Data page encryption and decryption method and device based on quantum cryptographic card and storage medium

Abstract

The application discloses a data page encryption and decryption method and device based on a quantum password card and a storage medium, the method comprising: in response to a file system triggered write data page request, extracting a plaintext data page to be written, generating a quantum key corresponding to the plaintext data page, and generating an encryption parameter based on the quantum key and a page identifier of the plaintext data page; inputting the plaintext data page and the encryption parameter into the quantum password card, performing an encryption operation on the plaintext data page through the quantum password card, and outputting a ciphertext data page; after the encryption parameter is stored in association with the ciphertext data page, the ciphertext data page is stored in a block device through disk brushing of a file system; in response to a file system triggered read data page request, reading the ciphertext data page from the block device, and extracting the encryption parameter stored in association with the ciphertext data page; inputting the ciphertext data page and the encryption parameter into the quantum password card, performing a decryption operation on the ciphertext data page through the quantum password card, and outputting a restored plaintext data page. The application can improve the anti-quantum attack capability of server storage data encryption.

Description

Technical Field

[0001] This application relates to the field of data storage and security, and in particular to a data page encryption and decryption method, apparatus and storage medium based on a quantum cryptographic card. Background Technology

[0002] Quantum cryptographic cards, as hardware encryption devices integrating quantum physics characteristics, can generate quantum keys with true randomness and resistance to quantum computing attacks based on quantum random number generators or quantum key distribution protocols. They also possess hardware-level encryption / decryption operations and integrity verification functions, and are increasingly being applied to key management and data encryption in high-security scenarios. The effectiveness of server data storage encryption largely depends on the security of the encryption key, the fineness of the encryption granularity, and the reliability of data integrity verification.

[0003] In related technologies, traditional server data encryption schemes mainly include two categories: software encryption and hardware encryption cards based on traditional cryptographic algorithms. Both methods achieve data encryption by generating a key based on a mathematical problem, using this key to encrypt the data, storing it, and then performing the inverse operation using the corresponding key to restore the data during decryption. These methods have the following problems: First, because the key is generated based on a mathematical algorithm, it lacks resistance to quantum attacks. With the development of quantum computing technology, existing encryption systems face fundamental security threats. Second, the transmission and storage of keys lack quantum-level security protection. Software encryption, which stores keys in memory, is vulnerable to attacks, and hardware encryption cards, which rely on traditional network protocols for key distribution, are at risk of interception. Third, the encryption granularity is typically at the file, directory, or process level. This coarse granularity and key reuse make it impossible to achieve fine-grained protection for data pages. Once a key is leaked, a batch of data will be exposed. Furthermore, the encrypted data lacks an integrity verification mechanism based on quantum cryptography characteristics, making it difficult to accurately identify data tampering or corruption.

[0004] Therefore, improving the ability of server-stored data encryption to resist quantum attacks is a technical problem that urgently needs to be solved. Summary of the Invention

[0005] The main objective of this application is to provide a data page encryption and decryption method, device, and storage medium based on a quantum cryptographic card, so as to improve the resistance of server-stored data encryption to quantum attacks.

[0006] To achieve the above objectives, this application provides a data page encryption / decryption method based on a quantum cryptographic card, comprising: In response to a write data page request triggered by the file system, the plaintext data page to be written is extracted, and the quantum cryptographic card is called through the quantum cryptographic card driver interface to generate a quantum key corresponding to the plaintext data page. Encryption parameters are generated based on the quantum key and the page identifier of the plaintext data page, wherein the quantum keys corresponding to different data pages are different from each other. The plaintext data page and the encryption parameters are input into the quantum cryptographic card, and the quantum cryptographic card performs encryption operations on the plaintext data page to output the ciphertext data page. After the encryption parameters are associated with the ciphertext data page and stored, they are flushed to the block device via the file system. In response to a read data page request triggered by the file system, the encrypted data page is read from the block device, and the encryption parameters associated with the encrypted data page are extracted; The ciphertext data page and the encryption parameters are input into the quantum cryptographic card, and the quantum cryptographic card performs a decryption operation on the ciphertext data page to output the restored plaintext data page.

[0007] Optionally, generating encryption parameters based on the quantum key and the page identifier of the plaintext data page includes: Extract the page identifier of the plaintext data page; The page identifier and the quantum key are concatenated and then hashed to generate an initialization vector that uniquely corresponds to the plaintext data page. The initialization vector, the key identifier of the quantum key, and the preset encryption algorithm type are combined to form the encryption parameters. The data structure of the encryption parameters is arranged in a fixed format according to the key identifier, the preset encryption algorithm type, and the initialization vector. During decryption, the required decryption parameters can be obtained by parsing the data structure of the encryption parameters.

[0008] Optionally, the step of calling the quantum cryptographic card through the quantum cryptographic card driver interface to generate the quantum key corresponding to the plaintext data page includes: The quantum key generation interface in the quantum cryptographic card driver interface is invoked to pass the page identifier of the plaintext data page to the quantum cryptographic card driver interface; Send a key generation instruction carrying the page identifier to the quantum cryptographic card through the quantum key generation interface; The quantum key generated by the quantum cryptographic card according to the page identifier and a quantum random number generator or a quantum key distribution protocol is received, wherein the quantum keys generated corresponding to different page identifiers are different from each other.

[0009] Optionally, the step of associating and storing the encryption parameters with the ciphertext data page includes: Write the encryption parameters into the header area of ​​the ciphertext data page; Write the contents of the encrypted data page into the main area; The encrypted data pages are reorganized according to a preset format.

[0010] Optionally, before inputting the ciphertext data page and the encryption parameters into the quantum cryptographic card, performing a decryption operation on the ciphertext data page through the quantum cryptographic card, and outputting the restored plaintext data page, the method further includes: The HMAC algorithm interface of the quantum cryptographic card is invoked to perform HMAC operation on the plaintext data page based on the quantum key, generating a first HMAC value; Write the first HMAC value into the header area of ​​the ciphertext data page; After inputting the ciphertext data page and the encryption parameters into the quantum cryptographic card, performing a decryption operation on the ciphertext data page through the quantum cryptographic card, and outputting the restored plaintext data page, the method further includes: The HMAC algorithm interface of the quantum cryptographic card is invoked to perform HMAC operation on the restored plaintext data page based on the quantum key, thereby generating a second HMAC value; The first HMAC value is compared with the second HMAC value, and the integrity status of the encrypted data page is determined based on the comparison result.

[0011] Optionally, determining the integrity status of the encrypted data page based on the comparison result includes: If the first HMAC value is consistent with the second HMAC value, the encrypted data page is determined to be complete, and the restored plaintext data page is allowed to be returned to the upper layer application via the file system; If the first HMAC value is inconsistent with the second HMAC value, the encrypted data page is determined to be abnormal, the encrypted data page is marked as abnormal, the abnormal state is reported to the error handling module of the file system, and the repair process is triggered. In response to the repair process, the error handling module reads the corresponding plaintext data page backup from the backup storage, and calls the encryption module to re-encrypt the plaintext data page backup using a quantum cryptographic card to generate a replacement ciphertext data page; The file system's write interface is invoked to write the replacement ciphertext data page to the block device to replace the ciphertext data page in the abnormal state.

