Data encryption and decryption method, electronic equipment and computer program product

Abstract

The embodiment of the invention is suitable for the technical field of data security, and provides a data encryption method, a data decryption method, electronic equipment and a computer program product, and the method comprises the steps: determining a target encryption task unit; the target encryption task unit corresponds to an initial write request of the to-be-encrypted data; sending the to-be-encrypted data corresponding to the target encryption task unit to an external encryption device; and when the encrypted data corresponding to the target encryption task unit is received, updating the initial write request based on the encrypted data so as to trigger the preset data driving component to store the encrypted data. According to the embodiment of the invention, the write request can be decoupled from the encryption process of the to-be-encrypted data, and the encryption efficiency of the to-be-encrypted data is improved. The problem of processing blocking of the write request due to the fact that the external encryption device needs to wait for encrypting the to-be-encrypted data is avoided, and the data encryption efficiency is improved.

Description

Technical Field

[0001] This application belongs to the field of data security technology, and in particular relates to a data encryption and decryption method, electronic device and computer program product. Background Technology

[0002] In the field of data encryption, especially in scenarios where external cryptographic services are used to meet compliance requirements, a long-standing core technical problem is the strong coupling between encryption / decryption calculations and disk I / O operations, and the large latency of calling external cryptographic services, which ultimately leads to a serious degrade in I / O performance.

[0003] In traditional synchronous encryption models, when the operating system kernel's I / O thread initiates a write request, it must synchronously wait for the data to be encrypted by an external cryptographic service before submitting the encrypted data to the disk drive. During this waiting process, the I / O thread is completely blocked and unable to process other requests, resulting in a significant increase in I / O latency. Because the I / O thread is idle and waiting during data encryption, the entire storage stack's request processing pipeline cannot achieve pipelined operation. This limits the overall system throughput to the latency of a single encryption operation, thus restricting the performance of the storage medium.

[0004] When I / O threads are blocked and waiting, the CPU cores are in an idle or inefficient state, while the encryption computation task cannot be processed in parallel by other cores. Furthermore, since encryption computation relies on remote network calls to external cryptographic services, the network round-trip time (RTT) is directly added to the I / O latency, exacerbating the performance problem.

[0005] Therefore, there is an urgent need for a data processing method that can eliminate the blocking problem of I / O threads during data processing. Summary of the Invention

[0006] In view of this, embodiments of this application provide a data encryption and decryption method, electronic device, and computer program product to improve the efficiency of data encryption and decryption by avoiding the blocking problem of write / read requests caused by waiting for an external encryption device to encrypt / decrypt the data to be decrypted.

[0007] A first aspect of this application provides a data encryption method, comprising: determining a target encryption task unit; the target encryption task unit corresponding to an initial write request for data to be encrypted; sending the data to be encrypted corresponding to the target encryption task unit to an external encryption device; and, upon receiving encrypted data corresponding to the target encryption task unit, updating the initial write request based on the encrypted data to trigger a preset data-driven component to store the encrypted data.

[0008] In some implementations of the first aspect, before determining the target encryption task unit, the method includes: obtaining an initial write request for a preset storage medium; determining an initial write request corresponding to the data to be encrypted based on preset encryption policy information; and generating an encryption task unit to be processed for the initial write request corresponding to the data to be encrypted.

[0009] In some implementations of the first aspect, generating a processing encryption task unit for the initial write request corresponding to the data to be encrypted includes: extracting an idle encryption task unit from a preset first object pool; determining first feature information of the initial write request; and associating the idle encryption task unit with the first feature information to generate a processing encryption task unit.

[0010] In some implementations of the first aspect, after updating the write request based on the encrypted data, the method further includes: determining a first reference count value for the target encryption task unit; when the first reference count value is a preset threshold, resetting the target encryption task unit to an idle encryption task unit, and adding the idle encryption task unit to the first object pool.

[0011] In some implementations of the first aspect, the method further includes: determining the current write position of a preset first lock-free circular queue; when the first lock-free circular queue is not full, storing the encryption task unit to be processed to the current write position based on atomic operations; when the first lock-free circular queue is full, performing queue overflow processing on the encryption task unit to be processed; the queue overflow processing includes dynamically expanding the first lock-free circular queue or caching the encryption task unit to be processed.

[0012] In some implementations of the first aspect, determining the target encryption task unit includes: determining the current readable position of a preset first unlocked circular queue; determining the task status of the encryption task unit to be processed located at the current readable position; and, if the task status is "already enqueued", determining the encryption task unit to be processed located at the current readable position as the target encryption task unit, and updating the task status of the target encryption task unit to "processing".

[0013] In some implementations of the first aspect, updating the write request based on the encrypted data includes: updating the data vector information in the initial write request based on the encrypted data to obtain a target write request; storing the target write request in a preset write request queue to trigger a data-driven component to read and respond to the target write request in the write request queue.

[0014] A second aspect of this application provides a data decryption method, including:

[0015] Determine the target decryption task unit; the target decryption task unit corresponds to the initial read request of the data to be decrypted. The data to be decrypted corresponding to the target decryption task unit is sent to the external decryption device; Upon receiving the decrypted data corresponding to the target decryption task unit, the initial read request is updated based on the decrypted data to trigger a preset data application component to read the decrypted data.

[0016] A third aspect of this application provides an electronic device including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the electronic device implements the data encryption method as described in the first aspect or the data decryption method as described in the second aspect.

[0017] A fourth aspect of this application provides a computer program product, including a computer program that, when run, causes the data encryption method as described in the first aspect or the data decryption method as described in the second aspect to be executed.

[0018] A fifth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the data encryption method as described in the first aspect or the data decryption method as described in the second aspect.

