Memory encryption and decryption method and system based on user layer, and related device

Abstract

Disclosed in the present invention are a memory encryption and decryption method and system based on a user layer, and a related device. In the present solution, an original file in an encrypted state is innovatively mirror-image-mapped at a user layer to a specified directory without using a minifilter, decryption is synchronously performed during the process of mirror image mapping, and all pieces of decrypted data are stored in a user-mode program memory; and on this basis, the access process for the current decrypted file is synchronously monitored, so as to intercept untrusted process or release trusted process. By means of the solution of the present invention, all encryption and decryption and data storage operations are completed at the user layer, and all pieces of decrypted data are stored in the user-mode program memory, and thus the system efficiency can be greatly improved in a scenario where big data needs to be accessed.

Description

A user-layer-based memory encryption and decryption method, system, and related equipment Technical Field

[0001] The present invention relates to data security technology, and in particular to data encryption technology. Background Art

[0002] Encryption technology uses technical means to convert data into encrypted data (garbled code) before transmission, decrypting it upon arrival. Encryption technology is currently widely used, particularly in the economic sector and e-commerce. The most important aspect of encryption technology is the encryption algorithm. Different encryption algorithms have different security levels and encryption effectiveness. Common encryption algorithms are divided into symmetric encryption and asymmetric encryption.

[0003] Symmetric encryption uses symmetric cryptographic coding technology, which is characterized by using the same key for encryption and decryption, that is, the encryption key can also be used for decryption. This encryption algorithm is simple to use and has a short key. A common symmetric key encryption system is the International Data Encryption Algorithm (IDEA).

[0004] Asymmetric encryption algorithms are designed to address information disclosure and key management issues. In symmetric encryption, the encryption key may be shared with others, allowing data to be decrypted by obtaining the encryption key, posing a security risk. Asymmetric encryption algorithms separate the encryption and decryption keys into public and private keys. The public key encrypts data and the private key decrypts it. The two are symmetrical and complementary: data encrypted with the private key must be decrypted with the public key, and similarly, data encrypted with the public key must be decrypted with the private key.

[0005] Traditional encryption involves encrypting data and saving it to disk. When a user needs to view it, they must decrypt it. Once decrypted, the data becomes plaintext and can be used indefinitely, meaning it remains in plaintext. For example, this is similar to viewing an encrypted compressed package: once encrypted, the package cannot be viewed or opened, but once decrypted, the data is saved to disk in plaintext, allowing subsequent users to use it without having to decrypt it again.

[0006] In actual applications, some data needs to remain encrypted when not being viewed. This means that the data requires decryption by a specific program, and once decrypted and viewed, the data should automatically return to encrypted mode to prevent malicious reading and transfer by other programs. For example, in real-world business, users need to add, delete, query, and modify sensitive data, while also ensuring data security at all times. To achieve this, users must be restricted to using only specific programs for decryption and editing, with other programs unable to access the decrypted data. To address this issue, a general program can be built to decrypt the encrypted data, automatically returning it to encrypted mode after decryption. Traditional decryption methods typically use a key or password to decrypt the file and save it to the hard drive. Once decrypted, the file can be viewed an unlimited number of times, which results in certain security compromises. Consequently, traditional decryption methods are limited in scope and can also expose issues with the decrypted data.

[0007] The current technical solutions for automatic encryption and decryption of applications are all based on minifilter to implement file-related protection encryption.

[0008] Minifilter is a kernel-driven filter program officially launched by Windows. It provides hook callback operations for the Windows operating system, allowing users to intercept and release system operations. Minifilter is divided into user layer and kernel layer. The user layer configures permission files, etc., which are passed to the kernel layer. The kernel layer then operates on the file according to the configuration information, such as interception or release. The configuration file can perform certain operations based on the file name, extension, request process name, request method, etc. At the same time, if file encryption is detected, it will be automatically decrypted. The solution for judging file encryption or decryption is generally to judge the file header identifier. After the user writes the file information, the written information will be encrypted and appended to the kernel buffer, thereby realizing real-time encrypted storage of the file.