[0012] Optionally, before performing the decryption operation on the ciphertext data page via the quantum cryptographic card, the method further includes: Extract the key identifier of the quantum key from the encryption parameters; The local key cache of the quantum cryptographic card is queried based on the key identifier; If the quantum key is found in the local key cache, then the quantum key is retrieved from the local key cache; If the quantum key is not found in the local key cache, the quantum key is retrieved from the quantum cryptographic card through the quantum key generation interface in the quantum cryptographic card driver interface.

[0013] Furthermore, to achieve the above objectives, this application also provides a data page encryption / decryption device based on a quantum cryptographic card, comprising: The generation module is used to respond to a write data page request triggered by the file system, extract the plaintext data page to be written, call the quantum cryptographic card through the quantum cryptographic card driver interface to generate a quantum key corresponding to the plaintext data page, wherein the quantum keys corresponding to different data pages are different from each other, and generate encryption parameters based on the quantum key and the page identifier of the plaintext data page; The first output module is used to input the plaintext data page and the encryption parameters into the quantum cryptographic card, perform encryption operations on the plaintext data page through the quantum cryptographic card, and output the ciphertext data page. The storage module is used to associate the encryption parameters with the ciphertext data page and store them, and then flush the file system to the block device. The extraction module is configured to, in response to a read data page request triggered by the file system, read the ciphertext data page from the block device and extract the encryption parameters stored in association with the ciphertext data page; The second output module is used to input the ciphertext data page and the encryption parameters into the quantum cryptographic card, perform decryption operations on the ciphertext data page through the quantum cryptographic card, and output the restored plaintext data page.

[0014] This application also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the data page encryption and decryption method based on the quantum cryptographic card as described above.

[0015] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data page encryption and decryption method based on the quantum cryptographic card as described above.

[0016] This application proposes a data page encryption / decryption method, apparatus, and storage medium based on a quantum cryptographic card. By generating unique quantum keys for each data page independently using the quantum cryptographic card, it achieves fine-grained encryption with one key per page. This ensures that a single key leak only affects the corresponding data page, avoiding the risk of mass data exposure. Simultaneously, the quantum keys are generated based on quantum physics principles, possessing true randomness and resistance to quantum computing attacks, effectively resisting the threat of quantum computing to crack traditional encryption systems. Furthermore, the encryption and decryption operations are performed by the quantum cryptographic card hardware, without consuming CPU computing power and having no significant impact on server performance. The encryption parameters are stored in association with the ciphertext data page and written to the block device along with the data page, enabling accurate decryption based on the encryption parameters extracted from the data page header. The entire encryption / decryption process is transparent to upper-layer applications, achieving data security protection without modification. Therefore, this application can ensure server data security while maintaining encryption / decryption efficiency, solving the technical problems of insufficient resistance to quantum attacks and excessively coarse encryption granularity in server data encryption. Attached Figure Description

[0017] Figure 1 This is one of the flowcharts for a data page encryption / decryption method based on a quantum cryptographic card, as described in this application.

[0018] Figure 2 This is a second flowchart of a data page encryption / decryption method based on a quantum cryptographic card, according to an embodiment of this application.

[0019] Figure 3 This is the third flowchart of a data page encryption / decryption method based on a quantum cryptographic card, according to an embodiment of this application.

[0020] Figure 4 This is the fourth flowchart of a data page encryption / decryption method based on a quantum cryptographic card, as described in this application.

[0021] Figure 5 This is the fifth flowchart of a data page encryption / decryption method based on a quantum cryptographic card, as described in this application.

[0022] Figure 6 This is flowchart six of a data page encryption / decryption method based on a quantum cryptographic card, which is an embodiment of this application.

[0023] Figure 7 This is flowchart number seven of a data page encryption / decryption method based on a quantum cryptographic card, which is an embodiment of this application.

[0024] Figure 8 This is a schematic diagram of a data page encryption / decryption device based on a quantum cryptographic card, according to an embodiment of this application.

[0025] Figure 9A schematic diagram of the physical structure of an electronic device is provided.

[0026] In the diagram: 810, generation module; 820, first output module; 830, storage module; 840, extraction module; 850, second output module; 901, processor; 902, memory; 9021, computer program.

[0027] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0029] Quantum cryptographic cards, as hardware encryption devices integrating quantum physics characteristics, can generate quantum keys with true randomness and resistance to quantum computing attacks based on quantum random number generators or quantum key distribution protocols. They also possess hardware-level encryption / decryption operations and integrity verification functions, and are increasingly being applied to key management and data encryption in high-security scenarios. The effectiveness of server data storage encryption largely depends on the security of the encryption key and the fineness of the encryption granularity.

[0030] Traditional server data encryption schemes mainly include two categories: software encryption and hardware encryption cards based on traditional cryptographic algorithms. The encryption method involves generating a key based on a mathematical problem, using this key to encrypt the data before storage, and then using the corresponding key to perform the inverse operation to restore the data during decryption. These schemes have the following drawbacks: First, the key is generated based on a mathematical algorithm and lacks resistance to quantum attacks, posing a fundamental security threat with the development of quantum computing technology. Second, the encryption granularity is typically at the file, directory, or process level, which is too coarse and involves key reuse; once the key is leaked, a batch of data will be exposed.

[0031] Based on this, embodiments of this application provide a data page encryption / decryption method, apparatus, electronic device, and storage medium based on a quantum cryptographic card. By generating unique quantum keys independently for each data page using the quantum cryptographic card, fine-grained encryption with one key per page is achieved, ensuring that a leak of a single key only affects the corresponding data page. Simultaneously, encryption and decryption operations are performed by the quantum cryptographic card hardware, without consuming CPU (Central Processing Unit) computing power. Encryption parameters are stored in association with the ciphertext data page, and decryption is accurately performed based on the encryption parameters extracted from the data page header. The entire encryption / decryption process is transparent to upper-layer applications. This achieves the technical effect of improving the security of server data storage and solves the technical problems of insufficient resistance to quantum attacks and coarse encryption granularity leading to easy exposure of batch data after key leakage.

[0032] Figure 1 This is one of the flowcharts of a data page encryption / decryption method based on a quantum cryptographic card, according to an embodiment of this application. This quantum cryptographic card-based data page encryption / decryption method can be executed by a processor of an electronic device, such as... Figure 1 As shown, the data page encryption / decryption method based on a quantum cryptographic card may include the following steps: Step 110: In response to a write data page request triggered by the file system, extract the plaintext data page to be written, call the quantum cryptographic card through the quantum cryptographic card driver interface to generate a quantum key corresponding to the plaintext data page, and generate encryption parameters based on the quantum key and the page identifier of the plaintext data page, wherein the quantum keys corresponding to different data pages are different from each other.

