the confidentiality and integrity of the information has become a critical technical requirement.

[0003] The existing data encryption schemes for mobile storage media can be divided into three categories. The first category is mobile storage media with built-in encryption modules. Some manufacturers integrate encryption chips into mobile storage media. The chip can automatically complete real-time encryption and decryption of data during data writing or reading. For example, a hardware-based AES algorithm is used to implement encryption operations, and users only need to input an access password to access the encrypted area. The second category is a software tool-based encryption method (such as using open source software such as Linux Unified Key Setup (LUKS), which can create an encrypted partition on a normal mobile storage medium). This method uses a driver at the operating system level to mount the encrypted partition as a usable partition after the user inputs the password, thereby implementing data encryption and decryption operations. The third category is a management method based on an external security container or middleware, which stores the key in the security container and decrypts the data after the user inputs the password by installing a dedicated encryption management software or external security device (such as a USB key) on the host.

[0004] However, the above-mentioned several existing data management methods for mobile storage media still have some non-negligible defects:

[0005] First, the existing schemes only support single-user use, lack multi-user identity recognition and management mechanisms, and are difficult to meet the needs of multi-person sharing and collaborative work;

[0006] Second, the existing schemes generally lack effective data isolation mechanisms. The data of different users are stored in the same encrypted partition, and once a user obtains access rights, all data can be viewed, resulting in a high risk of leakage of confidential information;

[0007] Third, existing solutions do not support fine-grained configuration of shared directories between users. They can only choose to share all data or not share data in a single storage space. They cannot specify the role of file sharing, and it is difficult to achieve flexible management of files with different security levels.

[0008] Fourth, existing software-based encryption methods rely on the host environment, are easily limited by system compatibility and security, and are insufficient in resisting external attacks, making it difficult to guarantee stability and security in complex application environments. Summary of the Invention

[0009] To address the aforementioned deficiencies or improvement needs of existing technologies, this invention provides a data management method and system for multi-user encrypted mobile storage media. Its purpose is to solve the technical problems of existing mobile storage media data management methods lacking multi-user identification and management mechanisms, making it difficult to meet the needs of multi-user sharing and collaborative work; the technical problem that due to the general lack of effective data isolation mechanisms, data from different users are stored in the same encrypted partition, and once a user gains access, all data can be viewed, leading to a significant risk of leakage of confidential information; the technical problem of difficulty in flexibly managing files with different security levels; and the technical problem that existing software-based encryption methods, due to their reliance on the host environment, are easily limited by system compatibility and security, and are insufficient in resisting external attacks, making it difficult to guarantee stability and security in complex application environments.

[0010] To achieve the above objectives, according to one aspect of the present invention, a data management method for a multi-user encrypted mobile storage medium is provided, comprising the following steps:

[0011] (1) The mobile storage medium obtains the username and password from the client, verifies the client based on the username and password, and prompts the client to log in to the mobile storage medium after successful verification;

[0012] (2) Obtaining ciphertext from removable storage media The user key is derived from the user password obtained in step (1). and use the user key Regarding the ciphertext Decryption is performed to obtain the master encryption key MK;

[0013] (3) The mobile storage medium uses the master encryption key MK obtained in step (2) and uses the XTS-AES-256 algorithm to decrypt the encrypted area in the mobile storage medium in real time to obtain the virtual decryption partition;

[0014] (4) The mobile storage medium performs file system analysis on the virtual decryption partition obtained in step (3) to obtain a first virtual file system;

[0015] (5) The mobile storage medium acquires the exclusive directory corresponding to the client from the first virtual file system obtained in step (4), and constructs a second virtual file system with the exclusive directory as the root directory;

[0016] (6) The mobile storage medium creates a shared directory under the root directory of the second virtual file system obtained in step (5) to obtain an updated second virtual file system;

[0017] (7) The mobile storage medium acquires the pre-established matching triplets in sequence, and creates a plurality of virtual links pointing to the shared path in the shared directory under the root directory of the updated second virtual file system obtained in step (6) according to the matching triplets, to obtain a second virtual file system containing a plurality of virtual links, wherein the shared path is all the strings in the second element of the matching triplets;

[0018] (8) The mobile storage medium mounts the second virtual file system containing a plurality of virtual links obtained in step (7) to the client, and generates a user operation partition corresponding to the second virtual file system by the client;

[0019] (9) The mobile storage medium acquires the file read request initiated by the client to the user operation partition obtained in step (8), and acquires the corresponding plaintext file data according to the file read request;

[0020] (10) The mobile storage medium acquires the file write request initiated by the client to the user operation partition obtained in step (8), and acquires the corresponding ciphertext file data according to the file write request.