[0009] However, in actual application, the existing minifilter-based encryption protection scheme requires pre-registration of the Windows kernel driver and then communication between the user layer and the kernel layer. Since the configuration file encryption and decryption logic needs to be configured, the configuration file needs to be passed to the kernel layer, and the decryption of the file depends on the decryption method of the kernel layer. When the cache to be decrypted is too large, the resources occupied by the kernel layer will increase sharply, causing the system to freeze. The user configuration file of this scheme is defined at the user layer and can be flexibly transformed. Both XML and JSON can be used to achieve similar functions without considering the data transmission problem between the user layer and the kernel layer.

[0010] Furthermore, when the existing minifilter-based encryption protection scheme is actually applied, the program that must rely on the minifiler must add the Windows driver signature before it can be used. If it does not have the official Windows authorized signature, the program will not be able to run on the official version of Windows or will issue a warning, which will greatly increase the application cost of the existing scheme.

[0011] Summary of the Invention

[0012] In response to the problems existing in the existing file-related protection encryption scheme based on minifilter, the purpose of the present invention is to provide a user-layer based memory encryption and decryption scheme, which can implement file encryption protection at the user layer without using minifilter, thereby effectively overcoming the problems existing in the prior art.

[0013] In order to achieve the above-mentioned objectives, the present invention provides a user-layer-based memory encryption and decryption method, which maps any original directory image to any specified empty directory at the user layer, and synchronously decrypts all specified files under the original file directory during the image mapping process, and monitors the access process of the current decrypted file, intercepting untrusted processes or releasing trusted processes.

[0014] In some embodiments of the present invention, the memory encryption and decryption method uses dokany at the user layer to mount any original file in an encrypted state to any other specified empty directory, decrypts it at the same time, and monitors the access process of the current decrypted file.

[0015] In some embodiments of the present invention, the memory encryption and decryption method provides a file operation hook interface during the mount mapping process, and performs file io operation interception, authorization release, and encryption and decryption operations based on the operation hook interface.

[0016] In some embodiments of the present invention, when the memory decryption of a file is performed based on the operation hook interface in the memory encryption and decryption method, the file is encrypted in advance by an encryption program; at the same time, decryption is performed by reading the encryption scheme in the configuration file. When the file is opened and the hook callback is triggered, the encryption algorithm of the configuration file is read, and the file content is decrypted using the program's built-in key or the encryption space to read the key.

[0017] In some embodiments of the present invention, when the memory encryption and decryption method performs permission interception and authorization release based on the operation hook interface, the permission is granted through the user layer configuration; when the file is opened, the file IO read callback interface of dokany is actively triggered. The file IO read callback interface judges whether to intercept or release the current operation by judging the configuration information passed by the user layer. When the permission authentication is passed, it will enter the decryption logic to implement the memory decryption of the file and return it to the user layer for opening. When the authorization is not passed, the IO operation will be directly intercepted, and the file will remain encrypted.

[0018] In some embodiments of the present invention, the access permission policy for the decrypted file in the memory encryption and decryption method is generated by the user layer reading the configuration policy file, and then written into the user layer program to perform file permission management.

[0019] In order to achieve the above-mentioned objectives, the present invention also provides a memory encryption and decryption system based on dokany, comprising a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program is loaded by the processor and executes the steps of the above-mentioned memory encryption and decryption method.

[0020] In order to achieve the above-mentioned object, the present invention provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the implementation steps of the above-mentioned dokany-based memory encryption and decryption method.

[0021] In order to achieve the above-mentioned object, the present invention provides a processor, which is used to run a program, and when the program is running, the implementation steps of the above-mentioned dokany-based memory encryption and decryption method are executed.