[0033] In this implementation, when the file system triggers a write data page request, the plaintext data page to be written is extracted, and the quantum cryptography card is called through the quantum cryptography card driver interface to generate a quantum key corresponding to the data page. The quantum keys for different data pages are distinct. Then, encryption parameters are generated based on the generated quantum key and the page identifier of the plaintext data page. For example, the write data page request carries the data content and metadata of the plaintext data page. By parsing the request, the page identifier can be extracted from the data page header. Simultaneously, a key generation command is sent to the quantum cryptography card through the quantum key generation interface in the quantum cryptography card driver interface. The quantum key and its corresponding key identifier are received from the quantum cryptography card. The page identifier and the quantum key are then concatenated and a hash operation is performed to generate an initialization vector. Finally, the initialization vector, the key identifier of the quantum key, and the preset encryption algorithm type are combined to form the encryption parameters.

[0034] Optionally, by generating unique quantum keys independently for each data page, fine-grained encryption with one key per page can be achieved, ensuring that the leakage of a key for a single data page does not affect the security of other data pages. By generating encryption parameters uniquely corresponding to each data page based on its identifier, the encryption parameters are bound to the identity of the data page, further guaranteeing the implementation of one key per page. Generating quantum keys using a quantum cryptographic card endows the keys with true randomness and resistance to quantum computing attacks, fundamentally improving the security of data encryption.

[0035] Step S120: Input the plaintext data page and encryption parameters into the quantum cryptographic card, perform encryption operation on the plaintext data page through the quantum cryptographic card, and output the ciphertext data page.

[0036] In this implementation, after generating the encryption parameters in step S110, the plaintext data page and the encryption parameters are input together into the quantum cryptographic card. The quantum cryptographic card performs encryption operations on the plaintext data page and outputs the encrypted ciphertext data page. For example, the encryption algorithm type and initialization vector are extracted from the encryption parameters, and an encryption operation request message containing the plaintext data page, quantum key, encryption algorithm type, and initialization vector is constructed. The encryption / decryption algorithm interface in the quantum cryptographic card driver interface is called to send the request message to the quantum cryptographic card. The quantum cryptographic card uses its hardware acceleration capabilities to perform encryption operations (such as SM4-CBC mode or AES-GCM mode), and finally, the ciphertext data page returned by the quantum cryptographic card is received.

[0037] Optionally, encryption operations can be performed using the hardware acceleration capabilities of the quantum cryptographic card. Encryption and decryption operations do not consume CPU computing power and have no significant impact on server performance, thus meeting the performance requirements for concurrent encryption of large-scale data pages in server scenarios. By inputting the plaintext data page and encryption parameters into the quantum cryptographic card, encryption operations can be performed based on the unique quantum key and initialization vector specific to that data page, ensuring the uniqueness and security of the encryption result.

[0038] Step S130: After associating the encryption parameters with the ciphertext data page and storing them, the data is flushed to the block device via the file system.

[0039] In this implementation, after the encrypted data page is output in step S120, the encryption parameters are associated with and stored in the encrypted data page, and then flushed to the block device via the file system. For example, the encryption parameters are written to the header area of ​​the encrypted data page, the content of the encrypted data page is written to the body area, the encrypted data page is reassembled according to a preset format (header + body), and then the reassembled encrypted data page is flushed to the disk via the file system's write interface for persistent storage to the underlying block device (such as an SSD, HDD, or SAN storage array).

[0040] Optionally, by associating encryption parameters with ciphertext data pages (e.g., writing encryption parameters to the header of data pages), decryption only requires reading that data page to obtain complete decryption parameter information, eliminating the need for an external parameter management system and reducing the system's parameter management complexity and key lookup overhead. Furthermore, by flushing the reconstructed ciphertext data pages to disk via the file system and storing them on a block device, the encryption storage process becomes transparent to upper-layer applications, enabling data security protection without modifying the upper-layer applications.

[0041] In step S140, in response to a read data page request triggered by the file system, a ciphertext data page is read from the block device, and the encryption parameters associated with the ciphertext data page are extracted.

[0042] In this implementation, when the file system triggers a read data page request, it reads the ciphertext data page from the block device and then extracts the associated encrypted parameters from that data page. For example, after the file system initiates a read data page request, it reads the complete ciphertext data page from the block device, parses the header area of ​​the data page, extracts the encrypted parameter structure from the header area according to a preset format, and obtains information such as the quantum key identifier, initialization vector, and encryption algorithm type from it.

[0043] Optionally, since the encryption parameters are stored in the same data page as the ciphertext data page, the complete decryption parameters can be obtained at the same time as reading the ciphertext data page, without the need for additional parameter query steps, which simplifies the decryption process and improves data reading efficiency.

[0044] Step S150: Input the ciphertext data page and encryption parameters into the quantum cryptographic card, perform decryption operation on the ciphertext data page through the quantum cryptographic card, and output the restored plaintext data page.

[0045] In this implementation, after extracting the encryption parameters in step S140, the ciphertext data page and the encryption parameters are input together into the quantum cryptographic card. The quantum cryptographic card performs a decryption operation on the ciphertext data page and outputs the restored plaintext data page. For example, the encryption algorithm type, quantum key identifier, and initialization vector are extracted from the encryption parameters. The corresponding quantum key is obtained based on the key identifier. A decryption operation request message containing the ciphertext data page, quantum key, encryption algorithm type, and initialization vector is constructed. The encryption / decryption algorithm interface in the quantum cryptographic card driver interface is called to send the request message to the quantum cryptographic card. The quantum cryptographic card performs the decryption operation. Finally, the restored plaintext data page returned by the quantum cryptographic card is received and returned to the upper-layer application via the file system.

[0046] Optionally, the decryption operation is performed using the hardware acceleration capability of the quantum cryptographic card, ensuring decryption efficiency and preventing it from becoming a performance bottleneck in the data reading process. Decryption is performed by obtaining the corresponding quantum key from the key identifier recorded in the encryption parameters, ensuring that only data pages with the correct quantum key can be successfully decrypted, thus guaranteeing data confidentiality.

[0047] In this embodiment, a unique quantum key is independently generated for each data page using a quantum cryptographic card, achieving fine-grained encryption with one key per page. This ensures that a single key leak only affects the corresponding data page, avoiding the risk of mass data exposure. Simultaneously, the quantum key is generated based on quantum physics principles, possessing true randomness and resistance to quantum computing attacks, effectively defending against the threat of quantum computing breaking traditional encryption systems. Furthermore, encryption and decryption operations are performed by the quantum cryptographic card hardware, without consuming CPU computing power and having no significant impact on server performance. The encryption parameters are stored in association with the ciphertext data page and written to the block device along with the data page, enabling accurate decryption based on the encryption parameters extracted from the data page header. The entire encryption and decryption process is transparent to upper-layer applications, achieving data security protection without requiring modifications to the upper-layer applications. Therefore, this application can ensure server data security while maintaining encryption and decryption efficiency, solving the technical problems of insufficient resistance to quantum attacks and excessively coarse encryption granularity in server data encryption.