[0019] In this embodiment, by determining a target encryption task unit; the target encryption task unit corresponds to the initial write request of the data to be encrypted; the data to be encrypted corresponding to the target encryption task unit is sent to an external encryption device; upon receiving the encrypted data corresponding to the target encryption task unit, the initial write request is updated based on the encrypted data to trigger a preset data-driven component to store the encrypted data, thus achieving complete decoupling between the I / O processing thread and the encryption task, avoiding thread blocking, and improving data encryption efficiency. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of a data encryption method provided in an embodiment of this application; Figure 2 This is a schematic diagram of a data decryption method provided in an embodiment of this application; Figure 3 This is a schematic diagram of a data encryption device provided in an embodiment of this application; Figure 4 This is a schematic diagram of a data decryption device provided in an embodiment of this application; Figure 5 This application provides a data processing system according to its embodiments; Figure 6 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0022] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0023] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0024] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0025] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0026] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0027] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0028] One inventive concept of this application is to build an efficient asynchronous task scheduling framework at the storage driver layer. By associating write requests, data to be encrypted, and encrypted data through encrypted task units, the write request processing of data to be encrypted is decoupled from the data encryption processing. This avoids thread blocking caused by the need to perform data encryption during the write request processing, thereby improving the efficiency of writing data to be encrypted. The technical solution of this application will be described below through specific embodiments.

[0029] Reference Figure 1 The diagram illustrates a data encryption method provided in an embodiment of this application, which may specifically include the following steps: Step 101: Determine the target encryption task unit.

[0030] The EncryptTaskUnit is the core data structure that runs through the entire asynchronous data encryption process. Its field design takes into account data integrity, state traceability, and resource reusability.

[0031] As an example, the definition of a cryptographic task unit can be as follows: struct EncryptTaskUnit { structbio orig_bio; / / A pointer to the initial write request, used to associate encrypted data later. void plaintext_buf; / / Buffer for the data to be encrypted (or zero-copy mapping address) void ciphertext_buf; / / Pre-allocated encrypted data buffer enumTaskStatestate; / / Task state machine: TS_INIT (initialization), TS_QUEUED (enqueued), TS_PROCESSING (processing), TS_COMPLETED (completed), TS_FAILED (failed) struct list_headcompleted_node; / / Nodes used to link into the completed list. atomic_tref_count; / / Reference counting to ensure safe resource release. unsignedintdata_len; / / Data length, records the number of valid bytes in the data to be encrypted / the already encrypted data. structcompletion comp; / / Optional: The amount of time required to complete the synchronization waiting scenario (enable as needed) }; State machines can avoid inconsistencies in state when multiple threads access the system concurrently through atomic switching and memory barriers.

[0032] The target encryption task unit is an encryption task unit associated with the data to be encrypted and the initial write request; that is, the target encryption task unit corresponds to the initial write request of the data to be encrypted. After the target encryption task unit is determined, the state of the encryption task unit is switched to "TS_PROCESSING" through an atomic operation to avoid two or more encryption threads used to process the same target encryption task unit repeatedly.

[0033] An initial write request refers to a data write request initiated by a data application component (e.g., a file system, an application). As an example, an initial write request can be an initial block I / O write request (BIO). The initial write request can be submitted to the kernel storage stack by the I / O submission thread. The I / O processing thread associates the encryption task unit with the initial write request to obtain the encryption task unit to be processed. Then, the encryption thread determines and processes the target encryption task unit from the encryption task units to be processed, and the encryption thread asynchronously processes the data encryption, thereby achieving complete decoupling between the encryption task and the I / O processing thread.

[0034] Step 102: Send the data to be encrypted corresponding to the target encryption task unit to the external encryption device.

[0035] After the encryption thread determines the target encryption task unit, it can determine the data to be encrypted corresponding to the target encryption task unit and send the data to be encrypted to the external encryption device through the kernel network stack.

[0036] An external encryption device encrypts the data to be encrypted and returns the encrypted data to the encryption thread, which is the encrypted data corresponding to the target encryption task unit.

[0037] In practical applications, the encryption thread can also send the encryption algorithm identifier and key index to an external encryption device, which will then call the encryption algorithm corresponding to the encryption algorithm identifier and the key corresponding to the key to encrypt the data to be encrypted, thereby generating encrypted data.

[0038] In practical applications, external encryption devices can be server cryptographic machine clusters. These clusters are external, compliant encryption devices that receive encryption requests over a network and return ciphertext, providing a high level of security encryption services. A server cryptographic machine cluster contains multiple cryptographic machines that support load balancing. The optimal cryptographic machine node is selected through round-robin or hash algorithms to avoid overloading a single node, thereby improving the efficiency of data encryption processing.

[0039] For encryption threads, an encryption thread pool can be pre-built. For example, multiple dedicated encryption threads can be created based on the kernel's thread creation mechanism to form an encryption thread pool. Encryption threads can be bound to specific CPU cores to avoid thread scheduling overhead. The number of threads is dynamically adjusted based on the system load, cryptographic machine throughput, and queue length for storing pending encryption tasks. For example, a minimum of two encryption threads can be set to ensure basic encryption capabilities, while a maximum number of encryption threads can be set to avoid scheduling contention caused by too many encryption threads. The number of encryption threads in the encryption thread pool can also be dynamically adjusted. For example, if the queue length exceeds a threshold (e.g., 70% of queue capacity) for three consecutive periods, one or two threads can be automatically added; if the queue length is below a threshold (e.g., 30% of queue capacity) for five consecutive periods, one thread can be removed, but not less than the minimum number of threads.

[0040] Step 103: Upon receiving the encrypted data corresponding to the target encryption task unit, update the initial write request based on the encrypted data to trigger the preset data-driven component to store the encrypted data.

[0041] While waiting for the cipher machine to return encrypted data, the encryption thread can handle other tasks and can be woken up via an event-driven mechanism. If encryption fails, such as due to the cipher machine going offline or network timeout, the encryption thread marks the target encryption task unit status as TS_FAILED (failed), triggers the retry mechanism, and sets a maximum number of retries. If all retries fail after reaching the maximum number, error information is recorded in the kernel log, and the callback execution component (e.g., a soft interrupt or a dedicated I / O completion thread) is notified to handle the exception.

[0042] Upon receiving the encrypted data corresponding to the target encryption task unit, the encryption thread writes the encrypted data to the encrypted data buffer recorded in the target encryption task unit and triggers the callback execution component to update the initial write request based on the encrypted data, thus associating the initial write request with the encrypted data. The initial write request is then sent to the data driver component (e.g., SCSI, NVMe driver). The data driver component responds to the updated initial write request, determines the corresponding encrypted data, and writes the encrypted data to the physical storage medium (e.g., physical disk). In specific implementations, the encryption thread can use a completion list and a lightweight notification mechanism to trigger the callback execution component, notifying it to perform subsequent processing. This avoids the CPU overhead of the callback execution component needing to poll to determine whether the encryption thread has received the encrypted data. For example, after acquiring the encrypted data, the encryption thread atomically links the target encryption task unit into the lock-free completion list to trigger the callback execution component (by triggering a soft interrupt or waking up the I / O completion thread). The target encryption task unit, after being processed by the callback execution component, is then removed from the completion list, avoiding list redundancy.