[0022] In order to achieve the above-mentioned objectives, the present invention provides a terminal device, which includes a processor, a memory, and a program stored in the memory and capable of running on the processor. The program code is loaded and executed by the processor to implement the implementation steps of the above-mentioned dokany-based memory encryption and decryption method.

[0023] In order to achieve the above-mentioned object, the present invention provides a computer program product, which, when executed on a data processing device, is suitable for executing the implementation steps of the above-mentioned dokany-based memory encryption and decryption method.

[0024] The dokany-based memory encryption and decryption solution provided by the present invention completes all encryption, decryption and data storage operations at the user level, and all decrypted data is stored in the user-state program memory. This can greatly improve system efficiency in scenarios where big data needs to be accessed; thereby effectively overcoming the problem that the traditional minifilter solution cannot support the reading and analysis of big data because the size of the data file depends on the memory, and cannot provide a decryption solution for large amounts of data due to the small kernel-level memory.

[0025] Furthermore, compared with the existing minifilter-based encryption protection scheme, the user configuration file in the scheme of the present invention is defined at the user layer and can be flexibly transformed. Both XML and JSON can be used to implement the corresponding functions without considering the data transmission issues between the user layer and the kernel layer. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The present invention is further described below with reference to the accompanying drawings and specific embodiments.

[0027] FIG1 is an example diagram of memory encryption and decryption based on dokany in an example of the present invention. DETAILED DESCRIPTION

[0028] In order to make the technical means, creative features, objectives and effects achieved by the present invention easier to understand, the present invention is further described below with reference to specific illustrations.

[0029] Name explanation:

[0030] Intel's x86 processors use Ring levels for access control, which are divided into four levels, from Ring0 to Ring3 (hereinafter referred to as R0, R1, R2, and R3). The R0 layer has the highest permissions, and the R3 layer has the lowest permissions. According to Intel's original concept, applications work in the R3 layer and can only access data in the R3 layer; the operating system works in the R0 layer and can access data in all layers; and other drivers are located in the R1 and R2 layers, and each layer can only access data in the layer itself and the layers with lower permissions.

[0031] User layer: The operating environment of ordinary applications is the user layer, which can access limited resources and interfaces. For security reasons, the user layer cannot access resources such as drivers and system kernels.

[0032] Kernel layer: The operating system works in the R0 layer and can access data in all layers; other drivers are located in the R1 and R2 layers, and each layer can only access data in its own layer and lower layers.

[0033] Without using a minifilter, the solution of this invention innovatively maps encrypted files from any original directory to a designated empty directory at the user level. During the mirroring process, all designated files in the original directory are decrypted simultaneously, and all decrypted data is stored in the user-mode program memory. Furthermore, the solution simultaneously monitors the access process of the currently decrypted file, intercepting untrusted processes or allowing trusted processes to pass. Both the original file directory and the designated directory can be specified by the user and can be either a directory or an entire drive letter.

[0034] Specifically, the solution of the present invention uses Dokany to implement file encryption protection at the user level without using a minifilter. At the user level, the solution of the present invention uses Dokany to mount the original file in any encrypted directory to any other specified empty directory, decrypt it at the same time, and monitor the access process of the current decrypted file, intercepting untrusted processes or allowing trusted processes to access.

[0035] In some embodiments of the present invention, the present invention provides a file operation hook interface during the mount process. The file operation hook interface can be used to interact with the user layer for data, thereby realizing core functions such as process monitoring and file encryption and decryption.

[0036] Based on this, this solution implements file IO operation interception, authorization release, and encryption and decryption operations based on the file's operation hook interface.

[0037] In some embodiments of the present invention, when decrypting a file in memory based on the file's operation hook interface in the present invention, the file is pre-encrypted by an encryption program. The encryption scheme and encryption key are independently set and do not depend on the program involved in the present invention. At the same time, the present invention decrypts by reading the encryption scheme in the configuration file. When the file is opened and the hook callback is triggered, the program reads the encryption algorithm in the configuration file and uses the program's built-in key or the key read from the encryption space to decrypt the file content. Since the file content is generally a string, it is adaptable to currently common encryption algorithms, including symmetric and asymmetric encryption, but the encryption must be reversible.