[0048] The steps described above will be explained in detail below.

[0049] Figure 2 This is a second flowchart of a data page encryption / decryption method based on a quantum cryptographic card, according to an embodiment of this application. Figure 2 As shown, step 110, which generates encryption parameters based on the quantum key and the page identifier of the plaintext data page, may include the following steps: Step 1111: Extract the page identifier of the plaintext data page.

[0050] Step 1112: Concatenate the page identifier with the quantum key and perform a hash operation to generate an initialization vector that uniquely corresponds to the plaintext data page.

[0051] Step 1113: Combine the initialization vector, the key identifier of the quantum key, and the preset encryption algorithm type into encryption parameters. The data structure of the encryption parameters is arranged in a fixed format of key identifier, preset encryption algorithm type, and initialization vector. During decryption, the required decryption parameters can be obtained by parsing the data structure of the encryption parameters.

[0052] In this embodiment, when the page identifier of the plaintext data page is extracted, it means that the unique identity information used to distinguish different data pages has been obtained. Based on this, the page identifier and the quantum key can be concatenated and a hash operation can be performed to generate an initialization vector that uniquely corresponds to the data page. Then, the initialization vector, the key identifier of the quantum key, and the preset encryption algorithm type are combined into encryption parameters.

[0053] Optionally, when the page identifier is extracted, since the page identifier is globally unique within the tablespace or file system, it can be used in a hash operation together with the quantum key. This ensures that different data pages will generate different initialization vectors even if they use the same quantum key, thus achieving a one-to-one binding between the initialization vector and the data page. For example, the page identifier can be a combination of the page offset of the data page in the database storage engine and the tablespace ID, or it can be a combination of the file inode number of the cached page in the file system and the page offset, as long as it can uniquely identify the data page.

[0054] Optionally, the page identifier and the quantum key are concatenated and then a hash operation is performed. The hash operation can use any secure hash algorithm, such as SHA-256 (Secure Hash Algorithm 256), SM3, etc. The uniform distribution of the hash value ensures that the initialization vector has good randomness in terms of the bit length required by the encryption algorithm, and the one-way nature of the hash operation ensures that the quantum key cannot be deduced from the initialization vector. For example, the hash value generated by the SHA-256 algorithm is 256 bits. When the encryption algorithm is SM4-CBC (Cipher Block Chaining), the first 128 bits are used as the initialization vector. When the encryption algorithm is AES-GCM (Advanced Encryption Standard-Galois / Counter Mode), the entire 256 bits can be used as the initialization vector.

[0055] Optionally, the initialization vector, the key identifier of the quantum key, and the preset encryption algorithm type are combined into encryption parameters. This ensures that the encryption parameters contain all the necessary decryption information, are associated with the quantum key through the key identifier, and are configurable through the encryption algorithm type. For example, the data structure of the encryption parameters can be arranged in a fixed format of key identifier, encryption algorithm type, and initialization vector. During decryption, parsing this structure yields all the necessary decryption parameters.

[0056] Optionally, an initialization vector is generated jointly based on the page identifier and the quantum key, so that the encryption parameters of each data page are bound to its identity, ensuring the implementation of one key per page from the root and avoiding security risks caused by the reuse or predictability of the initialization vector.

[0057] Figure 3 This is the third flowchart of a data page encryption / decryption method based on a quantum cryptographic card, according to an embodiment of this application. Figure 3 As shown, step 110, which involves using the quantum cryptographic card driver interface to generate the quantum key corresponding to the plaintext data page, may include the following steps: Step 1121: Call the quantum key generation interface in the quantum cryptographic card driver interface to pass the page identifier of the plaintext data page to the quantum cryptographic card driver interface.

[0058] Step 1122: Send a key generation command carrying a page identifier to the quantum cryptographic card through the quantum key generation interface.

[0059] Step 1123: Receive the quantum key generated by the quantum cryptographic card based on the page identifier and the quantum random number generator or quantum key distribution protocol, wherein the quantum keys generated corresponding to different page identifiers are different from each other.

[0060] In this embodiment, when it is necessary to generate a quantum key for a plaintext data page, the quantum key generation interface in the quantum cryptographic card driver interface is first called and the page identifier is passed to it. Then, a key generation instruction carrying the page identifier is sent to the quantum cryptographic card through the interface. Finally, the quantum key generated by the quantum cryptographic card according to the page identifier and the quantum random number generator or quantum key distribution protocol is received.

[0061] Optionally, by calling the quantum key generation interface in the quantum cryptographic card driver interface and passing it the page identifier of the plaintext data page, a communication channel can be established with the quantum cryptographic card, informing the quantum cryptographic card of the identity of the data page for which a key needs to be generated. As a component of the driver interface module, the quantum key generation interface provides a standardized key acquisition method to the encryption parameter generation module above, and communicates with the quantum cryptographic card below, responsible for converting key generation requests into an instruction format recognizable by the quantum cryptographic card.

[0062] Optionally, sending a key generation command to the quantum cryptographic card can trigger the key generation process and cause the quantum cryptographic card to bind the page identifier to the key during key generation. The key generation command can carry additional information such as key length parameters (e.g., 256 bits) and key purpose identifiers, so that the quantum cryptographic card can generate a quantum key that meets the requirements according to preset parameters.

[0063] Optionally, the quantum cryptographic card receives a quantum key generated by a page identifier and a quantum random number generator or a quantum key distribution protocol. The quantum random number generator utilizes the inherent randomness of quantum physical processes (such as vacuum fluctuations and photon polarization states) to generate truly random numbers. The generated quantum key possesses true randomness and unpredictability, fundamentally different from pseudo-random numbers based on mathematical algorithms. The quantum key distribution protocol achieves secure key sharing between communicating parties through quantum state transmission. When generating a quantum key, the quantum cryptographic card establishes a one-to-one correspondence between the generated quantum key and the page identifier carried in the key generation instruction. Specifically, a mapping table between key identifiers and page identifiers can be maintained internally within the quantum cryptographic card, or this mapping relationship can be recorded in the driver interface module. Quantum keys generated using either of these methods possess resistance to quantum computing attacks, effectively resisting the threat of quantum computing breaking traditional encryption systems.

[0064] Optionally, the quantum keys generated for different page identifiers are all different. Since the quantum cryptographic card generates corresponding quantum keys based on the page identifiers, different page identifiers will trigger the quantum cryptographic card to generate different quantum keys. Furthermore, the quantum keys generated based on the quantum random number generator or quantum key distribution protocol possess true randomness and uniqueness, fundamentally guaranteeing the implementation of one-page-one-key. The received quantum key and its corresponding key identifier will be passed to the encryption parameter generation module for subsequent encryption parameter combinations.

