WO2024021496A1 - 透明加密方法、装置、电子设备及存储介质 - Google Patents

透明加密方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2024021496A1
WO2024021496A1 PCT/CN2022/141882 CN2022141882W WO2024021496A1 WO 2024021496 A1 WO2024021496 A1 WO 2024021496A1 CN 2022141882 W CN2022141882 W CN 2022141882W WO 2024021496 A1 WO2024021496 A1 WO 2024021496A1
Authority
WO
WIPO (PCT)
Prior art keywords
file
file system
operation request
virtual disk
encrypted
Prior art date
Application number
PCT/CN2022/141882
Other languages
English (en)
French (fr)
Inventor
徐天骥
刘才军
郭彬
段江南
黄景平
Original Assignee
天翼云科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 天翼云科技有限公司 filed Critical 天翼云科技有限公司
Publication of WO2024021496A1 publication Critical patent/WO2024021496A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5005—Allocation of resources, e.g. of the central processing unit [CPU] to service a request
    • G06F9/5011—Allocation of resources, e.g. of the central processing unit [CPU] to service a request the resources being hardware resources other than CPUs, Servers and Terminals
    • G06F9/5016—Allocation of resources, e.g. of the central processing unit [CPU] to service a request the resources being hardware resources other than CPUs, Servers and Terminals the resource being the memory
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5005—Allocation of resources, e.g. of the central processing unit [CPU] to service a request
    • G06F9/5011—Allocation of resources, e.g. of the central processing unit [CPU] to service a request the resources being hardware resources other than CPUs, Servers and Terminals
    • G06F9/5022—Mechanisms to release resources
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2211/00—Indexing scheme relating to details of data-processing equipment not covered by groups G06F3/00 - G06F13/00
    • G06F2211/007—Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2107—File encryption

Definitions

  • the present invention relates to the field of encryption technology, and specifically to transparent encryption methods, devices, electronic equipment and storage media.
  • Transparent encryption refers to protecting files on the user's computer without changing the user's operating habits.
  • the file is encrypted when it is written to the disk; when it is read, it is decrypted based on process judgment, and the authorized process is decrypted, while other unauthorized processes are not decrypted. This not only supports users to edit and use files on a daily basis, but also prevents users from leaking encrypted files to ensure data security.
  • embodiments of the present invention provide a transparent encryption method, device, electronic device, and storage medium to solve the problem of transparent encryption.
  • an embodiment of the present invention provides a transparent encryption method, including:
  • the operation request is redirected to a virtual disk file system or a real file system.
  • the virtual disk file system is used to interact with the real file system.
  • the virtual disk file is used to cache the decrypted file. of the target file, and the real file system is used to store the encrypted target file.
  • the transparent encryption method provided by the embodiment of the present invention realizes two forms of isolation of the same target file through the virtual disk file system, that is, the encrypted target file is stored in the real file system, and the decrypted target file is cached in the virtual disk In the file system, redirection is based on the type of operation request, thus achieving transparent encryption of dual file control and achieving the high performance and stability of a hierarchical file system.
  • redirecting the operation request to a virtual disk file system or a real file system according to the type of the operation request includes:
  • the operation request is processed in plain text based on the virtual disk file system.
  • the transparent encryption method provided by the embodiment of the present invention will redirect the operation request to the virtual disk file system only when it is determined that the type of the operation request is an authorized operation request, ensuring the reliability of the text data.
  • the virtual disk file system includes a virtual disk and an encrypted file system.
  • the virtual disk is used to mount the encrypted file system.
  • the encrypted file system is used to read encrypted files from the real file system.
  • the target file is then decrypted.
  • the shadow files maintained by the encrypted file system and the files maintained by the real file system actually correspond to the same physical disk file.
  • the shadow file accesses plaintext and the real file system accesses ciphertext, and has high performance and high stability. sex.
  • a redirection mechanism is used to forward operation requests to the virtual disk, which is compatible with anti-virus software and prevents blue screens caused by transparent transmission of shadow file operation requests to the real file system.
  • the clear text operation on the target file based on the virtual disk file system includes:
  • the encrypted file system is used to decrypt the encrypted target file, and the shadow file is used to cache the decryption result to perform plaintext operations on the target file.
  • the transparent encryption method provided by the embodiment of the present invention stores the access path of the encrypted target file in the real file system in the shadow file, and only uses the access path to read the encrypted target file when an operation request is received. With decryption, unnecessary memory overhead can be reduced by limiting the reading timing.
  • reading the shadow file in the virtual disk to obtain the encrypted access path of the target file in the real file system includes:
  • the encrypted access path of the target file in the real file system is recorded in the shadow file.
  • the method further includes:
  • the shadow file is cleared in the virtual disk.
  • shadow files are created and cleared based on requirements, which can release memory space in a timely manner and reduce memory consumption.
  • the method further includes:
  • the transparent encryption method provided by the embodiment of the present invention directly redirects the operation request to the real file system for ciphertext operation for unauthorized operation requests, thereby improving the security of the target file.
  • an embodiment of the present invention also provides a transparent encryption device, including:
  • An acquisition module used to obtain an operation request for a target file, where the operation request carries attribute information of the target file
  • a determining module configured to determine the type of the operation request based on the attribute information, where the type of the operation request includes an authorized operation request or an unauthorized operation request;
  • a redirection module configured to redirect the operation request to a virtual disk file system or a real file system according to the type of the operation request.