[0038] In some embodiments of the present invention, when performing permission interception and authorization release based on the operation hook interface in the solution of the present invention, the permission is granted through user-level configuration, specifically including the blacklist and whitelist accessible to the process and the access type;

[0039] On the basis of this, when the user opens a file, dokany's file io read callback interface will be triggered actively. At the same time, the file io read callback interface will judge whether to intercept or release the current operation by judging the configuration information passed by the user layer:

[0040] Once the permission authentication is passed, the file will be decrypted in memory and returned to the user layer for opening.

[0041] If the authorization is not passed, the IO operation will be directly intercepted and the file will remain encrypted.

[0042] As a further preference, when the authorization is not passed, the io operation will be directly intercepted, and it can be further configured to prompt the user that he has no permission to open it.

[0043] In some embodiments of the present invention, the access permission policy for decrypted files in the solution of the present invention is generated by the user layer reading the configuration policy file, and then written into the user layer program to perform file permission management.

[0044] As a further explanation, file permissions here include delete, edit, access, and rename permissions, which can be freely configured by the user. Different file permissions correspond to one or more callback hook functions. The program reads the configuration file passed from the user layer and intercepts it in the hook callback of the specific permission to implement access control for specific permissions.

[0045] Specifically, the interception strategy here can be defined according to the policy file, which contains the configuration of the file name, file extension blacklist and whitelist, access process name, pid blacklist and whitelist, access user blacklist and whitelist, access time and access count.

[0046] As a further explanation, in the specific implementation, the interception strategy is defined by the user, and all configurations will be summarized into a piece of json data or xml, ini and other structured data. After the program is started, the corresponding configuration file information is read and passed to the kernel layer for access interception control.

[0047] On this basis, the solution of the present invention realizes the migration of all configuration parsing and encryption and decryption parsing operations to the user layer, effectively overcoming the problems of the existing minifilter solution in that the interception hook operation of the file must be reflected in the kernel layer, which has problems such as efficiency and occupancy. The solution of the present invention realizes the memory decryption of the file based on dokany, and decrypts it in the file information reading interface through the file operation hook interface formed by dokany. The process access policy prevents untrusted processes from accessing the decrypted data, so that all operations on the file are executed in the user layer, the decrypted data is stored in the program memory, and the file interface of the kernel layer is only used for interaction with the user layer, thereby making the implementation of this solution more flexible, low-cost, and rapid to develop, so that most of the development only needs to be completed in the user state, avoiding the system crash problem caused by kernel errors, and can effectively realize the encryption and decryption protection of large data. Completely different from the traditional minifilter solution, all decrypted data is stored in the kernel state, and the file resources that need to be executed or accessed are too large, which will cause the system to crash.

[0048] The user-level memory encryption and decryption scheme proposed in the present invention can be implemented as a corresponding software program, forming a corresponding user-level memory encryption and decryption system. When running, this software program will execute the user-level memory encryption and decryption method described above and store it in a corresponding storage medium for access and execution by a processor.

[0049] The user-level memory encryption and decryption system thus formed can encrypt and protect files, perform permission control, memory decryption, and automatic write-back at the user level based on dokany during runtime.

[0050] 1 , which is a flow chart showing memory encryption and decryption operations on files using the memory encryption and decryption system of the present invention.

[0051] As can be seen from the figure, when this memory encryption and decryption system performs memory encryption and decryption operations on files, dokany is started in the form of mirror mapping, and the protected encrypted original file is mapped to the mirror directory (that is, the mirror is mapped to any specified empty directory). The user accesses the mirror directory for viewing, and it is automatically decrypted after passing through dokany's mirror mapping. It also monitors the access process of the current decrypted file, intercepts untrusted processes, or releases trusted processes.

