A heterogeneous environment encryption block storage method, device, equipment and medium

Abstract

The application discloses a heterogeneous environment encryption block storage method and device, equipment and medium, and relates to the technical field of computers. The application comprises the following steps: expanding a volume encryption type creation interface in an open stack block storage management component to obtain an expanded interface, creating an encrypted volume type based on the expanded interface, generating a mapping request based on the encrypted volume type, mapping a remote block device to a local computing node based on the mapping request by using a preset protocol adaptation module to obtain a to-be-encrypted block device, and performing encryption processing on the to-be-encrypted block device based on the encrypted volume type by using a preset encryption engine module to complete encrypted block storage in a heterogeneous environment. Thus, the application can realize national secret encryption block storage that meets national secret compliance and simplifies operation and maintenance complexity in a heterogeneous storage environment.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, and medium for storing encrypted blocks in heterogeneous environments. Background Technology

[0002] With the development of cloud computing and big data technologies, cloud platforms need to connect to various storage protocols to meet different business needs. However, the existing OpenStack cloud platform has the following shortcomings in storage encryption technology: (1) Insufficient compliance with national cryptographic standards. Mainstream encryption schemes do not conform to commercial cryptographic standards and cannot meet the mandatory requirements of national cryptographic algorithms in the fields of finance and government. (2) Strong coupling between protocols and encryption. Traditional encryption technologies require the development of encryption modules for different storage protocols, resulting in high development and maintenance costs. (3) Complex key management. The distribution and rotation of keys for heterogeneous storage devices lack a unified management mechanism, which can easily lead to key leakage or management chaos. (4) High performance loss. The encryption process is not adapted to high-speed protocols, resulting in increased latency.

[0003] As can be seen from the above, how to achieve national cryptographic standard encryption block storage that meets national cryptographic standard compliance and simplifies operation and maintenance complexity in a heterogeneous storage environment is an urgent problem to be solved. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a method, apparatus, device, and medium for storing encrypted blocks in heterogeneous environments, which can achieve national cryptographic standard encrypted block storage that meets national cryptographic standard compliance and simplifies operation and maintenance complexity in heterogeneous storage environments. The specific solution is as follows:

[0005] Firstly, this application provides a method for storing encrypted blocks in heterogeneous environments, including:

[0006] The volume encryption type creation interface in the open stack block storage management component is extended to obtain an extended interface, and an encrypted volume type is created based on the extended interface; the encrypted volume type includes metadata information, backend storage unit information pointed to by the encrypted volume type, encryption algorithm type, key length, and encryption mode;

[0007] A mapping request is generated based on the encrypted volume type, and a preset protocol adaptation module is used to map the remote block device to the local computing node based on the mapping request to obtain the block device to be encrypted; the preset protocol adaptation module supports Internet Small Computer System Interface, Fibre Channel, network-based non-volatile memory high-speed protocol and distributed block storage protocol.

[0008] The preset encryption engine module encrypts the device to be encrypted based on the encrypted volume type to complete the encrypted block storage in a heterogeneous environment; the preset encryption engine module integrates the national cryptographic algorithms SM3 and SM4 and adopts a layered plug-in architecture to support both software and hardware encryption modes.

[0009] Optionally, the volume encryption type creation interface in the open stack block storage management component is extended to obtain an extended interface, including:

[0010] Modify the interface verification logic in the open stack storage management component, and extend the volume encryption type creation interface in the open stack storage management component based on the interface verification logic to obtain the extended interface;

[0011] The interface verification logic allows the interface's cryptographic algorithm field to support the national cryptographic standard SM4 algorithm parameters; the national cryptographic standard SM4 algorithm parameters include algorithm type, key length, and encryption mode.

[0012] Optionally, before mapping the remote block device to the local computing node based on the mapping request using a preset protocol adaptation module to obtain the block device to be encrypted, the method further includes:

[0013] The mounting method of the distributed storage volume of the preset protocol adaptation module is adjusted to use a local mapping method to map the remote block device to the local host machine for use as a local disk device.

[0014] Optionally, the preset protocol adaptation module supports the process of network-based non-volatile memory high-speed protocols, including:

[0015] The interface functions for initializing and terminating connections are implemented through an extended block storage driver.