  • the virtual disk file system is used to interact with the real file system.
  • the virtual disk The file is used to cache the decrypted target file, and the real file system is used to store the encrypted target file.
  • an embodiment of the present invention provides an electronic device, including: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor By executing the computer instructions, the transparent encryption method described in the first aspect or any implementation manner of the first aspect is executed.
  • embodiments of the present invention provide a computer-readable storage medium that stores computer instructions, and the computer instructions are used to cause the computer to execute the first aspect or any of the first aspects.
  • Figure 1 shows a schematic diagram of transparent encryption based on a hierarchical file system
  • Figure 2 is a flow chart of a transparent encryption method according to an embodiment of the present invention.
  • Figure 3 is a flow chart of a transparent encryption method according to an embodiment of the present invention.
  • Figure 4 is a schematic diagram of a transparent encryption method according to an embodiment of the present invention.
  • Figure 5 is a schematic diagram of a transparent encryption method according to an embodiment of the present invention.
  • Figure 6 is a structural block diagram of a transparent encryption device according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention.
  • transparent encryption is implemented based on the Windows kernel layer.
  • the caching mechanism in the Windows operating system when the caching mechanism is turned on, different processes reading and writing the same file actually read and write the same file cache. The authorized process needs to access the plain text, while the non-authorized process needs to access the cipher text. This results in the need for cache switching when the two types of processes alternately operate the same encrypted file.
  • this method not only reduces performance, but frequent cache clearing may also damage files.
  • the double cache solution based on the layered file system exists to solve the performance problem.
  • the so-called layered file system is to extend the traditional encryption filter driver into a half filter driver and half file system.
  • the encryption driver not only filters file read and write requests, but also interacts with the Windows IO manager, cache manager, and kernel manager to provide the same
  • a disk file creates and maintains two file control blocks (FCB for short) and creates two caches.
  • FCB file control blocks
  • layerfsd is not a real file system, but a filter driver at the same level as anti-virus software.
  • anti-virus software can directly obtain the file system driver device of the current disk after the upper layer intercepts user read and write requests, and transparently transmits user data to the underlying file system. This bypasses all intermediate filter driver layers, including hierarchical file system drivers. Not only will this cause errors in the encrypted file data, but it is also more likely to cause the computer to crash with a blue screen because the underlying file system receives an FCB it did not create itself.
  • the transparent encryption method provided by the embodiment of the present invention first determines the type of the operation request, and then redirects it to the virtual disk file system or the real file system according to the type of the operation request, so as to realize the decryption of the target file and the encrypted target file. Store and maintain separately. That is, this method achieves transparent encryption of dual-file control and has the high performance and stability of a hierarchical file system.
  • the transparent encryption method provided by the embodiment of the present invention can also solve the problem of compatibility with anti-virus software.
  • the encrypted file system is registered as a real file system and mounted to the virtual disk, even if the anti-virus software filters the access request of the shadow FCB, the volume device obtained through the access request is still a virtual disk volume.
  • the access request sent is still processed by the encrypted file system and can be encrypted and decrypted normally and transparently.
  • a transparent encryption method embodiment is provided. It should be noted that the steps shown in the flow chart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although A logical order is shown in the flowcharts, but in some cases the steps shown or described may be performed in a different order than herein.
  • FIG. 2 is a flow chart of a transparent encryption method according to an embodiment of the present invention. As shown in Figure 2, the process includes the following step:
  • the operation request carries attribute information of the target file.
  • Operation requests include but are not limited to operations such as modification, deletion, and copying of target files. They are set according to actual needs and are not limited here.
  • This operation request is a request issued when performing specific processing operations on the target file after the open request.
  • the attribute information includes file information and process information of the target file.
  • the file information includes operation information on the target file, that is, which operations are specifically performed.
  • the process information indicates which process is currently accessing the file.
  • the type of the operation request includes an authorized operation request or an unauthorized operation request.
  • the electronic device is configured with identifiers of files with authorized operations and their corresponding processes, as well as files with unauthorized operations and their processes. After obtaining the attribute information, use the file information in the attribute information for matching to determine the authorization process corresponding to the file; then use the process information to match the authorization process to determine the type of the operation request. For example, the process corresponding to the document or form is determined as an authorized process, and the process corresponding to the outgoing message is determined as an unauthorized process.
  • S13 Redirect the operation request to the virtual disk file system or the real file system according to the type of the operation request.
  • the virtual disk file system is used to interact with the real file system, the virtual disk file is used to cache the decrypted target file, and the real file system is used to store the encrypted target file.
  • the virtual disk file system By configuring the virtual disk file system, isolation from the real file system is achieved. And what is stored in the real file system is the encrypted target file. The decryption operation of the encrypted target file is implemented through the virtual disk file system. Therefore, the virtual disk file system is used to cache the decrypted target file.
  • the operation request is redirected to the file system corresponding to the authorized operation request or the unauthorized operation request.
  • the authorized operation request corresponds to the virtual disk file system
  • the unauthorized operation request corresponds to the real file system.
  • it can access the decrypted target file and process the decrypted target file accordingly according to the operation request; for unauthorized operation requests, it can only access the encrypted target file, all All operations are performed on encrypted target files.