[0043] In traditional related solutions, after the I / O submission thread submits the initial write request, the I / O processing thread encrypts the data. The I / O processing thread needs to wait for the data encryption process to be completed before it can write the encrypted data to the trigger data-driven component. Because the I / O processing thread needs to wait for the data encryption process, it will be blocked, which will seriously affect the data encryption efficiency.

[0044] By constructing encryption task units that associate initial write requests with data to be encrypted, efficient data interaction between I / O processing threads and encryption thread pools is achieved, as well as complete decoupling of encryption tasks and I / O processing threads. This enables asynchronous processing of I / O write requests and data encryption, avoiding blocking situations caused by I / O processing threads waiting for data encryption, thereby improving data encryption efficiency.

[0045] In this embodiment, by determining a target encryption task unit; the target encryption task unit corresponds to the initial write request of the data to be encrypted; the data to be encrypted corresponding to the target encryption task unit is sent to an external encryption device; upon receiving the encrypted data corresponding to the target encryption task unit, the initial write request is updated based on the encrypted data to trigger a preset data-driven component to store the encrypted data, thus achieving complete decoupling between the I / O processing thread and the encryption task, avoiding thread blocking, and improving data encryption efficiency.

[0046] In some implementations of this application, before step 101, the method includes: obtaining an initial write request for a preset storage medium; determining an initial write request corresponding to the data to be encrypted based on preset encryption policy information; and generating an encryption task unit to be processed for the initial write request corresponding to the data to be encrypted.

[0047] In practical applications, the embodiments of this application can be associated with different storage media. In practice, only the data written to a portion of the storage media can be encrypted, while the data written to the other portion of the storage media does not need to be encrypted. Therefore, the IO processing thread can obtain the initial write request for the preset storage media (the specified storage media). For example, an interception layer can be set up to capture write requests for the preset storage media.

[0048] Encryption policy information can be set to determine whether the initial write request meets the encryption policy information. The initial write request is associated with plaintext data. If the initial write request meets the encryption policy information (for example, if the initial write request corresponds to a specified partition, a specified file type, or a specified sensitive data identifier, it is determined that the initial write request meets the encryption policy information), then the plaintext data corresponding to the initial write request is determined to be the data to be encrypted; if the initial write request does not meet the encryption policy information, then writing can be performed directly.

[0049] For each initial write request corresponding to the data to be encrypted, an encryption task unit to be processed is generated so that the encryption task unit to be processed is associated with the data to be encrypted and the initial write request.

[0050] In some implementations of the embodiments of this application, generating an encryption task unit to be processed for an initial write request corresponding to the data to be encrypted includes: extracting idle encryption task units from a preset first object pool; determining first feature information of the initial write request; associating the idle encryption task unit and the first feature information to generate an encryption task unit to be processed.

[0051] To improve the processing efficiency of this application embodiment, an idle encryption task unit (an encryption task unit not associated with the initial write request) can be pre-constructed according to the data structure of the encryption task unit described above to obtain a first object pool. When an initial write request for data encryption is obtained, an idle encryption task unit is extracted from the first object pool to avoid the overhead of dynamically allocating memory at runtime, and the state of the idle encryption task unit is set to TS_INIT (initialization).

[0052] The first characteristic information of the initial write request is determined. The first characteristic information may include a pointer to the initial write request and the data size of the data to be encrypted corresponding to the initial write request.

[0053] A buffer of encrypted data can be pre-allocated according to the size of the data to be encrypted, and this buffer can be recorded in an idle encryption task unit. The pre-allocation mechanism can ensure memory continuity and improve access efficiency.

[0054] Understandably, relevant information needs to be recorded in the idle encryption task unit so that the encryption thread can accurately obtain the data to be encrypted in the target encryption task unit. The first characteristic information also includes the address of the data to be encrypted. The address of the data to be encrypted can be determined based on zero-copy technology, avoiding the CPU overhead of traditional copying. For scenarios that do not support zero-copy, the address of the data to be encrypted can be determined by copying the data to a specified address. Specifically, memcpy (memory copy function) can be used to efficiently copy the data to be encrypted. The copying overhead is much lower than the network encryption latency, and the impact on overall performance is negligible.

[0055] By associating idle encryption task units with the first feature information, a pending encryption task unit is generated. The pending encryption task unit is recorded with the first feature information so that it corresponds to the initial write request. Then, through the subsequent encryption thread, any pending encryption processing unit is determined as the target encryption task unit, realizing the interaction between the I / O processing thread and the encryption thread, and decoupling the write request processing from the encryption processing.

[0056] In some implementations of this application, after updating the write request based on the encrypted data, the method further includes: determining a first reference count value of the target encrypted task unit; when the first reference count value is a preset threshold, resetting the target encrypted task unit to an idle encrypted task unit, and adding the idle encrypted task unit to the first object pool.

[0057] After updating the write request, the first reference count value of the target cryptographic task unit can be determined. When the first reference count value is a preset threshold, it is determined that all references to the target cryptographic task unit have been released. The target cryptographic task unit can be reset to an idle cryptographic task unit and added to the first object pool. This allows the I / O processing thread to associate the idle cryptographic task unit with a new initial write request without having to rebuild a new idle cryptographic task unit, thus achieving resource reuse and avoiding resource waste.

[0058] In this embodiment, a first lock-free circular queue can be pre-constructed. The first lock-free circular queue is implemented using a fixed-size array, supporting cyclic read and write operations. Its core design is as follows: First, the lock-free circular queue capacity is configurable (default support for 1024 / 2048 / 4096 encryption task units, expandable as needed), with pre-allocated memory to avoid runtime overhead from dynamic expansion. Read / write indexes: Atomic operations are used for lock-free read and write operations. The read index records the read position of the encryption thread pool, and the write index records the write position of the I / O processing thread.

[0059] Empty / full check: If the modulo operation of the capacity of the first lock-free circular queue (write index + 1) is equal to the read index, then the first lock-free circular queue is considered full (fully loaded). If the write index and the read index are the same, then the first lock-free circular queue is considered empty (empty). This safe check can be achieved without a lock mechanism.