[0065] Figure 4 This is the fourth flowchart of a data page encryption / decryption method based on a quantum cryptographic card, according to an embodiment of this application. Figure 4 As shown, step 130, which associates and stores the encryption parameters with the ciphertext data page, may include the following steps: Step 131: Write the encryption parameters into the header area of ​​the ciphertext data page; Step 132: Write the contents of the encrypted data page into the main area; Step 133: Reassemble the encrypted data pages according to the preset format.

[0066] In this embodiment, after the quantum cryptographic card completes the encryption operation and outputs the ciphertext data page, the encryption parameters are first written into the header area of ​​the ciphertext data page, then the content of the ciphertext data page is written into the body area, and finally the ciphertext data page is reassembled according to a preset format.

[0067] Optionally, the encryption parameters are written into the header area of ​​the ciphertext data page, thus establishing a physical binding relationship between the encryption parameters and the ciphertext data page. The header area is located at the beginning of the data page and has a fixed length and a parsable structure, facilitating quick location and retrieval during decryption. For example, the size of the header area can be pre-allocated based on the actual length of the encryption parameters, such as allocating 256 bytes to store the encryption parameter structure, which includes a key identifier field, an encryption algorithm type field, an initialization vector field, etc.

[0068] Optionally, the content of the encrypted data page is written into the body area, which is the remaining space in the data page excluding the header area, and is used to store the encrypted data content after encryption by the quantum cryptographic card. The header area and the body area together constitute a complete data page, which logically maintains the same page size as the original data page.

[0069] Optionally, the encrypted data pages can be reassembled according to a preset format, ensuring a unified format for accurate parsing and decryption during disk reading. The preset format refers to a pre-agreed data page organization structure. For example, it can be organized according to the format of "header length (2 bytes), header content (encryption parameters), body content (encrypted data)," where the header length field indicates the actual length of the header area, enabling correct separation of the header and body during parsing. Alternatively, a fixed header size format can be used, where the header area length is fixed (e.g., 256 bytes), followed by the body area; during parsing, the first 256 bytes are directly read as the header. A unified reassembly format ensures data consistency during disk writing and reading, avoiding parsing errors caused by format mismatches.

[0070] Figure 5 This is the fifth flowchart of a data page encryption / decryption method based on a quantum cryptographic card, according to an embodiment of this application. Figure 5 As shown, based on the feasible implementation of S150 described above, this application further provides an implementation method for integrity verification: Before inputting the ciphertext data page and encryption parameters into the quantum cryptographic card, performing decryption operations on the ciphertext data page through the quantum cryptographic card, and outputting the restored plaintext data page, the method may further include: Step 511: Call the HMAC (Hash-based Message Authentication Code) algorithm interface of the quantum cryptographic card, perform HMAC operation on the plaintext data page based on the quantum key, and generate the first HMAC value; Step 512: Write the first HMAC value into the header area of ​​the ciphertext data page; After inputting the ciphertext data page and encryption parameters into the quantum cryptographic card, performing decryption operations on the ciphertext data page through the quantum cryptographic card, and outputting the restored plaintext data page, the method further includes: Step 513: Call the HMAC algorithm interface of the quantum cryptographic card, perform HMAC operation based on the plaintext data page restored by the quantum key pair, and generate the second HMAC value; Step 514: Compare the first HMAC value with the second HMAC value, and determine the integrity status of the encrypted data page based on the comparison result.

[0071] In this embodiment, during the encryption phase, the HMAC algorithm interface of the quantum cryptographic card is first invoked to perform an HMAC operation on the plaintext data page based on the quantum key to generate a first HMAC value, and then the first HMAC value is written into the header area of ​​the ciphertext data page. During the decryption phase, the HMAC algorithm interface of the quantum cryptographic card is first invoked to perform an HMAC operation on the restored plaintext data page based on the quantum key to generate a second HMAC value, and then the first HMAC value and the second HMAC value are compared to determine the integrity status of the ciphertext data page based on the comparison result.

[0072] Optionally, HMAC operations can be performed by calling the HMAC algorithm interface of the quantum cryptographic card. The authentication key used in the HMAC operation is the quantum key corresponding to the data page. The HMAC algorithm can generate the message authentication code by combining a secure hash algorithm (such as SHA-256, SM3, etc.) with the quantum key. Because the quantum key has true randomness and unpredictability, the HMAC value generated based on it also has high security and can effectively prevent the message authentication code from being forged.

[0073] Optionally, the first HMAC value is written to the header area of ​​the ciphertext data page, thus physically binding the HMAC value, encryption parameters, and ciphertext data page together and storing them within the data page for easy retrieval during reading without additional storage management. The header area is written during data page reassembly, ensuring the associative storage of the HMAC value and the data page.

[0074] Optionally, the integrity status of the encrypted data page is determined by comparing the first HMAC value with the second HMAC value. If the first HMAC value matches the second HMAC value, it means that the restored plaintext data page is completely identical to the original plaintext data page, and the data has not been tampered with or damaged during storage. If they do not match, it means that the data page may have been changed during storage or retrieval (such as disk sector corruption, man-in-the-middle attack, etc.), and the data page can be determined to be in an abnormal state.

[0075] It should be understood that the HMAC checksum (in this embodiment, the HMAC checksum can be either the first HMAC value or the second HMAC value mentioned above) is highly sensitive to any modification to the data page. A change in any bit in the data page will cause a significant change in the HMAC value (avalanche effect). Therefore, it can accurately identify whether the data page has been tampered with and promptly detect data security risks.

[0076] Figure 6 This is flowchart six of an embodiment of a data page encryption / decryption method based on a quantum cryptographic card according to this application. Figure 6 As shown, step 514, which determines the integrity status of the encrypted data page based on the comparison results, may include the following steps: Step 5141: If the first HMAC value is consistent with the second HMAC value, the ciphertext data page is determined to be complete, and the plaintext data page that can be restored is returned to the upper layer application through the file system; Step 5142: If the first HMAC value is inconsistent with the second HMAC value, the encrypted data page is determined to be abnormal, the encrypted data page is marked as abnormal, the abnormal status is reported to the error handling module of the file system, and the repair process is triggered.

[0077] Step 5143: In response to the repair process, the error handling module reads the corresponding plaintext data page backup from the backup storage, and calls the encryption module to re-encrypt the plaintext data page backup using the quantum cryptographic card to generate a replacement ciphertext data page.

[0078] Step 5144: In response to the repair process, the error handling module reads the corresponding plaintext data page backup from the backup storage, and calls the encryption module to re-encrypt the plaintext data page backup using the quantum cryptographic card to generate a replacement ciphertext data page.