[0021] Preferably, the user key derivation method in step (2) is to use the PBKDF2 function;

[0022] The process of obtaining the master encryption key MK in step (2) is specifically:

[0023] MK = AES-GCM-Decrypt( , IV, , )

[0024] wherein AES-GCM-Decrypt represents the AES-256-GCM decryption algorithm, IV represents a random initialization vector with a length of 96 bits (12 bytes), which is generated once by a true random number generator TRNG built in the mobile storage medium represents the ciphertext obtained by encrypting the master encryption key MK by the AES-256-GCM encryption algorithm, representing a ciphertext for detecting whether the ciphertext is tampered.

[0025] Preferably, the ciphertext and the authentication tag are generated by the following steps:

[0026] (2-1) The mobile storage medium obtains an administrator password from the client, verifies the client according to the administrator password, and notifies the client to log in the mobile storage medium after the verification is passed.

[0027] (2-2) The mobile storage medium derives a 256-bit administrator key from the administrator password obtained in step (2-1).

[0028] (2-3) The mobile storage medium obtains its own unique hardware identification information (i.e. chip serial number), and generates a 256-bit master encryption key MK according to the hardware identification information and a high-entropy random number generator TRNG built-in in the mobile storage medium.

[0029] (2-4) The mobile storage medium encrypts the master encryption key MK obtained in step (2-3) using the key to obtain the ciphertext and the authentication tag , specifically:

[0030] , )=AES-GCM-Encrypt( ,IV,MK), where AES-GCM-Encrypt is an AES-256-GCM encryption algorithm.

[0031] Preferably, in step (4), the mobile storage medium first reads the file system identifier of the virtual decryption partition header, then loads the corresponding file system according to the file system identifier, then establishes a file path-physical sector mapping table according to the metadata area in the file system, and finally checks the integrity of the file path-physical sector mapping table to generate the first virtual file system.

[0032] Preferably, step (5) is specifically as follows: first, the mobile storage medium acquires the exclusive directory corresponding to the user in the first virtual file system obtained in step (4); then, a new file system instance is created, the root node of the new file system instance is set as the exclusive directory, and a directory index table and a file allocation table are allocated to the new file system; finally, the new file system is registered in the internal file system management module to obtain the second virtual file system after file system initialization is completed.

[0033] Preferably, the matching triplets in step (7) are obtained through the following sub-steps:

[0034] (7-1) The mobile storage medium acquires a plurality of shared configuration triplets from the client, and each triplet is in the following format:

[0035] (shared user, [shared path 1, shared path 2,...], [shared user 1, shared user 2,...]);

[0036] (7-2) The mobile storage medium constructs a triplet list according to all the shared configuration triplets obtained in step (7-1);

[0037] (7-3) The mobile storage medium acquires all the shared configuration triplets from the triplet list obtained in step (7-2), and screens all the shared configuration triplets in which the username of the client user is contained in the third element as the matching triplets.

[0038] Preferably, step (9) specifically includes the following sub-steps:

[0039] (9-1) The mobile storage medium acquires a file reading request initiated by the client to the user operation partition obtained in step (8), and parses the file reading request to obtain the logical file path therein;

[0040] (9-2) The mobile storage medium performs path conversion on the logical file path obtained in step (9-1) to obtain the physical sector address range corresponding to the file corresponding to the logical file path in the encryption area of the mobile storage medium;

[0041] (9-3) The mobile storage medium acquires the ciphertext data stream formed by all the encryption block data in the physical sector address range obtained in step (9-2);

[0042] (9-4) The mobile storage medium uses the master encryption key MK obtained in step (2-3) to perform real-time decryption on the ciphertext data stream by using the XTS-AES-256 algorithm to obtain the plaintext data stream;

[0043] (9-5) The client divides the clear data stream obtained in step (9-4) into a plurality of cache blocks, and writes all the cache blocks in sequence into the client, which generates the clear file data corresponding to the file read request according to all the cache blocks.

[0044] Preferably, step (9-2) is to perform path conversion by using a path conversion algorithm based on path resolution and index mapping, which first resolves the logical file path into a directory hierarchy, then retrieves the entry corresponding to the directory hierarchy in the logical path-physical address mapping table, and finally determines the physical sector address range corresponding to the file corresponding to the logical file path in the encrypted area of the mobile storage medium from the entry.