[0016] A mapping request is initiated to the remote storage via a secure shell or a state transition management method, and connection information is returned; the connection information includes the target portal, target port, transmission type, and unique identifier.

[0017] Optionally, the step of using a preset encryption engine module to encrypt the device to be encrypted based on the encrypted volume type to complete the encrypted block storage in a heterogeneous environment includes:

[0018] An encryption key is generated based on the key length in the encryption volume type using a preset encryption engine module, and the device to be encrypted is converted into a preset encryption format based on the encryption algorithm type and encryption mode to complete the encryption block storage in a heterogeneous environment.

[0019] Optionally, the heterogeneous environment encrypted block storage method further includes:

[0020] Create a key generation cycle, and generate an update key based on the key generation cycle;

[0021] The encryption key is replaced with the updated key using a preset encryption setting tool, and the updated key is persistently stored.

[0022] Optionally, the preset encryption engine module supports interfacing with third-party hardware encryption devices or key management systems, so that the third-party hardware encryption devices can perform key generation for national cryptographic algorithms, block device encryption formatting, encryption volume switching, and key rotation operations.

[0023] Secondly, this application provides a heterogeneous environment encrypted block storage device, comprising:

[0024] The interface extension module is used to extend the volume encryption type creation interface in the open stack block storage management component to obtain the extended interface, and to create an encrypted volume type based on the extended interface; the encrypted volume type includes metadata information, backend storage unit information pointed to by the encrypted volume type, encryption algorithm type, key length and encryption mode;

[0025] The device mapping module is used to generate a mapping request based on the encrypted volume type, and to map the remote block device to the local computing node based on the mapping request using a preset protocol adaptation module to obtain the block device to be encrypted; the preset protocol adaptation module supports Internet Small Computer System Interface, Fibre Channel, network-based non-volatile memory high-speed protocol and distributed block storage protocol.

[0026] An encrypted storage module is used to encrypt the device to be encrypted based on the encrypted volume type using a preset encryption engine module, so as to complete the encrypted block storage in a heterogeneous environment; the preset encryption engine module integrates the national cryptographic algorithms SM3 and SM4, and adopts a layered plug-in architecture to support software and hardware encryption modes.

[0027] Thirdly, this application provides an electronic device, comprising:

[0028] Memory, used to store computer programs;

[0029] A processor is used to execute the computer program to implement the aforementioned heterogeneous environment encrypted block storage method.

[0030] Fourthly, this application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned heterogeneous environment encrypted block storage method.

[0031] This application provides a method for encrypted block storage in a heterogeneous environment. It extends the volume encryption type creation interface in the OpenStack Block Storage Management Component to obtain an extended interface, and creates an encrypted volume type based on the extended interface. The encrypted volume type includes metadata information, a target backend, an encryption algorithm type, a key length, and an encryption mode. A mapping request is generated based on the encrypted volume type, and a preset protocol adaptation module is used to map a remote block device to a local computing node based on the mapping request, thus obtaining a block device to be encrypted. The preset protocol adaptation module supports Internet Small Computer System Interface (ISP), Fibre Channel, network-based non-volatile memory high-speed protocols, and distributed block storage protocols. A preset encryption engine module is used to encrypt the block device to be encrypted based on the encrypted volume type to complete encrypted block storage in a heterogeneous environment. The preset encryption engine module integrates the national cryptographic algorithms SM3 and SM4 and adopts a layered plug-in architecture to support both hardware and software encryption modes.