  • the transparent encryption method provided by this embodiment realizes two forms of isolation of the same target file through the virtual disk file system, that is, the encrypted target file is stored in the real file system, and the decrypted target file is cached in the virtual disk file.
  • redirection is based on the type of operation request, thus achieving transparent encryption of dual file control and achieving the high performance and stability of a hierarchical file system.
  • FIG. 3 is a flow chart of a transparent encryption method according to an embodiment of the present invention. As shown in Figure 3, the process includes the following step:
  • the operation request carries attribute information of the target file.
  • the type of the operation request includes an authorized operation request or an unauthorized operation request.
  • S23 Redirect the operation request to the virtual disk file system or the real file system according to the type of the operation request.
  • the virtual disk file system is used to interact with the real file system, the virtual disk file is used to cache the decrypted target file, and the real file system is used to store the encrypted target file.
  • the virtual disk file system includes a virtual disk and an encrypted file system.
  • the virtual disk is used to mount the encrypted file system, and the encrypted file system is used to read encrypted target files from the real file system for decryption.
  • the virtual disk is implemented using a memory disk, providing a sandbox-like environment for mounting encrypted file systems and hiding it from users.
  • the encrypted file system is mounted to the virtual disk, which implements all file system interfaces to the upper layer. It not only handles upper-layer read and write operations, but also interacts with the Windows memory manager and cache manager to maintain shadow files and encrypted plaintext caches.
  • the lower layer interacts with the real file system where the encrypted target file is located when reading and writing disk data, and handles the encryption and decryption of data and the hiding of encryption marks.
  • redirection is implemented through the encapsulated redirection module.
  • a file filtering driver written using the micro-filtering framework is mounted on each disk volume of an electronic device.
  • File operations are passed in the kernel driver device stack through operation requests constructed by the IO manager.
  • the mounted file filter driver can intercept all operation requests on the current disk volume, and the operation requests contain information about this file operation.
  • the redirection module can determine whether to redirect the file access request to the virtual disk file system, allowing authorized processes and unauthorized processes to access two files.
  • the shadow files maintained by the encrypted file system and the files maintained by the real file system actually correspond to the same physical disk file.
  • the shadow file is used to cache the decrypted data, that is, the shadow file accesses plaintext and the real file system accesses ciphertext, with high performance. and high stability.
  • a redirection mechanism is used to forward operation requests to the virtual disk, which is compatible with anti-virus software and prevents blue screens caused by transparent transmission of shadow file operation requests to the real file system.
  • the above-mentioned redirection module is used to redirect the operation request to the virtual disk file system. Since the shadow file in the virtual disk file system accesses plain text, therefore, in the virtual disk file system The operation request is processed in clear text.
  • the above S232 includes:
  • the shadow file is used to store the access path of the encrypted target file in the real file system.
  • the access path recorded in the shadow file is used to read the encrypted target from the real file system. document. Then use the encrypted file system to decrypt the encrypted target file to obtain the decrypted target file.
  • the shadow file is used to cache the decrypted target file. Based on this, for the specific processing of the operation request, the plaintext data cached in the shadow file can be processed.
  • the access path of the encrypted target file in the real file system is stored in the shadow file. This access path is only used to read and decrypt the encrypted target file when an operation request is received. By limiting the reading timing, it is possible to Reduce unnecessary memory overhead.
  • step (1) of S232 above includes:
  • shadow files when an authorized open request for the target file is obtained, the shadow file is created in the virtual disk, the shadow file is initialized, and the access path of the encrypted target file in the real file system is recorded. At this time, for the shadow file, only the access path is recorded, and the specific content of the encrypted target file is not involved. As mentioned above, only after receiving the authorization operation request, the access path will be used to pull the encrypted target file from the real file system, and the encrypted file system will be used to decrypt it and then cache it in the shadow file.
  • the method further includes: clearing the shadow file in the virtual disk when an authorized close request for the target file is obtained. After use, the shadow files are automatically cleared in the virtual disk. Shadow files are created based on demand and cleared based on demand, which can release memory space in time and reduce memory consumption.
  • the transparent encryption method provided in this embodiment will redirect the operation request to the virtual disk file system only when it is determined that the type of the operation request is an authorized operation request, ensuring the reliability of the text data.
  • the method may further include:
  • the operation request is directly redirected to the real file system for ciphertext operation, which improves the security of the target file.
  • an operation request (IRP) is generated, and the redirection module determines the type of the IRP.
  • IRP operation request
  • the virtual disk file system includes an encrypted file system and a virtual disk.
  • the encrypted file system maintains a shadow FCB, which can also be called a shadow file.
  • the access path is stored in the shadow file, and the access path is used to extract data from the real file.
  • the real FCB file data is read in the system.
  • the real file FCB data read at this time is encrypted data, which is decrypted through the encrypted file system and cached in the shadow file.
  • the user uses a document editing program to open the D: ⁇ 1.doc file.
  • the document editing program calls the create file system application interface to trigger a system call.
  • the IO manager constructs an open request containing the open operation information and sends it to D.
  • the file system device stack of the disk has a redirection module, anti-virus software, file system, etc. on the device stack, which will process the access request in turn.
  • the redirection module mounted on the device stack filters the open request, obtains process information and file information based on the open request, and matches it with the current encryption policy. For the authorization process, redirect it to the virtual disk.
  • the encrypted file system mounted on the virtual disk receives the open request for the open operation. Based on the file information in the open request, the encrypted file system sends a request to open 1.doc to the file system device stack of the D drive and waits for the processing result. .