[0060] In some implementations of this application, the method further includes: determining the current write position of a preset first lock-free circular queue; storing the encryption task unit to be processed to the current write position based on atomic operations when the first lock-free circular queue is not full; and performing queue overflow processing on the encryption task unit to be processed when the first lock-free circular queue is full. The queue overflow processing includes dynamically expanding the first lock-free circular queue or caching the encryption task unit to be processed.

[0061] After obtaining the encryption task unit to be processed, determine the current write position (current write index) of the first lock-free circular queue. If the first lock-free circular queue is determined to be non-full based on the above empty / full check, it means that the encryption task unit to be processed can be stored in the first lock-free circular queue. Therefore, based on atomic operations, the encryption task unit to be processed can be stored in the current write position, and the state of the encryption task unit to be processed can be switched from initialization to TS_QUEUED (enqueued). And memory barriers are used to ensure data visibility.

[0062] If the first lock-free circular queue is determined to be full based on the above empty / full judgment, it means that no more encrypted task units can be stored in the first lock-free circular queue. To avoid the loss of these tasks, queue overflow handling can include dynamically expanding the first lock-free circular queue and storing the overflowed tasks in the expanded queue, or caching the encrypted task units (e.g., placing them in a spare linked list) to prevent the loss of initial write requests and the encrypted task units. For queue overflow handling, log alerts can be used to simultaneously optimize the thread pool or the configuration of the first lock-free circular queue.

[0063] Once the encryption component has finished enqueuing or overflow handling is complete, the driver function immediately returns a positive message to the data application component. The raw I / O thread does not need to wait for encryption to complete and can directly process the next initial write request. From the data application component's perspective, the write operation is completed instantly, greatly reducing perceived latency.

[0064] In some implementations of the embodiments of this application, determining the target encryption task unit includes: determining the current readable position of a preset first lockless circular queue; determining the task status of the encryption task unit to be processed located at the current readable position; and, if the task status is "already enqueued", determining the encryption task unit to be processed located at the current readable position as the target encryption task unit, and updating the task status of the target encryption task unit to "processing".

[0065] If the first unlock-free circular queue is empty, the encryption thread enters a sleep state. The encryption thread is awakened when a new encryption task unit to be processed appears in the first unlock-free circular queue. The encryption thread reads the read index of the queue through atomic operations, calculates the current readable position, and reads the task status of the encryption task unit to be processed at the current readable position. If the task status is "already enqueued," the encryption task unit to be processed at the current readable position is determined as the target encryption task unit, and its task status is updated to "processing." A memory barrier is executed to ensure the visibility of the status update and prevent the target encryption task unit from being processed repeatedly by other encryption threads.

[0066] In some implementations of this application, updating a write request based on encrypted data includes: updating the data vector information in the initial write request based on the encrypted data to obtain a target write request; storing the target write request in a preset write request queue to trigger the data-driven component to read and respond to the target write request in the write request queue.

[0067] The callback component can update the data vector information in the corresponding initial write request for each encrypted data according to the corresponding target encryption task unit, making it point to the encrypted data to obtain the target write request. It also updates the I / O iterator and data size in the target write request to ensure that the data-driven layer can correctly read the encrypted data. The target write request is stored in a preset write request queue, triggering the data-driven component to read and respond to the target write request from the queue, and then writes the encrypted data corresponding to that target write request.

[0068] The following example, using a transparent encryption scenario of a data server, further illustrates the embodiments of this application: Encryption Requirements: Data files stored on disk need to be encrypted to meet compliance requirements. Environment Configuration: The first lock-free circular queue has a capacity of 2048, and the encryption thread pool has a minimum of 4 threads and a maximum of 16 threads, communicating with an external cryptographic service over a network.

[0069] The specific execution process is as follows: Configure the disk partition where data is stored as an encrypted partition, and write data files to the encrypted partition: initiate a write operation and submit a BIO request to the kernel.

[0070] BIO interception and ETU (Encrypt Task Unit) encapsulation: The BIO filter driver intercepts the BIO, obtains an idle encryption task unit from the first object pool, maps the plaintext to the plaintext data buffer of the ETU using zero-copy technology, and initializes the state to TS_INIT.

[0071] Lock-free enqueueing: The driver calculates the write index through atomic operations. Assuming the current write_idx (write index) = 512, the ETU is inserted into the queue at position 512, and write_idx is updated to 513. The enqueue operation takes approximately 10ns, and the I / O processing thread returns immediately to continue processing the next initial write request.

[0072] Encryption thread processing: The encryption thread pool currently runs 8 threads. Due to the queue length of 513, it is under medium load. Thread 3 obtains an ETU through an atomic operation, with its read_idx (read index) = 512, and updates its state to TS_PROCESSING. The plaintext is then sent over the network to a low-load node in the cipher machine cluster. After the cipher machine returns the ciphertext, thread 3 writes the ciphertext into the ETU's ciphertext data buffer, marks its state as TS_COMPLETED, and adds the ETU to the completion list.

[0073] Callback and BIO Submission: After adding an ETU to the linked list, a tasklet soft interrupt is triggered. The callback function traverses the linked list and maps the ciphertext buffer of the ETU to the original BIO. Then, bio_endio is called to submit the BIO to the disk driver, and the disk driver writes the ciphertext to the disk.

[0074] Resource reuse: When the ETU reference count reaches zero, it is returned to the object pool, waiting for the next task allocation.

[0075] Another inventive concept of this application is to decouple the reading request processing of the data to be decrypted from the data decryption processing by associating the reading request, the data to be decrypted, and the decrypted data by decoupling the data reading request processing from the data decryption processing, thereby avoiding thread blocking caused by the need to complete data decryption during the reading request processing and improving the efficiency of reading the data to be decrypted.

[0076] Reference Figure 2 The diagram illustrates a data decryption method provided in an embodiment of this application, which may specifically include the following steps: Step 201: Determine the target decryption task unit. The target decryption task unit corresponds to the initial read request of the data to be decrypted.

[0077] The EncryptTaskUnit is the core data structure that runs through the entire asynchronous data decryption process. Its field design takes into account data integrity, state traceability, and resource reusability.