[0045] Preferably, step (10) specifically includes the following sub-steps:

[0046] (10-1) The mobile storage medium obtains the file write request initiated by the client for the user operation partition obtained in step (8), and parses the file write request to obtain the logical file path therein;

[0047] (10-2) The mobile storage medium performs path conversion on the logical file path obtained in step (10-1) to obtain the physical sector address range corresponding to the file corresponding to the logical file path in the disk of the client;

[0048] (10-3) The mobile storage medium obtains a clear data stream composed of all clear block data in the physical sector address range obtained in step (10-2);

[0049] (10-4) The mobile storage medium uses the master encryption key MK obtained in step (2-3) to encrypt the clear data stream obtained in step (10-3) in real time by using the XTS-AES algorithm to obtain the ciphertext data stream corresponding to the clear data stream;

[0050] (10-5) The client divides the ciphertext data stream obtained in step (10-4) into a plurality of cache blocks, and writes all the obtained cache blocks in sequence into the client, which generates the ciphertext file data corresponding to the file read request according to all the cache blocks

[0051] According to another aspect of the present application, a data management system for a multi-user encrypted mobile storage medium is provided, comprising:

[0052] A first module is arranged in the mobile storage medium, configured to obtain a username and a user password from a client, verify the client according to the username and the user password, and prompt the client to log in the mobile storage medium after verification;

[0053] A second module is arranged in the mobile storage medium, configured to obtain a ciphertext deriving a user key from the user password obtained from the first module and using the user key to encrypt the plaintext file data decrypting the ciphertext to obtain the master encryption key MK decrypting the ciphertext to obtain the master encryption key MK

[0054] a third module arranged in the mobile storage medium, for using the master encryption key MK obtained from the second module to decrypt the encrypted area in the mobile storage medium in real time using the XTS-AES-256 algorithm to obtain a virtual decrypted partition

[0055] a fourth module arranged in the mobile storage medium, for performing file system analysis on the virtual decrypted partition obtained from the third module to obtain a first virtual file system

[0056] a fifth module arranged in the mobile storage medium, for obtaining a dedicated directory corresponding to the client from the first virtual file system obtained from the fourth module, and constructing a second virtual file system with the dedicated directory as the root directory

[0057] a sixth module arranged in the mobile storage medium, for creating a shared directory under the root directory of the second virtual file system obtained from the fifth module to obtain an updated second virtual file system

[0058] a seventh module arranged in the mobile storage medium, for sequentially obtaining a pre-established matching triple, and creating a plurality of virtual links pointing to a shared path in the shared directory under the root directory of the updated second virtual file system obtained from the sixth module according to the matching triple, to obtain a second virtual file system containing a plurality of virtual links, wherein the shared path is all the strings in the second element of the matching triple

[0059] an eighth module arranged in the mobile storage medium, for mounting the second virtual file system containing a plurality of virtual links obtained from the seventh module to the client, and generating a user operation partition corresponding to the second virtual file system by the client

[0060] a ninth module arranged in the mobile storage medium, for obtaining a file reading request initiated by the client to the user operation partition obtained from the eighth module, and obtaining the plaintext file data corresponding thereto according to the file reading request

[0061] a tenth module arranged in the mobile storage medium, for obtaining a file writing request initiated by the client to the user operation partition obtained from the eighth module, and obtaining the ciphertext file data corresponding thereto according to the file writing request

[0062] Overall, the above technical solutions conceived by the present application can achieve the following beneficial effects compared with the prior art:

[0063] (1) The present application adopts the user authentication and user key derivation mechanism of steps (1) to (2), which can generate an independent user key through username and password verification when the user logs in, and decrypt the copy of the master encryption key using the user key, thereby solving the technical problem of the existing mobile storage medium data management method lacking multi-user identity recognition and management mechanism, and being difficult to meet the needs of multi-person sharing and collaborative office;

[0064] (2) The present application adopts the virtual decryption partition and multi-layer file system construction mechanism of steps (4) to (5), which can generate a directory for each user during decryption, and establish a virtual file system with the directory as the root directory, thereby solving the technical problem of the existing mobile storage medium data management method lacking effective data isolation mechanism, and the data of different users being stored in the same encrypted partition, so that once a user obtains access permission, all data can be viewed, resulting in a large risk of leakage of confidential information;

[0065] (3) The present application adopts the fine file sharing management mechanism of steps (6) to (7), which can customize the sharing file configuration between users, and flexibly select which user shares which file to which user, thereby solving the technical problem of the existing mobile storage medium data management method being difficult to realize flexible management of different file security level files;

[0066] (4) The present application adopts steps (1) to (5) to integrate the complete implementation mechanism of user authentication, key derivation, data isolation and file sharing at the hardware level of the mobile storage medium, and the data encryption and decryption process is completely completed by the security module inside the storage medium independently, without relying on the host operating system environment, thereby solving the technical problem of the existing encryption method based on software tools being limited by system compatibility and security due to dependence on the host environment, and having deficiencies in resisting external attacks, and being difficult to ensure stability and security in complex application environment;