  • the processing results include failure to open or successful opening.
  • the virtual disk After receiving the processing results, the virtual disk creates a shadow file, initializes the member data in the shadow file, records the real file path in the shadow file, and returns the processing results to the IO manager and upper-layer applications.
  • the document editing program receives the processing result and file handle.
  • the file pointed to by the file handle has been redirected to the shadow file in the virtual disk. Operation requests for subsequent file operations are directly sent to the encrypted file system for processing.
  • the redirection module directly sends the operation request to the real file system of the D: ⁇ disk, and accesses real files maintained by the real file system, that is, encrypted files.
  • the encrypted file system reads the file ciphertext data from the real file system, and The data is decrypted and returned to the document editing program; during writing operations, the plaintext data of the document editing program is encrypted and sent to the real file system to achieve transparent encryption and decryption.
  • module may be a combination of software and/or hardware that implements a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, implementation in hardware, or a combination of software and hardware, is also possible and contemplated.
  • This embodiment provides a transparent encryption device, as shown in Figure 6, including:
  • the acquisition module 41 is used to obtain an operation request of a target file, where the operation request carries attribute information of the target file;
  • Determining module 42 configured to determine the type of the operation request based on the attribute information, where the type of the operation request includes an authorized operation request or an unauthorized operation request;
  • Redirection module 43 configured to redirect the operation request to a virtual disk file system or a real file system according to the type of the operation request.
  • the virtual disk file system is used to interact with the real file system.
  • the virtual disk file system is used to interact with the real file system.
  • the disk file is used to cache the decrypted target file, and the real file system is used to store the encrypted target file.
  • redirection module 43 includes:
  • a first redirection unit configured to redirect the operation request to the virtual disk file system when the type of the operation request is an authorized operation request
  • the first processing unit is configured to perform plain text processing on the operation request based on the virtual disk file system.
  • the virtual disk file system includes a virtual disk and an encrypted file system.
  • the virtual disk is used to mount the encrypted file system.
  • the encrypted file system is used to read encrypted files from the real file system.
  • the target file is then decrypted.
  • the first processing unit includes:
  • the first reading subunit is used to read the shadow file in the virtual disk to obtain the encrypted access path of the target file in the real file system;
  • a second reading subunit configured to read the encrypted target file from the real file system based on the access path
  • the plaintext operation subunit is used to decrypt the encrypted target file using the encrypted file system, and cache the decryption result using the shadow file to perform plaintext operations on the target file.
  • the first reading subunit includes:
  • the recording subunit is configured to record the encrypted access path of the target file in the real file system in the shadow file.
  • the device further includes:
  • a clearing module configured to clear the shadow file in the virtual disk when an authorized close request for the target file is obtained.
  • the device further includes:
  • a first redirection unit configured to redirect the operation request to the real file system when the operation request is an unauthorized operation request
  • a ciphertext operation unit configured to perform ciphertext operations on the target file based on the real file system.
  • the transparent encryption device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC circuit, a processor and memory that executes one or more software or fixed programs, and/or other devices that can provide the above functions. .
  • An embodiment of the present invention also provides an electronic device having the transparent encryption device shown in FIG. 6 .
  • Figure 7 is a schematic structural diagram of an electronic device provided by an optional embodiment of the present invention.
  • the electronic device may include: at least one processor 51, such as a CPU (Central Processing Unit, Central Processing Unit). processor), at least one communication interface 53, memory 54, and at least one communication bus 52.
  • the communication bus 52 is used to realize connection communication between these components.
  • the communication interface 53 may include a display screen (Display) and a keyboard (Keyboard), and the optional communication interface 53 may also include a standard wired interface and a wireless interface.
  • the memory 54 may be a high-speed RAM memory (Random Access Memory, volatile random access memory) or a non-volatile memory (non-volatile memory), such as at least one disk memory.
  • the memory 54 may optionally be at least one storage device located remotely from the aforementioned processor 51 .
  • the processor 51 can be combined with the device described in FIG. 6 , the memory 54 stores an application program, and the processor 51 calls the program code stored in the memory 54 to execute any of the above method steps.
  • the communication bus 52 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the communication bus 52 can be divided into an address bus, a data bus, a control bus, etc. For ease of presentation, only one thick line is used in Figure 7, but it does not mean that there is only one bus or one type of bus.
  • the memory 54 may include volatile memory (English: volatile memory), such as random access memory (English: random-access memory). memory, abbreviation: RAM); memory can also include non-volatile memory (English: non-volatile memory), such as flash memory (English: flash memory), hard disk (English: hard disk drive, abbreviation: HDD) or solid state Hard disk (English: solid-state drive, abbreviation: SSD); the memory 54 may also include a combination of the above types of memory.
  • the processor 51 may be a central processing unit (English: central processing unit, abbreviation: CPU), a network processor (English: network processor, abbreviation: NP) or a combination of CPU and NP.
  • CPU central processing unit
  • NP network processor
  • the processor 51 may further include a hardware chip.
  • the above-mentioned hardware chip can be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof.
  • the above PLD can be a complex programmable logic device (English: complex programmable logic device (CPLD), field-programmable gate array (FPGA), general array logic (GAL) or any combination thereof.
  • memory 54 is also used to store program instructions.
  • the processor 51 can call program instructions to implement the transparent encryption method shown in any embodiment of the present application.