[0032] As can be seen from the above, this application extends the open stack block storage management component, integrates national cryptographic algorithms (such as SM4, SM3, and SM2), and designs a unified adaptation layer to achieve transparent encryption and key management for multi-protocol storage devices. It converts block device requests from different storage protocols into a unified encryption interface; combines the SM2 asymmetric algorithm to achieve key distribution, and supports dynamic rotation of encryption keys. Thus, it enables the implementation of national cryptographic encrypted block storage in heterogeneous storage environments that meets national cryptographic compliance requirements while simplifying operational complexity. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0034] Figure 1 This is a flowchart of a heterogeneous environment encrypted block storage method disclosed in this application;

[0035] Figure 2 This is a schematic diagram of a heterogeneous environment encrypted block storage device disclosed in this application;

[0036] Figure 3 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] With the development of cloud computing and big data technologies, cloud platforms need to interface with various storage protocols to meet different business needs. However, existing OpenStack cloud platforms suffer from insufficient compliance with national cryptographic standards in terms of storage encryption technology, strong coupling between protocols and encryption, complex key management, and significant performance overhead. Therefore, this application provides a heterogeneous environment encrypted block storage solution that can achieve national cryptographic standard encrypted block storage that meets national cryptographic standard compliance and simplifies operation and maintenance complexity in heterogeneous storage environments.

[0039] See Figure 1 As shown in the figure, this application discloses a method for storing encrypted blocks in a heterogeneous environment, including:

[0040] Step S11: Extend the volume encryption type creation interface in the open stack block storage management component to obtain the extended interface, and create an encrypted volume type based on the extended interface.

[0041] In this embodiment, the volume encryption type creation interface of the extended block storage management component is described. Since the native interface performs strong validation on asymmetric key algorithm types, the interface validation function needs to be modified to allow interface fields to accept relevant fields of the national cryptographic standard SM4. Specifically, extending the volume encryption type creation interface in the open stack block storage management component to obtain the extended interface may include: modifying the interface validation logic in the open stack block storage management component, and extending the volume encryption type creation interface based on the interface validation logic to obtain the extended interface; wherein, the interface validation logic allows the interface's cryptographic algorithm fields to support national cryptographic standard SM4 algorithm parameters; the national cryptographic standard SM4 algorithm parameters include algorithm type, key length, and encryption mode. That is, by modifying the native interface's logic for strong validation of asymmetric key algorithm types, the interface fields are allowed to accept relevant fields of national cryptographic standard SM4, such as sm4-xts-plain64. Users can create a block storage encryption volume type through the interface, the encryption volume type including metadata information, the backend storage unit information pointed to by the encryption volume type, encryption algorithm type, key length, and encryption mode.

[0042] Step S12: Generate a mapping request based on the encrypted volume type, and use a preset protocol adaptation module to map the remote block device to the local computing node based on the mapping request to obtain the block device to be encrypted.

[0043] In this embodiment, the native implementation of the encryption engine module differs between distributed and centralized storage block storage encryption. For distributed storage, the QEMU virtualization component integrates support for RBD (RADOS BlockDevice, a block device protocol based on Ceph distributed storage systems) and LUKS (Linux Unified KeySetup, a standard for encrypting block devices). Due to the high coupling, it is difficult to extend support for national cryptographic algorithms. Therefore, the distributed storage encryption access method needs to be modified. Specifically, before mapping the remote block device to the local computing node based on the mapping request using the preset protocol adaptation module to obtain the block device to be encrypted, the method may further include: adjusting the mounting method of the distributed storage volume of the preset protocol adaptation module to use a local mapping method to map the remote block device to the local host machine as a local disk device. That is, modifying the distributed storage encryption access method, changing the mounting method of the distributed storage volume to a local map method, that is, mapping from the remote block storage to the local host machine as a local disk device, thereby decoupling the distributed block storage encryption from the virtualization component.

[0044] In this embodiment, the preset protocol adaptation module supports Internet Small Computer System Interface (ISPI), Fibre Channel, network-based non-volatile memory high-speed protocol, and distributed block storage protocol. Specifically, the process by which the preset protocol adaptation module supports network-based non-volatile memory high-speed protocol may include: implementing interface functions for initializing and terminating connections through an extended block storage driver; initiating mapping requests to remote storage through a secure shell or representational state transfer management method, and returning connection information; the connection information includes the target portal, target port, transmission type, and unique identifier. That is, through the extended block storage management component driver, it supports interfacing with RDMA (Remote Direct Memory Access, a high-efficiency network communication technology) protocol storage, mainly implementing common interfaces such as initializing and terminating connections. The interface issues mapping and cancel mapping requests to remote storage through management methods such as SSH (Secure Shell) and REST (Representational State Transfer). The storage establishes a mapping channel to the virtual machine host through an IB (InfiniBand) network, and the interface returns relevant necessary information. The remote device connects to the local machine via the NVMe-oF (Non-Volatile Memory Express over Fabrics, a high-performance storage protocol) protocol, acting as a simulated local high-performance NVMe (Non-Volatile Memory Express, a non-volatile host controller interface specification) device. Furthermore, for the NVMe-oF-simulated local device, optimizations are implemented to bypass the virtualization software switching layer and directly allocate it to the virtual machine, reducing performance overhead.