[0067] (5) The present application uses a true random number generator (TRNG) inside the storage medium to generate an initialization vector and high-entropy key material, improving the randomness and attack resistance of the system;

[0068] (6) The present application adopts the PBKDF2 and HMAC-SHA256 key derivation method, which can effectively enhance the password strength and resist brute force attack;

[0069] (7) The present application can provide real-time encryption and decryption and efficient file system access while ensuring high security, balancing data security and performance, and having good practical value and promotion prospect. Attached Figure Description

[0070] Figure 1 This is a flowchart of the data management method for multi-user encrypted mobile storage media of the present invention;

[0071] Figure 2 This is a system architecture diagram of the data management method for multi-user encrypted mobile storage media of the present invention. Detailed Implementation

[0072] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0073] It should be noted that in the description of the embodiments of the present invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. The terms "upper," "lower," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the present invention. Those skilled in the art can understand the specific meaning of the above terms in the present invention according to the specific circumstances.

[0074] Furthermore, the technical solutions of the various embodiments of the present invention can be combined with each other, but only if they are feasible for those skilled in the art. If the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0075] The basic idea of ​​this invention is to provide a data management method for multi-user encrypted mobile storage media. This method employs a hierarchical key management mechanism, setting a master encryption key to uniformly encrypt the entire storage partition, while simultaneously generating an independent user key for each client user to encrypt a copy of the master encryption key. Upon client login, the mobile storage media first verifies the user's identity and derives a corresponding user key from the user's password. This user key is then used to decrypt the pre-stored copy of the master encryption key to obtain the master encryption key. The mobile storage media then uses this master encryption key to decrypt the storage partition in real time and constructs a corresponding virtual file system and dedicated directory for each user, achieving data isolation and management. The purpose of this invention is to solve the technical problem of traditional encrypted mobile storage media not supporting multi-user access control. On the one hand, data between different users is strictly isolated at the logical level, avoiding the risk of data leakage due to sharing the same encrypted partition; on the other hand, users can also set file sharing policies as needed to achieve fine-grained sharing of specific files or folders, thereby meeting the needs of multi-user collaboration in enterprise or team scenarios. Furthermore, since this invention implements user authentication, key derivation, data isolation, and file sharing functions at the hardware level of the mobile storage medium, it not only improves the security of the system but also avoids the shortcomings of traditional pure software solutions in terms of compatibility, performance, and anti-attack capabilities.

[0076] like Figure 1 and Figure 2 As shown, the present invention provides a data management method for multi-user encrypted mobile storage media, comprising the following steps:

[0077] (1) The mobile storage medium obtains the username (in this embodiment, "User A") and password from the client, verifies the client based on the username and password, and prompts the client to log in to the mobile storage medium after successful verification;

[0078] Specifically, in this invention, the client refers to a host with client software installed, which provides a user interface, such as initialization, login, account management, and file sharing configuration functions.

[0079] (2) Obtaining ciphertext from removable storage media The user key is derived from the user password obtained in step (1). (It is 256 bits), and uses the user key. Regarding the ciphertext Decryption is performed to obtain the master encryption key MK (which is 256 bits).

[0080] Specifically, the user key derivation method in this step is to use the PBKDF2 function (HMAC-SHA256 is used in this embodiment, and the iteration number is set to 100,000 times).

[0081] The process of obtaining the master encryption key MK in this step is specifically as follows:

[0082] MK = AES-GCM-Decrypt , IV, , )

[0083] wherein AES-GCM-Decrypt represents an AES-256-GCM decryption algorithm, IV represents a random initialization vector with a length of 96 bits (12 bytes), which is generated by a True Random Number Generator (TRNG) built in the mobile storage medium once and remains unchanged subsequently, represents ciphertext (which is 128 bits) obtained by encrypting the master encryption key MK using the AES-256-GCM encryption algorithm, represents an authentication tag (which is 128 bits) used to detect whether the ciphertext is tampered with.

[0084] More specifically, the ciphertext and the authentication tag are specifically generated by the following steps:

[0085] (2-1) The mobile storage medium obtains the administrator password from the client, verifies the client according to the administrator password, and notifies the client to log in to the mobile storage medium after the verification is passed;

[0086] (2-2) The mobile storage medium derives a 256-bit administrator key from the administrator password obtained in step (2-1).

[0087] Specifically, the administrator key derivation method is to use the PBKDF2 function (HMAC-SHA256 is used in this embodiment, and the iteration number is set to 100,000 times).