  • Embodiments of the present invention also provide a non-transitory computer storage medium.
  • the computer storage medium stores computer-executable instructions.
  • the computer-executable instructions can execute the transparent encryption method in any of the above method embodiments.
  • the storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk (Hard disk). Disk Drive (abbreviation: HDD) or solid-state drive (Solid-State Drive, SSD), etc.; the storage medium may also include a combination of the above types of memories.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Databases & Information Systems (AREA)
  • Storage Device Security (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本发明涉及加密技术领域，具体涉及透明加密方法、装置、电子设备及存储介质，该方法包括获取目标文件的操作请求，所述操作请求中携带有目标文件的属性信息；基于属性信息确定操作请求的类型，所述操作请求的类型包括授权操作请求或非授权操作请求；根据操作请求的类型，将操作请求重定向至虚拟磁盘文件***或真实文件***，所述虚拟磁盘文件***用于与真实文件***进行交互，所述虚拟磁盘文件用于缓存解密后的目标文件，所述真实文件***用于存储加密后的目标文件。通过虚拟磁盘文件***实现了同一目标文件的两种形式的隔离，在重定向时是基于操作请求的类型进行的，从而实现了双文件控制的透明加密，具备分层文件***的高性能和稳定性。

Description

透明加密方法、装置、电子设备及存储介质 技术领域
本发明涉及加密技术领域，具体涉及透明加密方法、装置、电子设备及存储介质。
 背景技术
透明加密是指在不改变用户操作习惯的前提下，对用户计算机上的文件进行保护。文件在被写入磁盘时进行加密；被读取时根据进程判断，对授权进程进行解密，而其他非授权进程不进行解密。这样既能支持用户日常编辑使用文件，又能防止用户将加密文件外发泄密，保障数据安全。
 技术问题
有鉴于此，本发明实施例提供了一种透明加密方法、装置、电子设备及存储介质，以解决透明加密的问题。
 技术解决方案
根据第一方面，本发明实施例提供了一种透明加密方法，包括：
获取目标文件的操作请求，所述操作请求中携带有所述目标文件的属性信息；
基于所述属性信息确定所述操作请求的类型，所述操作请求的类型包括授权操作请求或非授权操作请求；
根据所述操作请求的类型，将所述操作请求重定向至虚拟磁盘文件***或真实文件***，所述虚拟磁盘文件***用于与真实文件***进行交互，所述虚拟磁盘文件用于缓存解密后的所述目标文件，所述真实文件***用于存储加密后的所述目标文件。
本发明实施例提供的透明加密方法，通过虚拟磁盘文件***实现了同一目标文件的两种形式的隔离，即，加密后的目标文件存储在真实文件***中，解密后的目标文件缓存在虚拟磁盘文件***中，具体在重定向时是基于操作请求的类型进行的，从而实现了双文件控制的透明加密，具备分层文件***的高性能和稳定性。
在一些实施方式中，所述根据所述操作请求的类型，将所述操作请求重定向至虚拟磁盘文件***或真实文件***，包括：
当所述操作请求的类型为授权操作请求时，将所述操作请求重定向至所述虚拟磁盘文件***；
基于所述虚拟磁盘文件***对所述操作请求进行明文处理。
本发明实施例提供的透明加密方法，只有在确定出操作请求的类型为授权操作请求时，才会将操作请求重定向至虚拟磁盘文件***，保证明文数据的可靠性。
在一些实施方式中，所述虚拟磁盘文件***包括虚拟磁盘以及加密文件***，所述虚拟磁盘用于挂载所述加密文件***，所述加密文件***用于从所述真实文件***读取加密后的所述目标文件进行解密。
本发明实施例提供的透明加密方法，加密文件***维护的影子文件和真实文件***维护的文件实际对应同一个物理磁盘文件，影子文件访问明文，真实文件***访问密文，具备高性能和高稳定性。采用重定向机制将操作请求转发到虚拟磁盘，与杀毒软件兼容，防止透传影子文件的操作请求到真实文件***后导致蓝屏等。
在一些实施方式中，所述基于所述虚拟磁盘文件***对所述目标文件进行明文操作，包括：
读取所述虚拟磁盘中的影子文件，以获得加密后的所述目标文件在所述真实文件***中的访问路径；
基于所述访问路径从所述真实文件***中读取加密后的所述目标文件；
利用加密文件***对加密后的所述目标文件进行解密，并利用所述影子文件对解密结果进行缓存，以对所述目标文件进行明文操作。
