File storage encryption method implemented in user mode

Abstract

The invention relates to a file storage encryption method implemented in a user mode, and belongs to the technical field of storage encryption. The core data encryption and decryption operation is realized by adopting an FPGA (Field Programmable Gate Array). Compared with a traditional software encryption mode, the method has the following advantages that in the aspect of performance, the FPGA encryption algorithm can remarkably improve the encryption speed through customized optimization design, and the purpose of heterogeneous acceleration is achieved; in the aspect of resource occupation, the FPGA independently runs an encryption task and does not occupy resources of a main processor; in the aspect of security, encryption operation is completed in hardware and is difficult to attack by means of software; in the aspect of expandability, the FPGA supports parallel processing of multiple algorithm cores, and the encryption throughput rate can be remarkably improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of storage encryption, and particularly relates to a file storage encryption method realized in a user mode. BACKGROUND

[0002] With the acceleration of informatization, digitization and intelligentization, data has become a core asset, but data leakage, tampering and loss events occur frequently. Storage media, such as hard disks, are vulnerable to attacks, and if lost or stolen, data may be completely exposed. Data faces great threats in the storage link.

[0003] Increasingly enhanced data security and privacy protection requirements require sensitive data to be encrypted and protected.

[0004] eCryptfs uses kernel technology to realize storage encryption functions. Kernel programming has the disadvantages of high development complexity, involvement of underlying operations, lack of high-level abstraction in development, limited debugging tools, easy system crashes and poor portability.

[0005] User-mode encryption file system technology based on the FUSE framework. User-mode encryption file systems do not need to modify kernel code, have higher flexibility and scalability, and have rich user space debugging tools, so even if problems occur, the stability of the system will not be affected, reducing development difficulty and shortening development cycle. This flexibility enables user-mode file systems to be quickly iterated and deployed. FUSE supports multiple file system types, including network file systems, encryption file systems and compression file systems. However, the current encryption file systems using this technology all use software encryption, which is insufficient in performance and security. SUMMARY

[0006] (I) Technical problem to be solved The technical problem to be solved by the present application is to provide a file storage encryption method to solve the problem of fast and secure encryption storage of sensitive and important data.

[0007] (II) Technical scheme

[0008] To solve the above technical problems, the present application provides a user-mode file storage encryption method, which realizes storage encryption using the Linux system FUSE framework. It is a method of creating and managing file systems in user space, which allows users to complete file encryption and decryption without modifying the kernel, realizing transparent encryption files.

[0009] The present application also provides a system for implementing the method.

[0010] The present application also provides an application of the method in the field of storage encryption technology.

[0011] The application further provides application of the system in the field of storage encryption technology.

[0012] (Three) beneficial effects The application provides a user-mode implemented file storage encryption method, and core data encryption and decryption operations of the application are implemented by using FPGA. Compared with a traditional software encryption mode, the application has the following advantages: in terms of performance, FPGA encryption algorithms can significantly improve encryption speed and achieve the purpose of heterogeneous acceleration after customized optimization design; in terms of resource occupation, FPGA independently runs encryption tasks and does not occupy main processor resources; in terms of security, encryption operations are completed in hardware and are difficult to attack by using software means; and in terms of scalability, FPGA supports parallel processing of multiple algorithm cores and can significantly improve encryption throughput. BRIEF DESCRIPTION OF DRAWINGS

[0013] Figure 1 Fig. 1 is a schematic diagram of an encryption file system based on a FUSE framework of the application; Figure 2 Fig. 2 is a principle block diagram of an encryption file system based on a FUSE framework of the application. DETAILED DESCRIPTION

[0014] In order to make the purpose, content and advantages of the application more clear, the specific implementation manner of the application is further described below in combination with the drawings and examples.

[0015] The application provides a user-mode implemented file storage encryption method, wherein storage encryption is implemented by using a Linux system FUSE framework, which is a method for creating and managing a file system in a user space, and the method allows a user to complete file encryption and decryption without modifying a kernel and realizes a transparent encryption file system.

[0016] The encryption file system based on the FUSE framework, namely, the FUSE encryption file system, runs on a bottom-layer file system. The FUSE encryption file system serves as an intermediate layer of file processing and undertakes all file operation commands issued by a user. When the user issues a data write request, user data is transmitted into the FUSE encryption file system through a mounting directory, a write function of the FUSE encryption file system calls an FPGA encryption algorithm for processing through a PCIe interface, and then ciphertext data is stored to the bottom-layer file system. When the user issues a read request, user data is read from the bottom-layer file system into the FUSE encryption file system, a read function of the FUSE encryption file system calls an FPGA decryption algorithm for processing through the PCIe interface, and then plaintext data is sent to the user. Thus, the user relies on the FUSE encryption file system to realize file encryption and decryption functions. Figure 1 As shown in Fig. 1.