[0088] (2-3) The mobile storage medium obtains its unique hardware identification information (i.e., the chip serial number), and generates a 256-bit master encryption key MK according to the hardware identification information and a high-entropy random number generator (True Random Number Generator, TRNG) built in the mobile storage medium.

[0089] The advantage of the sub-step (2-3) is that the unique hardware identification information and the high-entropy random number generator are used to generate the master key, so that the master encryption key MK is random and unique.

[0090] (2-4) The mobile storage medium uses the key obtained in step (2-2) The master encryption key MK obtained in step (2-3) is encrypted to obtain ciphertext and authentication tags .

[0091] Specifically, the specific way of obtaining the ciphertext and authentication tags of the master encryption key MK in this step is:

[0092] , )=AES-GCM-Encrypt( ,IV,MK), where AES-GCM-Encrypt is an AES-256-GCM encryption algorithm.

[0093] The mobile storage medium stores , and IV in the security register of the mobile storage medium, which are used for subsequent encryption and decryption operations.

[0094] (3) The mobile storage medium uses the master encryption key MK obtained in step (2) and uses the XTS-AES-256 algorithm to perform real-time decryption on the encrypted area in the mobile storage medium to obtain a virtual decryption partition.

[0095] Specifically, the decryption process does not write all data to one physical partition, but is a real-time mapping process. At this time, all user data has been logically decrypted, but the virtual decryption partition is invisible to the host.

[0096] The above steps (2) to (3) have the advantage that the user key is used to encrypt and decrypt the copy of the master encryption key, which realizes the key layer management mechanism on the encrypted mobile storage medium and is easy to implement using existing technologies (such as Linux Unified Key Setup).

[0097] (4) The mobile storage medium performs file system analysis on the virtual decryption partition obtained in step (3) to obtain a first virtual file system.

[0098] The step specifically comprises the following steps. First, the mobile storage medium reads the file system identifier of the virtual decryption partition header, and then loads the corresponding file system according to the file system identifier. Subsequently, the file path-physical sector mapping table is established according to the metadata area in the file system. Finally, the integrity of the file path-physical sector mapping table is verified to generate the first virtual file system.

[0099] (5) The mobile storage medium acquires the exclusive directory corresponding to the client (User_A_Folder / in this example) from the first virtual file system obtained in step (4), and constructs the second virtual file system with the exclusive directory as the root directory.

[0100] The step specifically comprises the following steps. First, the mobile storage medium acquires the exclusive directory corresponding to the user in the first virtual file system obtained in step (4). Then, a new file system instance is created, the root directory node of the new file system instance is set as the exclusive directory, and the directory index table and file allocation table of the new file system are allocated. Finally, the file system initialization is completed, the new file system is registered in the internal file system management module, and the second virtual file system is obtained.

[0101] (6) The mobile storage medium creates a shared directory (shared / in this example) under the root directory of the second virtual file system obtained in step (5) to obtain the updated second virtual file system.

[0102] (7) The mobile storage medium sequentially acquires the pre-established matching triplets, and creates multiple virtual links pointing to the shared path in the shared directory under the root directory of the updated second virtual file system obtained in step (6) according to the matching triplets, to obtain the second virtual file system containing multiple virtual links, wherein the shared path is all the strings in the second element of the matching triplet.

[0103] For example, the triplet ("userB", [" / UserB_Folder / Documents / "], ["userA"]) indicates that user B shares the Documents directory to user A, and under / shared / userB / , user A will see a virtual folder named Documents, which is essentially a virtual link pointing to / UserB_Folder / Documents / .

[0104] For example, the matching triple obtained by the mobile storage medium is ("userB", [" / UserB_Folder / Documents / "], ["userA"]), which indicates that the shared path is " / UserB_Folder / Documents / ", the shared user is "userB", and the shared user is "userA". Therefore, the mobile storage medium creates a virtual link named Documents (which points to / UserB_Folder / Documents / ) for user A in the shared directory ( / shared / userB / ) under the root directory of the second virtual file system, so as to obtain the second virtual file system containing multiple virtual links.

[0105] The matching triple in this step is obtained through the following sub-steps:

[0106] (7-1) The mobile storage medium obtains multiple shared configuration triples from the client, and each triple has the following format:

[0107] (shared user, [shared path 1, shared path 2,...], [shared user 1, shared user 2,...])

[0108] For example, the shared configuration triple ("user_A", [" / UserA_Folder / Photos / "], ["userB", "userC"]) indicates that user A shares the path / UserA_Folder / Photos / to user B and user C.

[0109] (7-2) The mobile storage medium constructs a triple list according to all the shared configuration triples obtained in step (7-1).