本发明实施例提供的透明加密方法，在影子文件中存储加密后的目标文件在真实文件***中的访问路径，只有在接收到操作请求时才利用该访问路径进行加密后的目标文件的读取与解密，通过读取时机的限制，能够减少不必要的内存开销。
在一些实施方式中，所述读取所述虚拟磁盘中的影子文件，以获得加密后的所述目标文件在所述真实文件***中的访问路径，包括：
当获取到所述目标文件的授权打开请求时，在所述虚拟磁盘中创建影子文件；
在所述影子文件中记录加密后的所述目标文件在所述真实文件***中的访问路径。
在一些实施方式中，所述方法还包括：
当获取到所述目标文件的授权关闭请求时，在所述虚拟磁盘中清除所述影子文件。
本发明实施例提供的透明加密方法，影子文件是依据需求创建，且依据需求清除的，能够及时释放内存空间，减少内存消耗。
在一些实施方式中，所述方法还包括：
当所述操作请求为非授权操作请求时，将所述操作请求重定向至所述真实文件***；
基于所述真实文件***对所述目标文件进行密文操作。
本发明实施例提供的透明加密方法，对于非授权操作请求，就直接将操作请求重定向至真实文件***中进行密文操作，提高了目标文件的安全性。
根据第二方面，本发明实施例还提供了一种透明加密装置，包括：
获取模块，用于获取目标文件的操作请求，所述操作请求中携带有所述目标文件的属性信息；
确定模块，用于基于所述属性信息确定所述操作请求的类型，所述操作请求的类型包括授权操作请求或非授权操作请求；
重定向模块，用于根据所述操作请求的类型，将所述操作请求重定向至虚拟磁盘文件***或真实文件***，所述虚拟磁盘文件***用于与真实文件***进行交互，所述虚拟磁盘文件用于缓存解密后的所述目标文件，所述真实文件***用于存储加密后的所述目标文件。
根据第三方面，本发明实施例提供了一种电子设备，包括：存储器和处理器，所述存储器和所述处理器之间互相通信连接，所述存储器中存储有计算机指令，所述处理器通过执行所述计算机指令，从而执行第一方面或者第一方面的任意一种实施方式中所述的透明加密方法。
根据第四方面，本发明实施例提供了一种计算机可读存储介质，所述计算机可读存储介质存储计算机指令，所述计算机指令用于使所述计算机执行第一方面或者第一方面的任意一种实施方式中所述的透明加密方法。
 附图说明
为了更清楚地说明本发明具体实施方式或现有技术中的技术方案，下面将对具体实施方式或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本发明的一些实施方式，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1示出了基于分层文件***的透明加密示意图；
图2是根据本发明实施例的透明加密方法的流程图；
图3是根据本发明实施例的透明加密方法的流程图；
图4是根据本发明实施例的透明加密方法的示意图；
图5是根据本发明实施例的透明加密方法的示意图；
图6是根据本发明实施例的透明加密装置的结构框图；
图7是本发明实施例提供的电子设备的硬件结构示意图。
 本发明的实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
一般透明加密是基于windows内核层实现，通过在内核层对打开关闭、读写文件等请求进行过滤，根据不同进程的权限和文件类型决定是否进行加解密。然而，由于windows操作***存在缓存机制，在开启缓存机制的状态下，不同进程读写同一个文件实际上是读写同一份文件缓存。授权进程需要访问明文，而非授权进程需要访问密文，这就导致两类进程交替操作同一个加密文件时，需要进行缓存切换。但是这类方法不仅降低了性能，频繁清缓存还可能损坏文件。
进一步地，基于分层文件***（即，layerfsd）的双缓存方案为了解决性能问题而存在的。所谓分层文件***，就是将传统加密过滤驱动扩展为一个半过滤驱动半文件***，加密驱动不仅过滤文件读写请求，还与windows io管理器、缓存管理器、内核管理器进行交互，为同一个磁盘文件建立维护两个文件控制块（file control block，简称为FCB），建立两份缓存。这样授权进程和非授权进程相当于访问两个文件，互不干扰，解决了性能问题，稳定性也有所提高。然而layerfsd并不是真正的文件***，而与杀毒软件同属同一层面的过滤驱动。为了防止某些恶意软件也采用过滤文件操作的方法威胁用户数据，杀毒软件可以在上层拦截到用户读写请求后，直接获取当前磁盘的文件***驱动设备，将用户数据透传到底层文件***，从而绕过中间所有的过滤驱动层，包括分层文件***驱动。这不仅会导致加密文件数据出错，而且由于下层文件***接受到了一个并非它自身创建的FCB，更有可能导致计算机崩溃蓝屏。
例如，如图1所示，基于分层文件***的技术虽然实现了所有文件***接口，但并没有注册为真正的文件***，其本质仍然是文件过滤驱动，与真实文件***挂载在同一个卷设备上。因此，如果某些杀毒软件或者恶意软件同样采用文件过滤驱动的方式，将影子FCB的访问请求过滤，通过访问请求获取到底层文件***设备，然后将访问请求直接发送到底层文件***，文件***接收到一个不属于自己维护的FCB，去读写相关数据就很可能导致***直接崩溃。
本发明实施例提供的透明加密方法，先确定操作请求的类型，再依据操作请求的类型将其重定向至虚拟磁盘文件***或真实文件***，实现解密后的目标文件与加密后的目标文件的分别存储与维护。即，该方法实现了双文件控制的透明加密，具备分层文件***的高性能和稳定性。