[0045] Step S13: Use the preset encryption engine module to encrypt the device to be encrypted based on the encrypted volume type to complete the encrypted block storage in a heterogeneous environment.

[0046] In this embodiment, the preset encryption engine module integrates the national cryptographic algorithms SM3 and SM4, and adopts a layered plug-in architecture to support both hardware and software encryption modes. The preset encryption engine module uses a plug-in structure design, providing a unified encryption and decryption interface, such as formatting the encrypted volume, unlocking the encrypted volume, closing the encrypted volume, and rotating the key in the LUKs encrypted volume key slot.

[0047] In this embodiment, the preset protocol adaptation module unifies the encrypted access protocol, and the `initialize_connection` method is called to obtain a simulated drive letter mapped from remote storage to local storage. The preset encryption engine module then encrypts the block device to be encrypted based on the encrypted volume type. Specifically, encrypting the block device based on the encrypted volume type using the preset encryption engine module to complete encrypted block storage in a heterogeneous environment can include: generating an encryption key based on the key length in the encrypted volume type using the preset encryption engine module, and converting the block device to be encrypted into a preset encryption format based on the encryption algorithm type and encryption mode to complete encrypted block storage in a heterogeneous environment. That is, the preset encryption engine module obtains encryption algorithm-related fields from the volume encryption type, such as SM4 encryption algorithm and XTS mode, then generates a random number key of a specified length using a pseudo-random number generator, and calls the encryption backend, passing in the specified algorithm, mode, and key content to perform operations such as encrypting, opening, closing, and modifying the key slot key of the simulated drive letter.

[0048] Furthermore, the preset encryption engine module expands the key rotation update function. Specifically, the heterogeneous environment encryption block storage method may further include: creating a key generation cycle and generating an update key based on the key generation cycle; replacing the encryption key with the update key through a preset encryption setting tool, and persistently storing the update key. Taking a software plugin as an example, a periodic task for creating an update key is created, and the update cycle time can be configured as needed, with a default of 3 months. When updating the key, a random key of the same length is first obtained, and the old key is simultaneously retrieved from the database. Then, the encryption key slot key is updated with the new key, and the new key is stored in the database. This further improves the security of encrypted storage.

[0049] In this embodiment, the preset encryption engine module supports interfacing with third-party hardware encryption devices or encryption systems that support Chinese national cryptographic algorithms. This ensures that the third-party encryption device can access the local drive, and that the encryption device supports methods such as generating Chinese national cryptographic keys, formatting encrypted block storage, enabling encrypted block storage, disabling encrypted block storage, and rotating block storage keys, thereby simplifying operational complexity.

[0050] As can be seen from the above, this application's embodiments improve the encrypted access mechanism of distributed storage by extending the open stack block storage management component, connecting to mainstream protocols, abstracting underlying protocol details, providing a unified data block read / write interface, supporting protocol-aware encryption strategy matching, integrating national cryptographic algorithms (such as SM4, SM3, and SM2), and designing a unified adaptation layer to achieve transparent encryption and key management for multi-protocol storage devices, thus expanding and unifying support for multi-protocol heterogeneous storage. The preset encryption engine module integrates national cryptographic algorithms SM3 / SM4, and the module adopts a layered plug-in architecture, supporting hybrid hardware and software encryption modes and key rotation; it provides a unified encryption / decryption interface for upper-layer calls. Therefore, it is possible to achieve national cryptographic encrypted block storage that meets national cryptographic compliance requirements and simplifies operation and maintenance complexity in heterogeneous storage environments.