[0110] (7-3) The mobile storage medium obtains all the shared configuration triples from the triple list obtained in step (7-2), and selects all the shared configuration triples in which the third element (which is a list) contains the username of the client user (user A in this embodiment) as the matching triple.

[0111] The above steps (6) to (7) have the advantages that the definition of file sharing configuration between users is realized through shared configuration triples, and cross-user access to files is realized through soft links under the shared directory, so that each encrypted mobile storage medium realizes fine multi-user file management.

[0112] (8) The mobile storage medium mounts the second virtual file system containing multiple virtual links obtained in step (7) to the client, and the client generates a user operation partition corresponding to the second virtual file system.

[0113] Specifically, the user operation partition integrates the personal files of user A and all the files shared to user A, and all the read and write requests of the host are processed through the partition and by the mobile storage medium.

[0114] (9) The mobile storage medium obtains a file read request initiated by the client to the user operation partition obtained in step (8), and obtains the corresponding plaintext file data according to the file read request;

[0115] This step specifically includes the following sub-steps:

[0116] (9-1) The mobile storage medium obtains a file read request (in this example, / Reports / report_Q1.pdf) initiated by the client to the user operation partition obtained in step (8), and parses the file read request to obtain the logical file path (in this example, / Reports / report_Q1.pdf) therein.

[0117] (9-2) The mobile storage medium performs path conversion on the logical file path obtained in step (9-1) to obtain the corresponding physical sector address range of the file corresponding to the logical file path in the encrypted area of the mobile storage medium.

[0118] Specifically, this step is to perform path conversion by using a path conversion algorithm based on path parsing and index mapping. First, the logical file path is parsed into a directory hierarchy, then the directory hierarchy is searched in the logical path-physical address mapping table to determine the corresponding entry, and finally the corresponding physical sector address range of the file corresponding to the logical file path in the encrypted area of the mobile storage medium is determined from the entry.

[0119] (9-3) The mobile storage medium obtains a ciphertext data stream composed of all the encrypted block data in the physical sector address range obtained in step (9-2).

[0120] (9-4) The mobile storage medium uses the master encryption key MK obtained in step (2-3) to perform real-time decryption on the ciphertext data stream by using the XTS-AES-256 algorithm to obtain a plaintext data stream.

[0121] (9-5) The client divides the plaintext data stream obtained in step (9-4) into multiple cache blocks (blocks), and writes all the cache blocks in sequence into the client, and generates the plaintext file data corresponding to the file read request according to all the cache blocks.

[0122] (10) The mobile storage medium obtains a file write request initiated by the client to the user operation partition obtained in step (8), and obtains the corresponding ciphertext file data according to the file write request;

[0123] The step specifically includes the following sub-steps:

[0124] (10-1) The mobile storage medium obtains the file write request (file.txt in this embodiment) initiated by the user operation partition in step (8) and analyzes the file write request to obtain the logical file path (file.txt in this embodiment) therein.

[0125] (10-2) The mobile storage medium performs path conversion on the logical file path obtained in step (10-1) to obtain the corresponding physical sector address range of the file in the disk of the client.

[0126] Specifically, the same method as in step (9-2) is used to perform path conversion, which will not be described here.

[0127] (10-3) The mobile storage medium obtains the plaintext data stream composed of all plaintext block data in the physical sector address range obtained in step (10-2).

[0128] (10-4) The mobile storage medium uses the master encryption key MK obtained in step (2-3) to perform real-time encryption on the plaintext data stream obtained in step (10-3) using the XTS-AES algorithm to obtain the corresponding ciphertext data stream of the plaintext data stream.

[0129] (10-5) The client divides the ciphertext data stream obtained in step (10-4) into multiple cache blocks (blocks) and writes all the obtained cache blocks in sequence in the client to generate the corresponding ciphertext file data of the file read request according to all the cache blocks.