[0017] The design of the encrypted file system in the application is based on the FUSE user mode file system framework, and important and sensitive data in the system is encrypted and decrypted, and the main body is a FUSE encrypted file system. Figure 2

[0018] The FUSE encrypted file system is divided into a kernel mode and a user mode. The kernel mode FUSE driver is part of the Linux operating system kernel, and the developer only needs to focus on the user mode part. The kernel mode FUSE driver is responsible for interacting with VFS, receiving file operation requests issued by the upper application, at the same time, the kernel mode FUSE driver is registered as a kernel file system, separates and abstracts specific file system operation semantics, associates specific file operations with API callback functions provided by the user mode software, and realizes the operation connection from the kernel mode to the user mode. The user mode software includes a lib-fuse dynamic link library and a FUSE file system daemon. The FUSE file system daemon implements the structure function specified by the lib-fuse dynamic link library, constructs a set of API callback functions, and calls the FPGA encryption algorithm through the PCIe interface. The kernel mode and the user mode work together to realize the main function of the encrypted file system, and finally provide file encryption services in the form of a daemon. The file system function provided by the daemon serves as a "middleware" to build a bridge for communication between the upper user and the underlying real file system.

[0019] The implementation of the FUSE encrypted file system mainly realizes a series of API function interfaces of the file system. The API mainly includes the following categories: a) Directory operation In the FUSE encrypted file system, directory operation is one of the core functions of the FUSE encrypted file system. The key directory operations of the user mode encrypted file system based on FUSE include: Mounting and unmounting the FUSE encrypted file system: after mounting, the content of the FUSE encrypted file system can be normally accessed, and after unmounting, the mounting point directory still exists, but the directory content is empty, because the actual data access entrance has been closed; Directory modification operation: this type of operation is limited within the mounted directory, such as creating, deleting a directory, opening, closing a directory, reading a directory, renaming a directory, etc., and these operations will be implemented synchronously to the underlying file system.

[0020] b) File operation In the user mode encrypted file system based on FUSE, file operation is the core of data encryption and decryption. In the file operation API interface, there are multiple operations such as creating a file, opening a file, deleting a file, renaming a file, writing a file, reading a file, and truncating a file, among which the operations directly related to data encryption and decryption are writing a file and reading a file. ​

[0021] c) Linking operations In the FUSE-based user-mode encryption file system, links include soft links (symbolic links) and hard links. Linking operations mainly include: creating a soft link, reading a soft link, deleting a soft link, creating a hard link, and deleting a hard link. Through these operations, users can securely create and manage link files in the FUSE-based encryption file system, while ensuring data security and integrity.

[0022] d) Permission operations In the FUSE-based user-mode encryption file system, permission operations are a key part of ensuring data security. Permission operations in the FUSE encryption file system mainly include: Permission control: The FUSE encryption file system can perform fine-grained permission control on files and directories to ensure that only authorized users can access and modify files. This includes user permission management, file and directory permission control, etc. FUSE permission operations: When using FUSE, kernel-level file permission checks can be enabled through the default_permissions option, and the allow_other option allows other users to access the data on the mount point, which can be set together with default_permissions to implement shared file access restrictions. Permission changes and file operation audits: In the FUSE encryption file system, permission changes and file operations can be monitored and recorded for auditing and tracking suspicious behavior, which is an important part of ensuring data security.

[0023] The operations in file operations that are directly related to data encryption and decryption are write file and read file operations. The FUSE-based user-mode encryption file system supports custom encryption algorithms. The core performance of the encryption file system depends on the encryption and decryption rate.

[0024] Traditional software encryption is based on general-purpose processors. In terms of performance, it is usually limited by the processor's main frequency, and the encryption speed is slow; in terms of resource occupation, software encryption will occupy CPU resources, affecting the performance of other tasks; in terms of security, software encryption is vulnerable to attacks and can be cracked encryption keys and algorithms; in terms of scalability, software encryption is difficult to improve encryption capabilities through parallelism.

[0025] The scheme uses FPGA to realize data encryption service. Compared with the traditional software encryption mode, the following advantages are obtained: in terms of performance, the FPGA encryption algorithm can significantly improve the encryption speed through customized optimization design, and the purpose of heterogeneous acceleration is achieved; in terms of resource occupation, the FPGA independently runs the encryption task and does not occupy the main processor resource; in terms of security, the encryption operation is completed in hardware and is difficult to attack through software means; in terms of scalability, the FPGA supports multi-algorithm core parallel processing and improves the encryption throughput.

[0026] The encryption and decryption functions of the file system of the application are decoupled from the design of the underlying real file system, and direct access to the block device for encryption is not required. The applicable underlying real file system includes a local file system, a remote file system, a local file system such as ext4, XFS, FAT32, etc., and a remote file system such as NFS. At the same time, the file system can encrypt file metadata (i.e., file names and directory names). Through the encryption of metadata, the data stored by the file system will have higher security. At the same time, the software stack does not depend on specific hardware architecture and can be easily ported across platforms.