进一步地，本发明实施例提供的透明加密方法，还能解决与杀毒软件的兼容性问题。在本发明实施例中，由于加密文件***注册为真正的文件***并挂载到虚拟磁盘，即使杀毒软件等过滤到影子FCB的访问请求，通过访问请求获取到的卷设备仍然是虚拟磁盘卷，发送的访问请求最终仍然由加密文件***处理，可以正常透明加解密。
根据本发明实施例，提供了一种透明加密方法实施例，需要说明的是，在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机***中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
在本实施例中提供了一种透明加密方法，可用于电子设备，如终端、服务器等，图2是根据本发明实施例的透明加密方法的流程图，如图2所示，该流程包括如下步骤：
S11，获取目标文件的操作请求。
其中，所述操作请求中携带有目标文件的属性信息。
操作请求包括但不限于对目标文件的修改、删除、复制等操作，具体根据实际需求进行设置，在此对其并不做任何限定。该操作请求是在打开请求之后，对目标文件进行具体处理操作时发出的请求。其中，属性信息包括目标文件的文件信息以及进程信息，文件信息包括对目标文件的操作信息，即具体执行哪些操作，进程信息表示当前是哪个进程访问的。
S12，基于属性信息确定操作请求的类型。
其中，所述操作请求的类型包括授权操作请求或非授权操作请求。
在电子设备中配置有具有授权操作的文件及其对应的进程，以及非授权操作的文件及其进程的标识。在获取到属性信息之后，利用属性信息中的文件信息进行匹配，确定出该文件对应的授权进程；再利用进程信息与授权进程进行匹配，确定出该操作请求的类型。例如，将对文档或表格对应的进程确定为授权进程，将消息外发对应的进程确定为非授权进程。
S13，根据操作请求的类型，将操作请求重定向至虚拟磁盘文件***或真实文件***。
所述虚拟磁盘文件***用于与真实文件***进行交互，所述虚拟磁盘文件用于缓存解密后的所述目标文件，所述真实文件***用于存储加密后的所述目标文件。
通过配置虚拟磁盘文件***，实现与真实文件***的隔离。且在真实文件***中存储的是加密后的目标文件，对于加密后的目标文件的解密操作是通过虚拟磁盘文件***实现的，因此，虚拟磁盘文件***用于缓存解密后的目标文件。
在确定出操作请求的类型之后，将操作请求重定向至授权操作请求或非授权操作请求对应的文件***。其中，授权操作请求与虚拟磁盘文件***对应，非授权操作请求与真实文件***对应。对于授权操作请求而言，其可以访问解密后的目标文件，并依据操作请求对解密后的目标文件进行相应的处理；对于非授权操作请求而言，其仅能够访问加密后的目标文件，所有的操作均是对加密后的目标文件进行处理的。
本实施例提供的透明加密方法，通过虚拟磁盘文件***实现了同一目标文件的两种形式的隔离，即，加密后的目标文件存储在真实文件***中，解密后的目标文件缓存在虚拟磁盘文件***中，具体在重定向时是基于操作请求的类型进行的，从而实现了双文件控制的透明加密，具备分层文件***的高性能和稳定性。
在本实施例中提供了一种透明加密方法，可用于电子设备，如终端、服务器等，图3是根据本发明实施例的透明加密方法的流程图，如图3所示，该流程包括如下步骤：
S21，获取目标文件的操作请求。
其中，所述操作请求中携带有目标文件的属性信息。
详细请参见图2所示实施例的S11，在此不再赘述。
S22，基于属性信息确定操作请求的类型。
其中，所述操作请求的类型包括授权操作请求或非授权操作请求。
详细请参见图2所示实施例的S12，在此不再赘述。
S23，根据操作请求的类型，将操作请求重定向至虚拟磁盘文件***或真实文件***。
所述虚拟磁盘文件***用于与真实文件***进行交互，所述虚拟磁盘文件用于缓存解密后的所述目标文件，所述真实文件***用于存储加密后的所述目标文件。
在一些实施方式中，虚拟磁盘文件***包括虚拟磁盘以及加密文件***，虚拟磁盘用于挂载加密文件***，加密文件***用于从真实文件***读取加密后的目标文件进行解密。虚拟磁盘使用内存盘实现，提供一个类沙箱的环境，用于挂载加密文件***，并对用户隐藏。加密文件***挂载到虚拟磁盘，其对上层实现了所有文件***接口，不仅处理上层读写等操作，还与windows内存管理器、缓存管理器交互，维护影子文件和加密明文缓存。对下层在读写磁盘数据时与加密后的目标文件所在的真实文件***进行交互，处理数据的加解密以及加密标记的隐藏等。
为实现对操作请求的重定向处理，通过封装的重定向模块实现重定向。例如，采用微过滤框架编写的文件过滤驱动，挂载到电子设备的每个磁盘卷上。文件操作通过IO管理器构造的操作请求在内核驱动设备栈中传递。挂载后的文件过滤驱动可以截获当前磁盘卷上所有的操作请求，而操作请求内包含了本次文件操作的信息。重定向模块根据拦截到的操作请求中的文件信息和进程信息，可以确定是否将该文件访问请求重定向到虚拟磁盘文件***，实现授权进程与非授权进程访问两个文件。
加密文件***维护的影子文件和真实文件***维护的文件实际对应同一个物理磁盘文件，影子文件用于对解密后的数据进行缓存，即影子文件访问明文，真实文件***访问密文，具备高性能和高稳定性。采用重定向机制将操作请求转发到虚拟磁盘，与杀毒软件兼容，防止透传影子文件的操作请求到真实文件***后导致蓝屏等。
基于此，上述S23包括：