[0130] Those skilled in the art will readily understand that the above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modification, equivalent replacement and improvement made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A data management method for a multi-user encrypted mobile storage medium, characterized in that, Includes the following steps: (1) The mobile storage medium obtains the username and password from the client, verifies the client based on the username and password, and prompts the client to log in to the mobile storage medium after successful verification; (2) Obtaining ciphertext from removable storage media The user key is derived from the user password obtained in step (1). and using the user key Regarding the ciphertext Decryption is performed to obtain the master encryption key MK; (3) The mobile storage medium uses the master encryption key MK obtained in step (2) and uses the XTS-AES-256 algorithm to decrypt the encrypted area in the mobile storage medium in real time to obtain the virtual decryption partition; (4) The removable storage medium performs file system parsing on the virtual decryption partition obtained in step (3) to obtain the first virtual file system; (5) The mobile storage medium obtains the client's exclusive directory from the first virtual file system obtained in step (4) and constructs a second virtual file system with the exclusive directory as the root directory; (6) The removable storage medium creates a shared directory in the root directory of the second virtual file system obtained in step (5) to obtain the updated second virtual file system; (7) The removable storage medium sequentially obtains the pre-established matching triplets, and creates multiple virtual links pointing to the shared path in the shared directory under the root directory of the updated second virtual file system obtained in step (6) based on the matching triplets, so as to obtain a second virtual file system containing multiple virtual links, wherein the shared path is all the strings in the second element of the matching triplet; the matching triplet in step (7) is created through the following sub-steps: (7-1) The removable storage medium obtains multiple shared configuration triples from the client, each triple having the following format: (Shared User, [Shared Path 1, Shared Path 2, ...], [Shared User 1, Shared User 2, ...]); (7-2) The removable storage medium constructs a triplet list based on all the shared configuration triplets obtained in step (7-1); (7-3) The mobile storage medium obtains all shared configuration triples from the triple list obtained in step (7-2), and filters out all shared configuration triples whose third element contains the username of the client user as matching triples. (8) The removable storage medium mounts the second virtual file system containing multiple virtual links obtained in step (7) to the client, and the client generates the user operation partition corresponding to the second virtual file system; (9) The mobile storage medium obtains the file read request initiated by the client on the user operation partition obtained in step (8), and obtains the corresponding plaintext file data according to the file read request; (10) The mobile storage medium obtains the file write request initiated by the client for the user operation partition obtained in step (8), and obtains the corresponding encrypted file data according to the file write request.

2. The data management method for multi-user encrypted mobile storage media according to claim 1, characterized in that, The user key derivation method in step (2) is to use the PBKDF2 function; The process of obtaining the master encryption key MK in step (2) is as follows: MK=AES-GCM-Decrypt( , IV, , ) Where AES-GCM-Decrypt represents the AES-256-GCM decryption algorithm, and IV represents a 96-bit random initialization vector, which is generated once by the TRNG true random number generator built into the removable storage medium. This represents the ciphertext obtained by encrypting the master encryption key MK using the AES-256-GCM encryption algorithm. Indicates the use of ciphertext detection Whether the authentication label has been tampered with.

3. The data management method for a multi-user encrypted mobile storage medium according to claim 1 or 2, characterized in that, Cipher and certification labels Specifically, it is generated through the following steps: (2-1) The removable storage medium obtains the administrator password from the client, verifies the client based on the administrator password, and notifies the client to log in to the removable storage medium after successful verification; (2-2) Using the removable storage medium, derive a 256-bit administrator key from the administrator password obtained in step (2-1). ; (2-3) The mobile storage medium obtains its own unique hardware identification information and generates a 256-bit master encryption key MK based on the hardware identification information and the high-entropy random number generator TRNG built into the mobile storage medium; (2-4) Use the key obtained in step (2-2) on the removable storage medium The master encryption key MK obtained in step (2-3) is encrypted to obtain the ciphertext. and certification labels Specifically: , )=AES-GCM-Encrypt( , IV, MK) AES-GCM-Encrypt is the AES-256-GCM encryption algorithm.

4. The data management method for multi-user encrypted mobile storage media according to claim 3, characterized in that, Step (4) is as follows: First, the mobile storage medium reads the file system identifier at the beginning of the virtual decryption partition, then loads the corresponding file system according to the file system identifier, then establishes a file path-physical sector mapping table according to the metadata area in the file system, and finally verifies the integrity of the file path-physical sector mapping table to generate the first virtual file system.

5. The data management method for multi-user encrypted mobile storage media according to claim 1, characterized in that, Step (5) specifically involves: first, obtaining the user's exclusive directory in the first virtual file system obtained in step (4) from the mobile storage medium; then, creating a new file system instance, setting the root directory node of the new file system instance to the exclusive directory, allocating a directory index table and a file allocation table for the new file system, and finally completing the file system initialization and registering the new file system to the internal file system management module to obtain the second virtual file system.