[0027] The file system is usually provided to the user in the form of a directory mount. Before using the file system, the user selects a specific block device to make a specific file system, for example, using a hard disk with a block device symbol of "sdb" to make a file system with a format of "ext4". The file system made here is referred to as the "underlying file system". The "underlying file system" can store any data after being mounted. After the "underlying file system" is mounted to a specific path (such as / base), the mounting (second mounting) of the FUSE encryption file system is performed, and the "underlying directory" and the "working directory" are specified during mounting. The "underlying directory" here is the mounting directory / base of the "underlying file system", and the "working directory" is the directory provided to the user, for example, / data. After the second mounting is completed, the user accesses the / data directory, that is, accesses the encrypted directory.

[0028] The core data encryption and decryption operation of the application is implemented by FPGA. Compared with the traditional software encryption mode, the following advantages are obtained: in terms of performance, the FPGA encryption algorithm can significantly improve the encryption speed through customized optimization design, and the purpose of heterogeneous acceleration is achieved; in terms of resource occupation, the FPGA independently runs the encryption task and does not occupy the main processor resource; in terms of security, the encryption operation is completed in hardware and is difficult to attack through software means; in terms of scalability, the FPGA supports multi-algorithm core parallel processing and improves the encryption throughput.

[0029] The above merely describes the preferred embodiments of the present application, and it should be pointed out that, for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present application, and these improvements and modifications should also be considered as the protection scope of the present application.

Claims

1. A file storage encryption method implemented in user space, characterized in that, This method utilizes the Linux system's FUSE framework to implement storage encryption. It is a method for creating and managing file systems in user space, allowing users to encrypt and decrypt files without modifying the kernel, thus achieving transparent file encryption.

2. The method as described in claim 1, characterized in that, This method is implemented through an encrypted file system based on the FUSE framework, namely the FUSE encrypted file system. The FUSE encrypted file system runs on top of the underlying file system and acts as an intermediate layer for file processing, responding to all file operation requests issued by the user. When a user issues a write request, the user data is transferred to the FUSE encrypted file system through the mounted directory. The write function of the FUSE encrypted file system calls the FPGA encryption algorithm through the PCIe interface to process the encrypted data and then stores it in the underlying file system. When a user issues a read request, the user's data is read from the underlying file system into the FUSE encrypted file system. The read function of the FUSE encrypted file system calls the FPGA decryption algorithm through the PCIe interface to process the data and then sends the plaintext data to the user. Thus, relying on the FUSE encrypted file system, the encryption and decryption functions of file data are realized.

3. The method as described in claim 2, characterized in that, The FUSE encrypted file system consists of two parts: kernel mode and user mode. The kernel-mode FUSE driver is part of the Linux operating system kernel. It is responsible for interacting with the VFS, receiving file operation requests from upper-layer applications, and registering itself as a kernel file system. It separates and abstracts the specific file system operation semantics, associating specific file operations with API callback functions provided by user mode, thus establishing a connection between kernel and user modes. User mode contains the lib-fuse dynamic link library and the FUSE file system daemon. The FUSE file system daemon implements the structure functions specified by the lib-fuse dynamic link library, constructs a set of API callback functions, and calls the FPGA encryption algorithm through the PCIe interface. The kernel and user modes work together to ultimately provide file encryption services in the form of a daemon process.

4. The method as described in claim 3, characterized in that, The operations implemented by the FUSE encrypted file system include the following categories: a) Directory operations Mounting and unmounting the FUSE encrypted file system: After mounting, the contents of the FUSE encrypted file system can be accessed normally. After unmounting, the mounted directory still exists, but the directory content is empty. Directory modification operations: These are performed within the mounted directory and include creating, deleting, opening, closing, reading, and renaming directories. These operations will be synchronized to the underlying file system. b) File operations The file operation API interface includes operations such as creating a file, opening a file, deleting a file, renaming a file, writing to a file, reading from a file, and truncating a file. Among these, the operations directly related to data encryption and decryption are writing to a file and reading from a file. c) Linking operations Links include soft links and hard links. Link operations include: creating a soft link, reading a soft link, deleting a soft link, creating a hard link, and deleting a hard link. Through these operations, applications can create and manage link files in the FUSE encrypted file system. d) Permission Operations Permission operations in the FUSE encrypted file system include: Access control: refers to the FUSE encrypted file system's ability to control permissions for files and directories, including user permission management and file and directory permission control; FUSE permission operations: Enable kernel-level file permission checks via the default_permissions option. In addition, the allow_other option allows other users to access data at the mount point, while setting default_permissions enables the function of restricting access to shared files. Permission changes and file operation auditing: In the FUSE encrypted file system, permission changes and file operations can be monitored and recorded.

5. The method as described in claim 4, characterized in that, FUSE encrypted file system supports custom encryption algorithms.

6. The method as described in claim 4, characterized in that, The performance of the FUSE encrypted file system depends on the encryption / decryption rate.

7. A system for implementing the method as described in any one of claims 1 to 6.

8. The system as described in claim 7, characterized in that, The system includes the FUSE encrypted file system.

9. An application of the method as described in any one of claims 1 to 6 in the field of storage encryption technology.

10. An application of the system as described in claim 7 in the field of storage encryption technology.

Images