[0078] As an example, the definition of a decryption task unit can be as follows: structDecryptTaskUnit{ structbio orig_bio; / / Initial read request void ciphertext_buf; / / Buffer of data to be decrypted void plaintext_buf; / / Buffer for decrypted data output enumTaskStatestate; / / TS_INIT, TS_QUEUED, TS_PROCESSING, TS_COMPLETED, TS_FAILED; struct list_headcompleted_node; / / Completed list node atomic_tref_count; / / Reference count unsigned int data_len; / / Data length structcompletion comp; / / Optional: The amount of time required to complete the synchronization waiting scenario (enable as needed) }; The encryption and decryption task units share a unified state machine definition and lifecycle management logic, differing only in the data direction.

[0079] The target decryption task unit is a decryption task unit associated with the data to be decrypted and the initial read request; that is, the target decryption task unit corresponds to the initial read request of the data to be decrypted. After the target decryption task unit is determined, the state of the decryption task unit is switched to "TS_PROCESSING" through an atomic operation to avoid two or more decryption threads used to process the same target decryption task unit repeatedly.

[0080] An initial read request refers to a data read request initiated by a data application component (e.g., a file system, an application), whereby the data to be decrypted is read from the physical disk into the kernel in ciphertext form. As an example, an initial read request can be an initial block I / O read request (BIO). This request can be submitted to the kernel storage stack by the I / O submission thread. The I / O processing thread associates the decryption task unit with the initial read request to obtain the decryption task unit to be processed. The decryption thread then determines and processes the target decryption task unit from the pending decryption task units, and asynchronously processes the data decryption, thus achieving complete decoupling between the decryption task and the I / O processing thread.

[0081] Step 202: Send the data to be decrypted corresponding to the target decryption task unit to the external decryption device.

[0082] After the decryption thread determines the target decryption task unit, it can determine the data to be decrypted corresponding to the target decryption task unit and send the data to be decrypted to the external decryption device through the kernel network stack.

[0083] The external decryption device decrypts the data to be decrypted and returns the decrypted data to the decryption thread, which is the decrypted data corresponding to the target decryption task unit.

[0084] In practical applications, the decryption thread can also send the decryption algorithm identifier and key index to an external decryption device, which can then call the decryption algorithm corresponding to the decryption algorithm identifier and the key corresponding to the key to decrypt the data to be decrypted, thereby generating decrypted data.

[0085] As an example, the external encryption device and the external decryption device are the same device, meaning that the same external device has both data encryption and decryption capabilities. For the decryption thread, a decryption thread pool can be pre-built. The construction method of the decryption thread pool is similar to or the same as that of the encryption thread pool. The construction method of the decryption thread pool can be referred to the data encryption example for explanation, and will not be repeated here.

[0086] Step 203: Upon receiving the decrypted data corresponding to the target decryption task unit, update the initial read request based on the decrypted data to trigger the preset data application component to read the decrypted data.

[0087] While waiting for the cipher machine to return decrypted data, the decryption thread can handle other tasks and can be woken up via an event-driven mechanism. If decryption fails, such as due to the cipher machine going offline or network timeout, the decryption thread marks the target decryption task unit status as TS_FAILED (failed), triggers the retry mechanism, and sets a maximum number of retries. If all retries fail after reaching the maximum number, the error information is recorded in the kernel log, and the callback execution component (e.g., a soft interrupt or a dedicated I / O completion thread) is notified to handle the exception.

[0088] Upon receiving the decrypted data corresponding to the target decryption task unit, the decryption thread reads the decrypted data into the decrypted data buffer recorded in the target decryption task unit. It then triggers the callback execution component to update the initial read request based on the decrypted data, associating the initial read request with the decrypted data. The initial read request is then sent to the data application component, which responds to the updated initial read request to determine and read the corresponding decrypted data. In a specific implementation, the decryption thread can use a completion list and a lightweight notification mechanism to trigger the callback execution component, notifying it to perform subsequent processing. This avoids the CPU overhead of the callback execution component needing to poll to determine whether the decryption thread has received the decrypted data.

[0089] In traditional solutions, after the I / O submission thread submits the initial read request, the I / O processing thread decrypts the data. The I / O processing thread needs to wait for the data decryption process to be completed before it can trigger the data application component to read the decrypted data. Because the I / O processing thread needs to wait for the data decryption process, it may become blocked, which seriously affects the data decryption efficiency.

[0090] This application embodiment determines a target decryption task unit; the target decryption task unit corresponds to the initial read request of the data to be decrypted; the data to be decrypted corresponding to the target decryption task unit is sent to an external decryption device; upon receiving the decrypted data corresponding to the target decryption task unit, the initial read request is updated based on the decrypted data to trigger a preset data application component to read the decrypted data. This achieves complete decoupling of the I / O processing thread and the decryption task, avoids thread blocking, improves data encryption efficiency, and allows decryption calculation and disk read operations to be executed in parallel, significantly improving the random and sequential read performance of the encrypted disk. In some implementations of this application, before determining the target decryption task unit, the method includes: obtaining an initial read request for the encrypted partition; and generating a decryption task unit to be processed based on the initial read request and the data to be decrypted corresponding to the initial read request.

[0091] In practical applications, the embodiments of this application may be associated with different storage media. Some storage media may have encrypted and unencrypted partitions, while others may not have encrypted partitions. Therefore, the IO processing thread can obtain initial write requests for the encrypted partition. For example, an interception layer can be set up to capture read requests for the encrypted partition.

[0092] Based on the initial read request, the target data to be encrypted is determined. According to the data structure of the above decryption task unit, a decryption task unit to be processed is generated for the initial read request and the data to be decrypted corresponding to the initial read request, so that the decryption task unit to be processed is associated with the data to be encrypted and the initial read request.

[0093] In some implementations of the embodiments of this application, generating a decryption task unit to be processed for an initial read request and the data to be decrypted corresponding to the initial read request includes: extracting an idle decryption task unit from a preset second object pool; determining the second feature information of the initial read request; associating the idle decryption task unit and the second feature information to generate a decryption task unit to be processed.

[0094] To improve the processing efficiency of this application embodiment, an idle decryption task unit (a decryption task unit not associated with an initial write request) can be pre-constructed according to the data structure of the decryption task unit described above to obtain a second object pool. When an initial read request that requires data decryption is obtained, an idle decryption task unit is extracted from the second object pool to avoid the overhead of dynamically allocating memory at runtime, and the state of the idle decryption task unit is set to TS_INIT (initialization).