[0052] Specifically, the original file is encrypted in advance by the encryption program, and the encryption scheme and encryption key can be encrypted independently of the program, or the encryption scheme provided by the program can be used. After the file is encrypted, its extension or name can be changed to facilitate the program to identify the encrypted file.

[0053] Furthermore, access permissions are configured in the program and it is started. The program decrypts the file by reading the encryption scheme in the configuration. When the user opens the file and triggers the hook callback, the program reads the configured encryption algorithm and decrypts the file content using the program's built-in key (or the encryption space read key).

[0054] Since file contents are generally strings, this solution can be adapted to currently common encryption algorithms, including symmetric and asymmetric encryption, but it must be reversible encryption.

[0055] When the file permissions are released, the file is opened normally. However, unlike traditional files, the content of the currently opened file is decrypted through the kernel layer and displayed on the file. It does not exist on the hard disk but in the memory, thus greatly increasing the security of the file.

[0056] Furthermore, during implementation, after the decrypted file is decrypted by Dokany Mount and the currently accessing program is monitored in real time, the file's access permission policy is generated by the user layer by reading a configuration policy file (JSON or XML). This is then written to the user layer program to implement file permission management. The permission configuration is user-defined. In this solution, permission configuration is passed through program internal variables or files (which reduces security because the configuration file can be tampered with). After the user specifies the access policy, the program passes the configuration policy to the Dokany kernel via variables. At the system level, interaction between the user layer and the kernel layer is implemented using shared memory, where configuration variables are written to shared memory and then read by the kernel driver.

[0057] Furthermore, during implementation of the present invention, a symmetric encryption algorithm is preferably used for file decryption, requiring synchronized encryption and decryption keys. The decryption algorithm and key are already built into the program. The program itself has pre-set common encryption algorithm classes, including encryption and decryption keys, encryption schemes, and encryption functions, allowing the program to directly call encryption or decryption algorithms.

[0058] Furthermore, during implementation, the encryption and decryption logic only considers file decryption, assuming the file has been successfully encrypted. After encryption, a flag is added to the file header. When Dokany detects a header match, it decrypts the file, while remaining files remain undecrypted and undisplayed. This means that the decrypted files after mounting only contain the files that require decryption.

[0059] As a further explanation, the files here can be encrypted by the user, or directly using the program's default encryption scheme. After encryption, the program needs to distinguish encrypted files from unencrypted files in the original directory. Therefore, the default encryption scheme automatically changes the file header after encryption. The program uses the configuration file header to determine which files need to be decrypted. If the user encrypts the files themselves, they can change the file name and extension to identify them. The program also determines decryption by matching the file name or extension with a regular expression.

[0060] Furthermore, during implementation, the present invention automatically writes back a file. After a user obtains permission to open a decrypted file, dokany intercepts the user's write operation and automatically encrypts the written portion and appends it to the buffer. After the user closes the file, the original encrypted file is simultaneously refreshed to the latest version. This write-back hook function is typically the flush file update interface, which reads the data currently being written to the file, encrypts it, and appends it to the original file, thus implementing the automatic file write-back operation.

[0061] Furthermore, during the implementation of the solution of the present invention, the decryption of files relies on the decryption program of the solution. The program is an ordinary Windows process. The program uses C# to connect to the dokany interface and can be directly executed after packaging. The program relies on the dokany driver package and can be automatically installed after packaging. Even if the program is accidentally killed, the decrypted file will automatically disappear without affecting the security of the file. Even if the original file is copied, it is ciphertext and cannot be viewed. When the decryption program is started, it will intercept the system explore operation to prevent the user from manually copying the decrypted file.

[0062] It should be noted that the solution of the present invention is specifically implemented based on dokany. Under the guidance of the principle of the solution of the present invention, memfs can also be used for implementation.