[0079] In this embodiment, when the first HMAC value matches the second HMAC value, it indicates that the restored plaintext data page is completely identical to the original plaintext data page, and the data has not been tampered with or damaged during storage. Based on this, the ciphertext data page is determined to be intact, and the restored plaintext data page is allowed to be returned to the upper-layer application via the file system. When the first HMAC value does not match the second HMAC value, it indicates that the data page may have been changed during storage or retrieval. Based on this, the ciphertext data page is determined to be abnormal, the data page is marked as abnormal, and the abnormal state is reported to the error handling module of the file system, triggering a repair process. In response to this repair process, the error handling module reads the corresponding plaintext data page backup from the backup storage, calls the encryption module to re-encrypt the plaintext data page backup using the quantum cryptographic card to generate a replacement ciphertext data page, and calls the file system's write interface to write the replacement ciphertext data page to the block device to replace the abnormal ciphertext data page.

[0080] Optionally, when the first HMAC value matches the second HMAC value, it indicates that the restored plaintext data page has passed the integrity check and the data page has not been tampered with. In this case, the plaintext data page is returned to the upper-layer application for normal use by the business system. Since HMAC is highly sensitive to any change in any bit of the data, consistency means that the data has not been modified at all during writing and reading, ensuring data security and availability.

[0081] Optionally, when the first HMAC value is inconsistent with the second HMAC value, it indicates that the data page may have been tampered with or damaged due to disk sector corruption, man-in-the-middle attack, or other reasons. In this case, the data page is marked as abnormal to prevent erroneous data from being returned to the upper layer application, thus avoiding data leakage or business anomalies caused by incorrect decryption or malicious data injection.

[0082] Furthermore, in response to the repair process, the error handling module is triggered to read the corresponding plaintext data page backup from the backup storage and re-execute the encryption process to replace the ciphertext data page in the abnormal state. Backup storage refers to storage resources used to store backup copies of data pages. Its forms include, but are not limited to, at least one of the following: RAID (Redundant Array of Independent Disks) mirror copy, database master-slave backup, or dedicated data page-level backup file. RAID mirror copy synchronously copies data pages to multiple physical disks during data writing through the real-time mirroring mechanism of the disk array, providing real-time recovery capabilities in the event of single disk failure or data corruption. Database master-slave backup synchronizes data page changes to the slave database through the database master-slave replication mechanism, suitable for data page recovery in database storage engine scenarios. Data page-level backup files periodically export and store the plaintext content of specific data pages in an independent storage location, suitable for fine-grained backup strategies. Through the above backup storage methods, the error handling module can quickly locate and obtain the corresponding plaintext data page backup when a data page is abnormal.

[0083] Optionally, the encryption module is invoked to re-encrypt the plaintext data page backup using a quantum cryptographic card to generate a replacement ciphertext data page. The encryption module is the same module that performs the initial encryption operation in steps S110 to S130. Its method of performing the encryption operation using the quantum cryptographic card is completely consistent with the initial encryption process; that is, it regenerates the corresponding quantum key and encryption parameters based on the backed-up plaintext data page, and generates a new ciphertext data page and its corresponding HMAC value after performing the encryption operation using the quantum cryptographic card.

[0084] Optionally, the file system's write interface is invoked to write the replacement ciphertext data page to the block device to replace the ciphertext data page in the abnormal state. The file system's write interface is the same as the write interface used to perform disk flushing in step S130. During writing, the storage location of the abnormal data page in the block device is located based on the page identifier of the abnormal data page, and the generated replacement ciphertext data page is written to that location to overwrite the abnormal data page, thereby achieving automatic repair of the abnormal data page. Through the above repair process, the recovery of abnormal data pages can be completed without manual intervention, ensuring the continuous availability of data.

[0085] Figure 7 This is flowchart seven of an embodiment of a data page encryption / decryption method based on a quantum cryptographic card according to this application. Figure 7 As shown, before S150 performs the decryption operation on the ciphertext data page using the quantum cryptographic card, the method may further include: Step 521: Extract the key identifier of the quantum key from the encryption parameters; Step 522: Query the local key cache of the quantum cryptographic card based on the key identifier; Step 523: If the quantum key is found in the local key cache, retrieve the quantum key from the local key cache; Step 524: If the quantum key is not found in the local key cache, the quantum key is retrieved from the quantum cryptographic card through the quantum key generation interface in the quantum cryptographic card driver interface.

[0086] In this embodiment, when the decryption process begins, the key identifier of the quantum key is first extracted from the encryption parameters. Then, the local key cache of the quantum cryptographic card is queried according to the key identifier. If the quantum key is found in the local key cache, it is directly obtained from the cache. If it is not found, the quantum key is re-obtained from the quantum cryptographic card through the quantum key generation interface.

[0087] Optionally, a key identifier for the quantum key is extracted from the encryption parameters. The key identifier is a unique identifier (such as a UUID) returned by the quantum cryptographic card when generating the quantum key. The universally unique identifier (UUQI) is recorded in the encryption parameter structure. By parsing the encryption parameter structure, this key identifier can be obtained, and then the corresponding quantum key can be located and retrieved based on this identifier.

[0088] Optionally, the local key cache of the quantum cryptographic card can be queried based on the key identifier. The local key cache can be located in the internal hardware storage of the quantum cryptographic card or in a cache area managed by the driver interface module in the host memory, used to store recently used quantum keys. Since the generation of quantum keys by the quantum cryptographic card requires physical processes such as quantum state preparation and measurement, each key generation requires a certain response time. The caching mechanism can reduce the number of times the same key is frequently requested from the quantum cryptographic card, thereby improving decryption efficiency.

[0089] Optionally, if a quantum key is found in the local key cache, the quantum key is directly obtained from the local key cache for decryption operations, without needing to initiate a key generation request to the quantum cryptographic card again, thereby saving the time overhead of key generation and accelerating the decryption process.

[0090] Optionally, if the quantum key is not found in the local key cache, the quantum key is retrieved from the quantum cryptographic card through the quantum key generation interface in the quantum cryptographic card driver interface, and the retrieved quantum key is stored in the local key cache for later use. The cache can be configured with an eviction policy, such as the LRU (Least Recently Used) policy, to control the cache capacity and ensure that the cache stores the most frequently accessed quantum key.

[0091] Figure 8 This is a schematic diagram of a data page encryption / decryption device based on a quantum cryptographic card according to an embodiment of this application, as shown below. Figure 8 As shown, based on the above embodiments, the data page encryption / decryption device based on a quantum cryptographic card may include: a generation module 810, a first output module 820, a storage module 830, an extraction module 840, and a second output module 850. Detailed descriptions of each functional module are as follows: The generation module 810 is used to respond to the write data page request triggered by the file system, extract the plaintext data page to be written, call the quantum cryptographic card through the quantum cryptographic card driver interface to generate the quantum key corresponding to the plaintext data page, and generate encryption parameters based on the quantum key and the page identifier of the plaintext data page. The quantum keys corresponding to different data pages are different. The first output module 820 is used to input plaintext data pages and encryption parameters into the quantum cryptographic card, perform encryption operations on the plaintext data pages through the quantum cryptographic card, and output ciphertext data pages. Storage module 830 is used to associate and store encryption parameters with ciphertext data pages, and then flush the data to the block device via the file system. The extraction module 840 is used to read ciphertext data pages from the block device in response to a read data page request triggered by the file system, and extract the encrypted parameters stored in association with the ciphertext data pages; The second output module 850 is used to input the ciphertext data page and encryption parameters into the quantum cryptographic card, perform decryption operations on the ciphertext data page through the quantum cryptographic card, and output the restored plaintext data page.