[0095] The second characteristic information of the initial read request is determined. The first characteristic information may include a pointer to the initial read request, the size of the data to be decrypted corresponding to the initial read request, and the address of the data to be decrypted. A decrypted data buffer can be pre-allocated according to the size of the data to be decrypted.

[0096] By associating the idle decryption task unit with the second feature information, a decryption task unit to be processed is generated, so that the decryption task unit to be processed records the pointer of the initial read request, the decrypted data buffer, and the data address to be decrypted is mapped to the data buffer to be decrypted in the decryption task unit based on zero-copy technology.

[0097] The task unit to be decrypted contains second characteristic information, which makes it correspond to the initial first request. The subsequent decryption thread determines any decryption processing unit to be processed as the target decryption task unit, realizing the interaction between the I / O processing thread and the decryption thread, and decoupling the read request processing from the decryption processing.

[0098] In some implementations of this application, after updating the read request based on the decrypted data, the method further includes: determining a second reference count value for the target decryption task unit; when the second reference count value is a preset threshold, resetting the target decryption task unit to an idle decryption task unit, and adding the idle decryption task unit to the second object pool.

[0099] In some implementations of this application, the method further includes: determining the current write position of a preset second lock-free circular queue; storing the decryption task unit to be processed to the current write position based on atomic operations when the second lock-free circular queue is not full; and performing queue overflow processing on the decryption task unit to be processed when the second lock-free circular queue is full. The queue overflow processing includes dynamically expanding the second lock-free circular queue or caching the decryption task unit to be processed.

[0100] The process of the decryption thread inserting the decryption task unit to be processed into the second lock-free circular queue is similar to the process of the encryption thread inserting the encryption task unit to be processed into the first lock-free circular queue. The process of inserting the decryption task unit to be processed can be referred to the process of inserting the encryption task unit to be processed described above, and will not be repeated here.

[0101] As one example, the first lock-free circular queue and the second lock-free circular queue are two different queues. As another example, the first lock-free circular queue and the second lock-free circular queue are the same queue.

[0102] In some implementations of this application, determining the target decryption task unit includes: determining the current readable position of a preset second lockless circular queue; determining the task status of the decryption task unit to be processed located at the current readable position; and, if the task status is "already enqueued", determining the decryption task unit to be processed located at the current readable position as the target decryption task unit, and updating the task status of the target decryption task unit to "processing".

[0103] The process by which the decryption thread determines the target decryption task unit is similar to that by the encryption thread determining the target encryption task unit. The process of determining the target decryption task unit can be referred to the process of determining the target encryption task unit described above, and will not be repeated here.

[0104] In some implementations of this application, updating the read request based on the decrypted data includes: updating the data vector information in the initial read request based on the decrypted data to obtain a target read request; storing the target read request in a preset read request queue to trigger a data application component to read and respond to the target read request in the read request queue.

[0105] The callback component can update the data vector information in the corresponding initial read request for each decrypted data according to the corresponding target decryption task unit, making it point to the decrypted data to obtain the target read request. It also updates the I / O iterator and data size in the target read request to ensure that the data application layer can correctly read the decrypted data. The target read request is stored in a preset read request queue, triggering the data application component to read and respond to the target read request from the queue. The data application component then reads the decrypted data corresponding to that target read request.

[0106] In summary, this application provides an asynchronous pipeline framework based on a lock-free circular queue and a dedicated thread pool, located in the operating system kernel storage stack, to implement the above-mentioned data encryption method embodiments and data decryption method embodiments. It decouples data write requests from data encryption and data read requests from data encryption, respectively, successfully decoupling high-latency encryption / decryption calculations from latency-sensitive disk I / O paths. This fundamentally solves the pain point of performance loss in transparent encryption scenarios, especially in compliant environments where external cryptographic devices must be used, providing a key software architecture guarantee for achieving high-performance transparent data encryption.

[0107] This application's embodiments address the synchronous blocking problem, achieving extremely low I / O latency. The I / O thread returns immediately after lock-free enqueueing in the ETU / DTU (Decrypt Task Unit). The latency only includes memory mapping / copying and atomic enqueueing operations, shielding the encryption latency of external cryptographic services and network latency. The I / O latency perceived by upper-layer data application components is significantly reduced, achieving near real-time response. Simultaneously, the lock-free circular queue and dedicated thread pool avoid the heavyweight scheduling overhead of the kernel workqueue, maintaining low latency even in high-frequency, fine-grained I / O request scenarios.

[0108] This application implements pipelined parallel processing to improve data throughput. Through a pipeline design of task encapsulation and queuing → asynchronous encryption → BIO submission, the three stages of I / O submission, encryption / decryption calculation, and disk write / data read can be processed in parallel and overlapped. System throughput is no longer limited by the latency of a single encryption operation, but depends on the throughput of the slowest stage in the pipeline, typically disk write or cryptographic machine encryption, fully leveraging the performance of high-speed storage media and cryptographic machine clusters. Simultaneously, the ETU state machine and lockless linked list design simplify data flow management, avoid complex state synchronization problems, and ensure the stability of parallel processing.

[0109] This application's embodiments feature refined resource management, improving resource utilization and task stability. For CPU resources: I / O processing threads are no longer idle while waiting for encryption and can continuously process new requests; the encryption thread pool / decryption thread pool is bound to a dedicated CPU core, processing encryption / decryption tasks in parallel, fully utilizing the computing power of multi-core CPUs. For cryptographic device resources: the encryption thread pool / decryption thread pool continuously delivers tasks to the cryptographic machine cluster, using a load balancing mechanism to avoid overloading a single cryptographic machine, improving cryptographic machine utilization and preventing device idleness. For resource isolation: the encryption thread pool provides dedicated, isolated computing resources for encryption tasks, without competing with other system tasks, ensuring the execution priority and stability of encryption tasks; the decryption thread pool provides dedicated, isolated computing resources for decryption tasks, without competing with other system tasks, ensuring the execution priority and stability of decryption tasks, avoiding task blocking or delays caused by resource contention.