[0051] See Figure 2 As shown in the figure, this application discloses a heterogeneous environment encrypted block storage device, including:

[0052] The interface extension module 11 is used to extend the volume encryption type creation interface in the open stack block storage management component to obtain the extended interface, and to create an encrypted volume type based on the extended interface; the encrypted volume type includes metadata information, backend storage unit information pointed to by the encrypted volume type, encryption algorithm type, key length and encryption mode;

[0053] The device mapping module 12 is used to generate a mapping request based on the encrypted volume type, and to map the remote block device to the local computing node based on the mapping request using a preset protocol adaptation module to obtain the block device to be encrypted; the preset protocol adaptation module supports Internet Small Computer System Interface, Fibre Channel, network-based non-volatile memory high-speed protocol and distributed block storage protocol.

[0054] The encrypted storage module 13 is used to encrypt the block device to be encrypted based on the encrypted volume type using a preset encryption engine module, so as to complete the encrypted block storage in a heterogeneous environment. The preset encryption engine module integrates the national cryptographic algorithms SM3 and SM4 and adopts a layered plug-in architecture to support software and hardware encryption modes. The preset encryption engine module supports docking with third-party hardware encryption devices or key management systems, so that the third-party hardware encryption devices can perform key generation of national cryptographic algorithms, block device encryption formatting, encrypted volume switching and key rotation operations.

[0055] In some specific embodiments, the interface expansion module 11 may specifically include:

[0056] The interface extension unit is used to modify the interface verification logic in the open stack storage management component, and extend the volume encryption type creation interface in the open stack storage management component based on the interface verification logic to obtain the extended interface.

[0057] The interface verification logic allows the interface's cryptographic algorithm field to support the national cryptographic standard SM4 algorithm parameters; the national cryptographic standard SM4 algorithm parameters include algorithm type, key length, and encryption mode.

[0058] In some specific embodiments, the device mapping module 12 may specifically include:

[0059] The driver extension unit is used to implement the interface functions of initializing and terminating the connection interface through the extension block storage driver;

[0060] The mapping request sending unit is used to initiate a mapping request to the remote storage through a secure shell or a representation state transition management method, and return connection information; the connection information includes the target portal, target port, transmission type and unique identifier.

[0061] In some specific embodiments, the encrypted storage module 13 may specifically include:

[0062] An encrypted storage unit is used to generate an encryption key based on the key length in the encrypted volume type using a preset encryption engine module, and to convert the device to be encrypted into a preset encryption format based on the encryption algorithm type and encryption mode, so as to complete the encrypted block storage in a heterogeneous environment.

[0063] In some specific embodiments, the heterogeneous environment encrypted block storage device may further include:

[0064] The mounting method adjustment unit is used to adjust the mounting method of the distributed storage volume of the preset protocol adaptation module to use the local mapping method to map the remote block device to the local host machine as a local disk device.

[0065] A key generation unit is used to create a key generation cycle and generate an update key based on the key generation cycle;

[0066] The key update unit is used to replace the encryption key with the update key through a preset encryption setting tool, and to persistently store the update key.

[0067] Furthermore, embodiments of this application also disclose an electronic device, Figure 3This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the heterogeneous environment encrypted block storage method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0068] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0069] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0070] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the heterogeneous environment encrypted block storage method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0071] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned heterogeneous environment encrypted block storage method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0072] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0073] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0074] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0075] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0076] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for storing encrypted blocks in a heterogeneous environment, characterized in that, include: The volume encryption type creation interface in the open stack block storage management component is extended to obtain an extended interface, and an encrypted volume type is created based on the extended interface; the encrypted volume type includes metadata information, backend storage unit information pointed to by the encrypted volume type, encryption algorithm type, key length, and encryption mode; A mapping request is generated based on the encrypted volume type, and a preset protocol adaptation module is used to map the remote block device to the local computing node based on the mapping request to obtain the block device to be encrypted. The preset protocol adaptation module supports Internet Small Computer System Interface, Fibre Channel, network-based non-volatile memory high-speed protocol and distributed block storage protocol. The device to be encrypted is encrypted using a preset encryption engine module based on the encrypted volume type, so as to complete the encrypted block storage in a heterogeneous environment; The preset encryption engine module integrates the national cryptographic algorithms SM3 and SM4, and adopts a layered plug-in architecture to support both software and hardware encryption modes. The extended interface for creating volume encryption types in the open stack block storage management component includes: Modify the interface verification logic in the open stack storage management component, and extend the volume encryption type creation interface in the open stack storage management component based on the interface verification logic to obtain the extended interface; The interface verification logic allows the interface's cryptographic algorithm field to support the national cryptographic standard SM4 algorithm parameters; the national cryptographic standard SM4 algorithm parameters include algorithm type, key length, and encryption mode.