[0092] In this embodiment of the application, the generation module 810 can also be specifically used for: Extract the page identifier of the plaintext data page; The page identifier is concatenated with the quantum key and then a hash operation is performed to generate an initialization vector that uniquely corresponds to the plaintext data page. The initialization vector, the key identifier of the quantum key, and the preset encryption algorithm type are combined into encryption parameters.

[0093] In this embodiment of the application, the generation module 810 can also be specifically used for: Call the quantum key generation interface in the quantum cryptographic card driver interface to pass the page identifier of the plaintext data page to the quantum cryptographic card driver interface; Send a key generation command carrying a page identifier to the quantum cryptographic card through the quantum key generation interface; The quantum key generated by the quantum cryptographic card based on the page identifier and the quantum random number generator or quantum key distribution protocol is received, wherein the quantum key generated corresponding to different page identifiers is different from each other.

[0094] In this embodiment of the application, the storage module 830 may also be specifically used for: Write the encryption parameters into the header area of ​​the ciphertext data page; Write the contents of the encrypted data page into the main area; Reassemble the encrypted data pages according to the preset format.

[0095] In this embodiment of the application, the second output module 850 can also be specifically used for: The HMAC algorithm interface of the quantum cryptographic card is invoked to perform HMAC operation on the plaintext data page based on the quantum key, generating the first HMAC value; Write the first HMAC value into the header area of ​​the ciphertext data page; The HMAC algorithm interface of the quantum cryptographic card is called to perform HMAC operation based on the plaintext data page restored by the quantum key pair, and generate a second HMAC value; The first HMAC value is compared with the second HMAC value, and the integrity status of the encrypted data page is determined based on the comparison result.

[0096] In this embodiment of the application, the second output module 850 can also be specifically used for: If the first HMAC value matches the second HMAC value, the encrypted data page is determined to be intact, and the plaintext data page that can be restored is returned to the upper layer application via the file system. If the first HMAC value and the second HMAC value are inconsistent, the encrypted data page is determined to be abnormal, the encrypted data page is marked as abnormal, the abnormal status is reported to the error handling module of the file system, and the repair process is triggered. In response to the repair process, the error handling module reads the corresponding plaintext data page backup from the backup storage, and calls the encryption module to re-encrypt the plaintext data page backup using the quantum cryptographic card to generate a replacement ciphertext data page; Calling the file system's write interface will replace the ciphertext data page with the block device to replace the ciphertext data page in an abnormal state.

[0097] In this embodiment of the application, the second output module 850 can also be specifically used for: Extracting the key identifier of the quantum key from the encryption parameters; Query the local key cache of the quantum cryptographic card based on the key identifier; If the quantum key is found in the local key cache, then the quantum key is retrieved from the local key cache. If the quantum key is not found in the local key cache, the quantum key can be retrieved from the quantum cryptographic card through the quantum key generation interface in the quantum cryptographic card driver interface.

[0098] It should be noted that for details not disclosed in the data page encryption / decryption device based on the quantum cryptographic card in this embodiment, please refer to the details disclosed in the embodiments of the data page encryption / decryption method based on the quantum cryptographic card in this specification, which will not be repeated here.

[0099] Based on the above embodiments, Figure 9 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 9 As shown, the electronic device 900 may include: a processor 901, a memory 902, and a computer program 9021 stored in the memory and executable on the processor. When executed, the processor implements the data page encryption and decryption method based on the quantum cryptographic card described in any of the foregoing embodiments.

[0100] Based on the above embodiments, this application also provides a computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by the processor of an electronic device, the electronic device is able to execute a data page encryption and decryption method based on a quantum cryptographic card. The method may include, for example, extracting the plaintext data page to be written in response to a write data page request triggered by a file system, calling the quantum cryptographic card through the quantum cryptographic card driver interface to generate a quantum key corresponding to the plaintext data page, and generating encryption parameters based on the quantum key and the page identifier of the plaintext data page, wherein the quantum keys corresponding to different data pages are different from each other. The plaintext data page and encryption parameters are input into the quantum cryptographic card, and the quantum cryptographic card performs encryption operations on the plaintext data page to output the ciphertext data page. After the encryption parameters are associated with the ciphertext data page and stored, they are flushed to the block device via the file system. In response to a read data page request triggered by the file system, read the ciphertext data page from the block device and extract the encrypted parameters stored in association with the ciphertext data page; The ciphertext data page and encryption parameters are input into the quantum cryptographic card. The quantum cryptographic card performs a decryption operation on the ciphertext data page and outputs the restored plaintext data page.

[0101] Furthermore, the logical instructions in the aforementioned memory 902 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of this application embodiment, essentially, or the parts that contribute to the prior art, or parts of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0102] Based on the above embodiments, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the data page encryption and decryption method based on the quantum cryptographic card provided by the above methods. The method includes: in response to a write data page request triggered by the file system, extracting the plaintext data page to be written, calling the quantum cryptographic card through the quantum cryptographic card driver interface to generate a quantum key corresponding to the plaintext data page, and generating encryption parameters based on the quantum key and the page identifier of the plaintext data page, wherein the quantum keys corresponding to different data pages are different from each other; The plaintext data page and encryption parameters are input into the quantum cryptographic card, and the quantum cryptographic card performs encryption operations on the plaintext data page to output the ciphertext data page. After the encryption parameters are associated with the ciphertext data page and stored, they are flushed to the block device via the file system. In response to a read data page request triggered by the file system, read the ciphertext data page from the block device and extract the encrypted parameters stored in association with the ciphertext data page; The ciphertext data page and encryption parameters are input into the quantum cryptographic card. The quantum cryptographic card performs a decryption operation on the ciphertext data page and outputs the restored plaintext data page.