[0110] This application's embodiments possess both data consistency and scalability. Data consistency is guaranteed through ETU / DTU reference counting, atomic state switching, and memory barrier design, ensuring data integrity during multi-threaded concurrent access; exception handling mechanisms (retries, error logs) reduce the impact of encryption / decryption failures on business operations. Scalability is strong: the capacity of the lock-free circular queue and the size of the encryption / decryption thread pools can be dynamically configured, supporting scenarios such as cryptographic machine cluster expansion and storage device upgrades; it supports multiple encryption algorithms and cryptographic machine protocols, adapting to different compliance requirements and business scenarios.

[0111] It should be noted that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0112] Reference Figure 3 The diagram illustrates a data encryption device provided in an embodiment of this application, which may specifically include: The target encryption task unit determination module 301 is used to determine the target encryption task unit; the target encryption task unit corresponds to the initial write request of the data to be encrypted. The data to be encrypted sending module 302 is used to send the data to be encrypted corresponding to the target encryption task unit to an external encryption device; The initial write request update module 303 is used to update the initial write request based on the encrypted data when the encrypted data corresponding to the target encryption task unit is received, so as to trigger the preset data-driven component to store the encrypted data.

[0113] In some implementations of the embodiments of this application, the apparatus further includes: The initial write request acquisition module is used to acquire initial write requests for a preset storage medium. The initial write request determination module is used to determine the initial write request corresponding to the data to be encrypted based on the preset encryption policy information. The pending encryption task unit generation module is used to generate pending encryption task units for the initial write request corresponding to the data to be encrypted.

[0114] In some implementations of the embodiments of this application, the module for generating encryption task units to be processed includes: The idle encryption task unit extraction submodule is used to extract idle encryption task units from a preset first object pool; The first feature information determination submodule is used to determine the first feature information of the initial write request; The pending encryption task unit generation submodule is used to associate the idle encryption task unit with the first feature information to generate a pending encryption task unit.

[0115] In some implementations of the embodiments of this application, the apparatus further includes: The first reference count value determination module is used to determine the first reference count value of the target encryption task unit; The idle encryption task unit adding module is used to reset the target encryption task unit to an idle encryption task unit and add the idle encryption task unit to the first object pool when the first reference count value is a preset threshold.

[0116] In some implementations of the embodiments of this application, the device further includes: The first current write position determination module is used to determine the current write position of the preset first lock-free circular queue; The pending encryption task unit storage module is used to store the pending encryption task unit to the current write position based on atomic operations when the first lockless circular queue is not full. The first overflow processing module is used to perform queue overflow processing on the encrypted task unit to be processed when the first lockless circular queue is full; the queue overflow processing includes dynamically expanding the first lockless circular queue or caching the encrypted task unit to be processed.

[0117] In some implementations of the embodiments of this application, the target encryption task unit determination module 301 includes: The first current readable position determination submodule is used to determine the current readable position of the preset first unlocked circular queue; The first task status determination submodule is used to determine the task status of the encrypted task unit to be processed located at the current readable position; The target encryption task unit determination submodule is used to determine the unprocessed encryption task unit located at the current readable position as the target encryption task unit when the task status is queued, and update the task status of the target encryption task unit to be in progress.

[0118] In some implementations of the embodiments of this application, the initial write request update module 303 includes: The target write request update submodule is used to update the data vector information in the initial write request based on the encrypted data to obtain the target write request; The target write request storage submodule is used to store the target write request to a preset write request queue, so as to trigger the data-driven component to read and respond to the target write request in the write request queue.

[0119] This application provides a data encryption device, which can be used to implement the steps in the aforementioned method embodiments.

[0120] Reference Figure 4 The diagram illustrates a data decryption apparatus provided in an embodiment of this application, which may specifically include: The target decryption task unit determination module 401 is used to determine the target decryption task unit; the target decryption task unit corresponds to the initial read request of the data to be decrypted. The data to be decrypted sending module 402 is used to send the data to be decrypted corresponding to the target decryption task unit to the external decryption device; The initial read request update module 403 is used to update the initial read request based on the decrypted data when it receives the decrypted data corresponding to the target decryption task unit, so as to trigger the preset data application component to read the decrypted data.

[0121] In some implementations of the embodiments of this application, the apparatus includes: The initial read request acquisition module is used to acquire the initial read request for the encrypted partition; The module for generating decryption task units to be processed is used to generate decryption task units to be processed for the initial read request and the corresponding data to be decrypted.

[0122] In some implementations of this application, the module for generating the decryption task unit to be processed includes: The idle decryption task unit extraction submodule is used to extract idle decryption task units from a preset second object pool; The second feature information determination submodule is used to determine the second feature information of the initial read request; The pending decryption task unit generation submodule is used to associate the idle decryption task unit with the second feature information to generate a pending decryption task unit.

[0123] In some implementations of the embodiments of this application, the apparatus further includes: The second reference count value determination module is used to determine the second reference count value of the target decryption task unit; The idle decryption task unit adding module is used to reset the target decryption task unit to an idle decryption task unit and add the idle decryption task unit to the second object pool when the second reference count value is a preset threshold.

[0124] In some implementations of the embodiments of this application, the apparatus further includes: The second current write position determination module is used to determine the current write position of the preset second lock-free circular queue; The pending decryption task unit storage module is used to store the pending decryption task unit to the current write position based on atomic operations when the second lockless circular queue is not full. The second overflow processing module is used to perform queue overflow processing on the unprocessed decryption task unit when the second lock-free circular queue is full; the queue overflow processing includes dynamically expanding the second lock-free circular queue or caching the unprocessed decryption task unit.

[0125] In some implementations of the embodiments of this application, the target decryption task unit determination module 401 includes: The second current readable position determination submodule is used to determine the current readable position of the preset second lock-free circular queue; The second task status determination submodule is used to determine the task status of the decryption task unit to be processed located at the current readable position; The target decryption task unit determination submodule is used to determine the unprocessed decryption task unit located at the current readable position as the target decryption task unit when the task status is queued, and update the task status of the target decryption task unit to be in progress.

[0126] In some implementations of the embodiments of this application, the initial read request update module 403 includes: The target read request acquisition submodule is used to update the data vector information in the initial read request based on the decrypted data to obtain the target read request; The target read request storage submodule is used to store the target read request to a preset read request queue, so as to trigger the data application component to read and respond to the target read request in the read request queue.

[0127] This application provides a data decryption device, which can be used to implement the steps in the aforementioned method embodiments.

[0128] As the apparatus embodiments are basically similar to the method embodiments, they are described in a relatively simple manner. For relevant details, please refer to the description in the method embodiment section.