2. The heterogeneous environment encrypted block storage method according to claim 1, characterized in that, Before mapping the remote block device to the local computing node using the preset protocol adaptation module based on the mapping request to obtain the block device to be encrypted, the method further includes: The mounting method of the distributed storage volume of the preset protocol adaptation module is adjusted to use a local mapping method to map the remote block device to the local host machine for use as a local disk device.

3. The heterogeneous environment encrypted block storage method according to claim 1, characterized in that, The process by which the preset protocol adaptation module supports network-based non-volatile memory high-speed protocols includes: The interface functions for initializing and terminating connections are implemented through an extended block storage driver. A mapping request is initiated to the remote storage via a secure shell or a state transition management method, and connection information is returned; the connection information includes the target portal, target port, transmission type, and unique identifier.

4. The heterogeneous environment encrypted block storage method according to claim 1, characterized in that, The step of using a preset encryption engine module to encrypt the device to be encrypted based on the encrypted volume type to complete the encrypted block storage in a heterogeneous environment includes: An encryption key is generated based on the key length in the encryption volume type using a preset encryption engine module, and the device to be encrypted is converted into a preset encryption format based on the encryption algorithm type and encryption mode to complete the encryption block storage in a heterogeneous environment.

5. The heterogeneous environment encrypted block storage method according to claim 4, characterized in that, Also includes: Create a key generation cycle, and generate an update key based on the key generation cycle; The encryption key is replaced with the updated key using a preset encryption setting tool, and the updated key is persistently stored.

6. The heterogeneous environment encrypted block storage method according to any one of claims 1 to 5, characterized in that, The preset encryption engine module supports integration with third-party hardware encryption devices or key management systems, enabling the third-party hardware encryption devices to perform key generation for national cryptographic algorithms, block device encryption formatting, encryption volume switching, and key rotation operations.

7. A heterogeneous environment encrypted block storage device, characterized in that, include: The interface extension module is used to extend the volume encryption type creation interface in the open stack block storage management component to obtain the extended interface, and to create an encrypted volume type based on the extended interface; the encrypted volume type includes metadata information, backend storage unit information pointed to by the encrypted volume type, encryption algorithm type, key length and encryption mode; The device mapping module is used to generate a mapping request based on the encrypted volume type, and to map the remote block device to the local computing node based on the mapping request using a preset protocol adaptation module, so as to obtain the block device to be encrypted. The preset protocol adaptation module supports Internet Small Computer System Interface, Fibre Channel, network-based non-volatile memory high-speed protocol and distributed block storage protocol. An encrypted storage module is used to encrypt the device to be encrypted based on the encrypted volume type using a preset encryption engine module, so as to complete the encrypted block storage in a heterogeneous environment. The preset encryption engine module integrates the national cryptographic algorithms SM3 and SM4, and adopts a layered plug-in architecture to support both software and hardware encryption modes. The interface expansion module includes: The interface extension unit is used to modify the interface verification logic in the open stack storage management component, and extend the volume encryption type creation interface in the open stack storage management component based on the interface verification logic to obtain the extended interface. The interface verification logic allows the interface's cryptographic algorithm field to support the national cryptographic standard SM4 algorithm parameters; the national cryptographic standard SM4 algorithm parameters include algorithm type, key length, and encryption mode.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the heterogeneous environment encrypted block storage method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, Used to store computer programs, wherein the computer programs, when executed by a processor, implement the heterogeneous environment encrypted block storage method as described in any one of claims 1 to 6.

Images