[0103] Based on the above embodiments, in another aspect, this application also provides a non-transitory computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it is implemented to perform the data page encryption and decryption methods based on quantum cryptographic cards provided by the above methods. The method may include, for example, extracting plaintext data pages to be written in response to a write data page request triggered by a file system, calling the quantum cryptographic card through the quantum cryptographic card driver interface to generate a quantum key corresponding to the plaintext data page, and generating encryption parameters based on the quantum key and the page identifier of the plaintext data page, wherein the quantum keys corresponding to different data pages are different from each other; The plaintext data page and encryption parameters are input into the quantum cryptographic card, and the quantum cryptographic card performs encryption operations on the plaintext data page to output the ciphertext data page. After the encryption parameters are associated with the ciphertext data page and stored, they are flushed to the block device via the file system. In response to a read data page request triggered by the file system, read the ciphertext data page from the block device and extract the encrypted parameters stored in association with the ciphertext data page; The ciphertext data page and encryption parameters are input into the quantum cryptographic card. The quantum cryptographic card performs a decryption operation on the ciphertext data page and outputs the restored plaintext data page.

[0104] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0105] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

Claims

1. A data page encryption / decryption method based on a quantum cryptographic card, characterized in that, include: In response to a write data page request triggered by the file system, the plaintext data page to be written is extracted, and the quantum cryptographic card is called through the quantum cryptographic card driver interface to generate a quantum key corresponding to the plaintext data page. Encryption parameters are generated based on the quantum key and the page identifier of the plaintext data page, wherein the quantum keys corresponding to different data pages are different from each other. The plaintext data page and the encryption parameters are input into the quantum cryptographic card, and the quantum cryptographic card performs encryption operations on the plaintext data page to output the ciphertext data page. After the encryption parameters are associated with the ciphertext data page and stored, they are flushed to the block device via the file system. In response to a read data page request triggered by the file system, the encrypted data page is read from the block device, and the encryption parameters associated with the encrypted data page are extracted; The ciphertext data page and the encryption parameters are input into the quantum cryptographic card, and the quantum cryptographic card performs a decryption operation on the ciphertext data page to output the restored plaintext data page.

2. The data page encryption / decryption method based on a quantum cryptographic card according to claim 1, characterized in that, The generation of encryption parameters based on the quantum key and the page identifier of the plaintext data page includes: Extract the page identifier of the plaintext data page; The page identifier and the quantum key are concatenated and then hashed to generate an initialization vector that uniquely corresponds to the plaintext data page. The initialization vector, the key identifier of the quantum key, and the preset encryption algorithm type are combined to form the encryption parameters. The data structure of the encryption parameters is arranged in a fixed format according to the key identifier, the preset encryption algorithm type, and the initialization vector. During decryption, the required decryption parameters can be obtained by parsing the data structure of the encryption parameters.

3. The data page encryption / decryption method based on a quantum cryptographic card according to claim 1, characterized in that, The step of generating a quantum key corresponding to the plaintext data page by calling the quantum cryptographic card through the quantum cryptographic card driver interface includes: The quantum key generation interface in the quantum cryptographic card driver interface is invoked to pass the page identifier of the plaintext data page to the quantum cryptographic card driver interface; Send a key generation instruction carrying the page identifier to the quantum cryptographic card through the quantum key generation interface; The quantum key generated by the quantum cryptographic card according to the page identifier and a quantum random number generator or a quantum key distribution protocol is received, wherein the quantum keys generated corresponding to different page identifiers are different from each other.

4. The data page encryption / decryption method based on a quantum cryptographic card according to claim 1, characterized in that, The step of associating and storing the encryption parameters with the ciphertext data page includes: Write the encryption parameters into the header area of ​​the ciphertext data page; Write the contents of the encrypted data page into the main area; The encrypted data pages are reorganized according to a preset format.

5. The data page encryption / decryption method based on a quantum cryptographic card according to claim 1, characterized in that, Before inputting the ciphertext data page and the encryption parameters into the quantum cryptographic card, performing a decryption operation on the ciphertext data page through the quantum cryptographic card, and outputting the restored plaintext data page, the method further includes: The HMAC algorithm interface of the quantum cryptographic card is invoked to perform HMAC operation on the plaintext data page based on the quantum key, generating a first HMAC value; Write the first HMAC value into the header area of ​​the ciphertext data page; After inputting the ciphertext data page and the encryption parameters into the quantum cryptographic card, performing a decryption operation on the ciphertext data page through the quantum cryptographic card, and outputting the restored plaintext data page, the method further includes: The HMAC algorithm interface of the quantum cryptographic card is invoked to perform HMAC operation on the restored plaintext data page based on the quantum key, thereby generating a second HMAC value; The first HMAC value is compared with the second HMAC value, and the integrity status of the encrypted data page is determined based on the comparison result.

6. The data page encryption / decryption method based on a quantum cryptographic card according to claim 5, characterized in that, Determining the integrity status of the encrypted data page based on the comparison results includes: If the first HMAC value is consistent with the second HMAC value, the encrypted data page is determined to be complete, and the restored plaintext data page is allowed to be returned to the upper layer application via the file system; If the first HMAC value is inconsistent with the second HMAC value, the encrypted data page is determined to be abnormal, the encrypted data page is marked as abnormal, the abnormal state is reported to the error handling module of the file system, and the repair process is triggered. In response to the repair process, the error handling module reads the corresponding plaintext data page backup from the backup storage, and calls the encryption module to re-encrypt the plaintext data page backup using a quantum cryptographic card to generate a replacement ciphertext data page; The file system's write interface is invoked to write the replacement ciphertext data page to the block device to replace the ciphertext data page in the abnormal state.

7. The data page encryption / decryption method based on a quantum cryptographic card according to claim 1, characterized in that, Before performing the decryption operation on the ciphertext data page via the quantum cryptographic card, the method further includes: Extract the key identifier of the quantum key from the encryption parameters; The local key cache of the quantum cryptographic card is queried based on the key identifier; If the quantum key is found in the local key cache, then the quantum key is retrieved from the local key cache; If the quantum key is not found in the local key cache, the quantum key is retrieved from the quantum cryptographic card through the quantum key generation interface in the quantum cryptographic card driver interface.

8. A data page encryption / decryption device based on a quantum cryptographic card, characterized in that, include: The generation module is used to respond to a write data page request triggered by the file system, extract the plaintext data page to be written, call the quantum cryptographic card through the quantum cryptographic card driver interface to generate a quantum key corresponding to the plaintext data page, wherein the quantum keys corresponding to different data pages are different from each other, and generate encryption parameters based on the quantum key and the page identifier of the plaintext data page; The first output module is used to input the plaintext data page and the encryption parameters into the quantum cryptographic card, perform encryption operations on the plaintext data page through the quantum cryptographic card, and output the ciphertext data page. The storage module is used to associate the encryption parameters with the ciphertext data page and store them, and then flush the file system to the block device. The extraction module is configured to, in response to a read data page request triggered by the file system, read the ciphertext data page from the block device and extract the encryption parameters stored in association with the ciphertext data page; The second output module is used to input the ciphertext data page and the encryption parameters into the quantum cryptographic card, perform decryption operations on the ciphertext data page through the quantum cryptographic card, and output the restored plaintext data page.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the data page encryption and decryption method based on the quantum cryptographic card as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the data page encryption and decryption method based on the quantum cryptographic card as described in any one of claims 1 to 7.

Images