[0129] Reference Figure 5 This application illustrates a data processing system provided in an embodiment of the present application, the system comprising: The target encryption task unit determination module 301 is used to determine the target encryption task unit; the target encryption task unit corresponds to the initial write request of the data to be encrypted; the data to be encrypted sending module 302 is used to send the data to be encrypted corresponding to the target encryption task unit to the external encryption device; the initial write request update module 303 is used to update the initial write request based on the encrypted data when the encrypted data corresponding to the target encryption task unit is received, so as to trigger the preset data driving component to store the encrypted data. The target decryption task unit determination module 401 is used to determine the target decryption task unit; the target decryption task unit corresponds to the initial read request of the data to be decrypted; the data to be decrypted sending module 402 is used to send the data to be decrypted corresponding to the target decryption task unit to the external decryption device; the initial read request update module 403 is used to update the initial read request based on the decrypted data when the decrypted data corresponding to the target decryption task unit is received, so as to trigger the preset data application component to read the decrypted data.

[0130] The data processing system can be a software system or a hardware system, and the data processing system can use the data encryption and data decryption methods described in the foregoing embodiments.

[0131] Reference Figure 6 The diagram illustrates an electronic device according to an embodiment of this application. Figure 6 As shown, the electronic device 600 in this embodiment includes: a processor 610, a memory 620, and a computer program 621 stored in the memory 620 and executable on the processor 610. When the processor 610 executes the computer program 621, it implements the steps in the various method embodiments described above, for example... Figure 1 Steps 101 to 103 as shown, or as... Figure 3 Steps 301 to 302 are shown. Alternatively, when the processor 610 executes the computer program 621, it implements the functions of each module / unit in the above-described device embodiments, for example... Figure 3 The functions of modules 301 to 303 shown, or as follows: Figure 4The functions of modules 401 to 403.

[0132] For example, the computer program 621 may be divided into one or more modules / units, which are stored in the memory 620 and executed by the processor 610 to complete this application. The one or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which may be used to describe the execution process of the computer program 621 in the electronic device 600.

[0133] The electronic device 600 may be the storage device described in the foregoing embodiments. The electronic device 600 may include, but is not limited to, a processor 610 and a memory 620. Those skilled in the art will understand that... Figure 6 This is merely one example of electronic device 600 and does not constitute a limitation on electronic device 600. It may include more or fewer components than shown, or combine certain components, or different components. For example, electronic device 600 may also include input / output devices, network access devices, buses, etc.

[0134] The processor 610 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0135] The memory 620 can be an internal storage unit of the electronic device 600, such as a hard disk or memory of the electronic device 600. The memory 620 can also be an external storage device of the electronic device 600, such as a plug-in hard disk, smart media card (SMC), secure digital card (SD) card, flash card, etc., equipped on the electronic device 600. Furthermore, the memory 620 can include both internal and external storage units of the electronic device 600. The memory 620 is used to store the computer program 621 and other programs and data required by the electronic device 600. The memory 620 can also be used to temporarily store data that has been output or will be output.

[0136] This application also discloses a computer-readable storage medium storing a computer program that, when executed by a processor, implements the data encryption or decryption methods described in the foregoing embodiments.

[0137] This application also discloses a computer program product, including a computer program, which, when run, causes the data encryption method or data decryption method described in the foregoing embodiments to be executed.

[0138] The embodiments described above are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A data encryption method, characterized in that, include: Identify the target encryption task unit; The target encryption task unit corresponds to the initial write request of the data to be encrypted; The data to be encrypted corresponding to the target encryption task unit is sent to an external encryption device; Upon receiving the encrypted data corresponding to the target encryption task unit, the initial write request is updated based on the encrypted data to trigger a preset data-driven component to store the encrypted data.

2. The method according to claim 1, characterized in that, Before determining the target encryption task unit, the method includes: Obtain the initial write request for the preset storage medium; Based on the preset encryption policy information, determine the initial write request corresponding to the data to be encrypted; For each initial write request corresponding to the data to be encrypted, an encryption task unit to be processed is generated.

3. The method according to claim 2, characterized in that, The step of generating a processing encryption task unit for the initial write request corresponding to the data to be encrypted includes: Extract idle encryption task units from the preset first object pool; Determine the first characteristic information of the initial write request; By associating the idle encryption task unit with the first feature information, an encryption task unit to be processed is generated.

4. The method according to claim 2, characterized in that, After updating the write request based on the encrypted data, the method further includes: Determine the first reference count value of the target encryption task unit; When the first reference count value is a preset threshold, the target encryption task unit is reset to an idle encryption task unit, and the idle encryption task unit is added to the first object pool.

5. The method according to claim 3, characterized in that, The method further includes: Determine the current write position of the preset first lock-free circular queue; When the first lockless circular queue is not full, the encryption task unit to be processed is stored in the current write position based on atomic operation; When the first lockless circular queue is full, queue overflow processing is performed on the encrypted task unit to be processed; the queue overflow processing includes dynamically expanding the first lockless circular queue or caching the encrypted task unit to be processed.

6. The method according to any one of claims 1-4, characterized in that, The target encryption task unit includes: Determine the current readable position of the preset first unlock-free circular queue; Determine the task status of the unprocessed encryption task unit located at the current readable position; If the task status is "queued", the unprocessed encryption task unit located at the current readable position is determined as the target encryption task unit, and the task status of the target encryption task unit is updated to "processing".

7. The method according to any one of claims 1-4, characterized in that, Updating the write request based on the encrypted data includes: The target write request is obtained by updating the data vector information in the initial write request based on the encrypted data. The target write request is stored in a preset write request queue to trigger the data-driven component to read from the write request queue and respond to the target write request.

8. A data decryption method, characterized in that, include: Identify the target decryption task unit; The target decryption task unit corresponds to the initial read request of the data to be decrypted; The data to be decrypted corresponding to the target decryption task unit is sent to the external decryption device; Upon receiving the decrypted data corresponding to the target decryption task unit, the initial read request is updated based on the decrypted data to trigger a preset data application component to read the decrypted data.

9. An electronic device, characterized in that, The device includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the electronic device performs the method as described in any one of claims 1-8.

10. A computer program product, characterized in that, Includes a computer program, which, when run, causes the method as described in any one of claims 1-8 to be performed.

Images