[0063] An embodiment of the present invention further provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the implementation steps of the above-mentioned user-layer-based memory encryption and decryption method are implemented.

[0064] An embodiment of the present invention further provides a processor, which is used to run a program, wherein when the program is running, the implementation steps of the above-mentioned user-layer-based memory encryption and decryption method are executed.

[0065] An embodiment of the present invention also provides a terminal device, which includes a processor, a memory, and a program stored in the memory and runnable on the processor. The program code is loaded and executed by the processor to implement the implementation steps of the above-mentioned user-layer-based memory encryption and decryption method.

[0066] The present invention also provides a computer program product, which, when executed on a data processing device, is suitable for executing the implementation steps of the above-mentioned user-layer-based memory encryption and decryption method.

[0067] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0068] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0069] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0070] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products of the embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0071] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0072] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0073] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0074] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0075] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

[0076] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0077] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0078] The basic principles, main features, and advantages of the present invention are shown and described above. Those skilled in the art should understand that the present invention is not limited to the foregoing embodiments. The foregoing embodiments and descriptions are merely illustrative of the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. A memory encryption and decryption method based on the user layer, characterized in that: At the user layer, the encrypted original file image is mapped to any specified empty directory, and all specified files in the original file directory are decrypted synchronously during the image mapping process. The access process of the current decrypted file is monitored, and the untrusted process is intercepted or the trusted process is released.

2. The user-layer-based memory encryption and decryption method according to claim 1, characterized in that: The memory encryption and decryption method is based on dokany to mount and map the original file of any encrypted directory to other specified empty directories at the user layer, decrypt the files at the same time, and monitor the access process of the current decrypted files.

3. The user-layer-based memory encryption and decryption method according to claim 2, characterized in that: The memory encryption and decryption method provides a file operation hook interface during the mount mapping process, and performs file IO operation interception, authorization release and encryption and decryption operations based on the operation hook interface.

4. The user-layer-based memory encryption and decryption method according to claim 3 is characterized in that: In the memory encryption and decryption method, when the memory decryption of a file is performed based on the operation hook interface, the file is encrypted in advance by an encryption program; at the same time, decryption is performed by reading the encryption scheme in the configuration file. When the file is opened and the hook callback is triggered, the encryption algorithm of the configuration file is read, and the file content is decrypted using the program's built-in key or the encryption space reading key.

5. The user-layer-based memory encryption and decryption method according to claim 3 is characterized in that: In the memory encryption and decryption method, when permission interception and authorization release are performed based on the operation hook interface, the permission is granted through the user layer configuration; when the file is opened, the file IO read callback interface of dokany is actively triggered. The file IO read callback interface judges whether to intercept or release the current operation by judging the configuration information passed by the user layer. When the permission authentication is passed, it will enter the decryption logic to realize the memory decryption of the file and return it to the user layer for opening. When the authorization is not passed, the IO operation will be directly intercepted, and the file will remain encrypted.

6. The user-layer-based memory encryption and decryption method according to claim 2, characterized in that: In the memory encryption and decryption method, the access permission policy for the decrypted file is generated by the user layer reading the configuration policy file, and then written into the user layer program to perform file permission management.

7. A memory encryption and decryption system based on dokany, comprising a processor, a memory, and a program stored in the memory and capable of running on the processor, characterized in that: The program is loaded by the processor and executes the steps of the memory encryption and decryption method according to any one of claims 1 to 6.

8. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the implementation steps of the dokany-based memory encryption and decryption method according to any one of claims 1 to 6 are implemented.

9. A terminal device comprising a processor, a memory, and a program stored in the memory and executable on the processor, characterized in that: The program code is loaded and executed by the processor to implement the implementation steps of the dokany-based memory encryption and decryption method according to any one of claims 1 to 6.

10. A computer program product, when executed on a data processing device, characterized in that Suitable for executing the implementation steps of the dokany-based memory encryption and decryption method described in any one of claims 1-6.

Images