6. The data management method for multi-user encrypted mobile storage media according to claim 1, characterized in that, Step (9) specifically includes the following sub-steps: (9-1) The mobile storage medium obtains the file read request initiated by the client on the user operation partition obtained in step (8), and parses the file read request to obtain the logical file path; (9-2) The removable storage medium performs path conversion on the logical file path obtained in step (9-1) to obtain the physical sector address range of the file corresponding to the logical file path in the encrypted area of ​​the removable storage medium. (9-3) Obtain the encrypted data stream consisting of all encrypted block data within the physical sector address range obtained in step (9-2) of the removable storage medium; (9-4) The mobile storage medium uses the master encryption key MK obtained in step (2-3) and uses the XTS-AES-256 algorithm to decrypt the ciphertext data stream in real time to obtain the plaintext data stream; (9-5) The client divides the plaintext data stream obtained in step (9-4) into multiple buffer blocks and writes all the buffer blocks into the client in sequence, so that the client can generate the plaintext file data corresponding to the file read request based on all the buffer blocks.

7. The data management method for multi-user encrypted mobile storage media according to claim 6, characterized in that, Step (9-2) is to perform path conversion using a path conversion algorithm based on path resolution and index mapping. First, the logical file path is resolved into a directory level. Then, the entry corresponding to the directory level is retrieved in the logical path-physical address mapping table. Finally, the physical sector address range of the file corresponding to the logical file path in the encrypted area of ​​the removable storage medium is determined from the entry.

8. The data management method for multi-user encrypted mobile storage media according to claim 1, characterized in that, Step (10) specifically includes the following sub-steps: (10-1) The mobile storage medium obtains the file write request initiated by the client for the user operation partition obtained in step (8), and parses the file write request to obtain the logical file path; (10-2) The removable storage medium performs path conversion on the logical file path obtained in step (10-1) to obtain the physical sector address range of the file corresponding to the logical file path in the client's disk. (10-3) Obtain the plaintext data stream consisting of all plaintext block data within the physical sector address range obtained in step (10-2) of the removable storage medium; (10-4) The mobile storage medium uses the master encryption key MK obtained in step (2-3) and the XTS-AES algorithm to encrypt the plaintext data stream obtained in step (10-3) in real time to obtain the ciphertext data stream corresponding to the plaintext data stream; (10-5) The client divides the ciphertext data stream obtained in step (10-4) into multiple buffer blocks and writes all the obtained buffer blocks into the client in sequence, so that the client can generate the ciphertext file data corresponding to the file read request based on all the buffer blocks.

9. A data management system for a multi-user encrypted mobile storage medium, characterized in that, include: The first module, which is located on the removable storage medium, is used to obtain the username and password from the client, verify the client based on the username and password, and prompt the client to log in to the removable storage medium after successful verification. The second module, located on the removable storage medium, is used to retrieve encrypted text. The user key is derived from the user password obtained in the first module. and using the user key Regarding the ciphertext Decryption is performed to obtain the master encryption key MK; The third module, located on the removable storage medium, is used to decrypt the encrypted area in the removable storage medium in real time using the master encryption key MK obtained from the second module and the XTS-AES-256 algorithm to obtain the virtual decryption partition. The fourth module, located on the removable storage medium, is used to perform file system parsing on the virtual decryption partition obtained by the third module to obtain the first virtual file system. The fifth module, which is located on the removable storage medium, is used to obtain the client's exclusive directory from the first virtual file system obtained from the fourth module, and to build a second virtual file system with the exclusive directory as the root directory. The sixth module, which is located on the removable storage medium, is used to create a shared directory in the root directory of the second virtual file system obtained in the fifth module, so as to obtain the updated second virtual file system; The seventh module, located on the removable storage medium, sequentially retrieves pre-established matching triples and, based on these triples, creates multiple virtual links pointing to the shared path in the shared directory under the root directory of the updated second virtual file system obtained in the sixth module. This results in a second virtual file system containing multiple virtual links, where the shared path is all the strings in the second element of the matching triples. The matching triples in the seventh module are created through the following sub-steps: (7-1) The removable storage medium obtains multiple shared configuration triples from the client, each triple having the following format: (Shared User, [Shared Path 1, Shared Path 2, ...], [Shared User 1, Shared User 2, ...]); (7-2) The removable storage medium constructs a triplet list based on all the shared configuration triplets obtained in step (7-1); (7-3) The mobile storage medium obtains all shared configuration triples from the triple list obtained in step (7-2), and filters out all shared configuration triples whose third element contains the username of the client user as matching triples. The eighth module, located on the removable storage medium, is used to mount the second virtual file system, which contains multiple virtual links and is obtained from the seventh module, to the client, and the client generates the user operation partition corresponding to the second virtual file system. The ninth module, located on the removable storage medium, is used to obtain file read requests initiated by the client to the user operation partition obtained by the eighth module, and to obtain the corresponding plaintext file data based on the file read request. The tenth module, located on the removable storage medium, is used to obtain file write requests initiated by the client for the user operation partition obtained by the eighth module, and to obtain the corresponding encrypted file data based on the file write request.

Images