S231，当操作请求的类型为授权操作请求时，将操作请求重定向至虚拟磁盘文件***。
S232，基于虚拟磁盘文件***对操作请求进行明文处理。
在操作请求的类型为授权操作请求时，利用上述的重定向模块将该操作请求重定性至虚拟磁盘文件***，由于虚拟磁盘文件***中的影子文件访问的是明文，因此，在虚拟磁盘文件***中对该操作请求进行明文处理。
在一些实施方式中，上述S232包括：
（1）读取虚拟磁盘中的影子文件，以获得加密后的目标文件在真实文件***中的访问路径。
（2）基于访问路径从真实文件***中读取加密后的目标文件。
（3）利用加密文件***对加密后的目标文件进行解密，并利用影子文件对解密结果进行缓存，以对目标文件进行明文操作。
影子文件中用于存储加密后的目标文件在真实文件***中的访问路径，当存在对该目标文件的操作需求时，利用影子文件中记载的访问路径从真实文件***中读取加密后的目标文件。再利用加密文件***对加密后的目标文件进行解密，得到解密后的目标文件。利用影子文件对解密后的目标文件进行缓存，基于此，对于操作请求的具体处理而言，就能够对影子文件中缓存的明文数据进行处理。
在影子文件中存储加密后的目标文件在真实文件***中的访问路径，只有在接收到操作请求时才利用该访问路径进行加密后目标文件的读取与解密，通过读取时机的限制，能够减少不必要的内存开销。
在一些实施方式中，上述S232的步骤（1）包括：
1.1）当获取到目标文件的授权打开请求时，在虚拟磁盘中创建影子文件。
1.2）在影子文件中记录加密后的目标文件在真实文件***中的访问路径。
对于影子文件而言，在获取到目标文件的授权打开请求时，才在虚拟磁盘中创建该影子文件，并对影子文件进行初始化，同时记录加密后的目标文件在真实文件***中的访问路径。此时，对于影子文件而言，记录的仅仅是访问路径，而不涉及到加密后的目标文件的具体内容。如上文所述，仅仅是在接收到授权操作请求之后，才会利用访问路径从真实文件***中拉取加密后的目标文件，利用加密文件***对其进行解密后缓存在影子文件中的。
在另一些实施方式中，该方法还包括：当获取到目标文件的授权关闭请求时，在虚拟磁盘中清除影子文件。在使用完成之后，在虚拟磁盘中自动清除影子文件。影子文件是依据需求创建，且依据需求清除的，能够及时释放内存空间，减少内存消耗。
本实施例提供的透明加密方法，只有在确定出操作请求的类型为授权操作请求时，才会将操作请求重定向至虚拟磁盘文件***，保证明文数据的可靠性。
在另一些实施方式中，该方法还可以包括：
（1）当操作请求为非授权操作请求时，将操作请求重定向至真实文件***。
（2）基于真实文件***对目标文件进行密文操作。
对于非授权操作请求，就直接将操作请求重定向至真实文件***中进行密文操作，提高了目标文件的安全性。
如图4所示，当操作应用程序时，生成一个操作请求（IRP），重定向模块对该IRP的类型进行确定。对于授权进程，将该IRP重定向到虚拟磁盘文件***；对于非授权进程，直接将该IRP重定向至真实文件***。其中，在虚拟磁盘文件***中包括有加密文件***以及虚拟磁盘，加密文件***中维护了影子FCB，也可以称之为影子文件，在影子文件中存储有访问路径，利用该访问路径从真实文件***中读取真实FCB文件数据，此时读取到的真实文件FCB数据是加密数据，通过加密文件***对其进行解密后缓存在影子文件中。
作为一个具体应用实例，如图5所示，以第一次打开加密文件为例，具体工作流程为：
（1）用户使用文档编辑程序打开D:\1.doc文件，文档编辑程序调用创建文件***应用接口触发***调用，IO管理器解析参数后构建包含打开操作信息的打开请求，将其发送到D盘的文件***设备栈，设备栈上面有重定向模块、杀毒软件、文件***等，会依次对访问请求进行处理。
（2）设备栈上挂载的重定向模块过滤到打开请求，根据打开请求获取进程信息和文件信息，与当前加密的策略进行匹配。对于授权进程，将其重定向到虚拟磁盘。
（3）虚拟磁盘上挂载的加密文件***收到打开操作的打开请求，基于打开请求内的文件信息，加密文件***向D盘的文件***设备栈发送打开1.doc的请求并等待处理结果。其中，处理结果包括打开失败，或打开成功。虚拟磁盘在接收到处理结果后创建影子文件，初始化影子文件中的成员数据，并在影子文件中记录真实文件路径，将处理结果返回给IO管理器和上层应用。
（4）文档编辑程序收到处理结果和文件句柄，文件句柄指向的文件已被重定向到虚拟磁盘中的影子文件，后续文件操作的操作请求直接被发送到加密文件***中处理。
（5）如果非授权进程访问D:\1.doc，重定向模块直接将操作请求下发到D:\盘的真实文件***，访问的是由真实文件***维护的真实文件，即加密文件。
通过建立影子文件实现了授权进程和非授权进程访问的隔离，对于文档编辑程序后续的读写等操作，加密文件***收到操作请求后，从真实文件***处读取文件密文数据，并将数据解密后返回给文档编辑程序；写操作时将文档编辑程序的明文数据加密后发送给真实文件***，实现透明加解密。
在本实施例中还提供了一种透明加密装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
本实施例提供一种透明加密装置，如图6所示，包括：
获取模块41，用于获取目标文件的操作请求，所述操作请求中携带有所述目标文件的属性信息；
确定模块42，用于基于所述属性信息确定所述操作请求的类型，所述操作请求的类型包括授权操作请求或非授权操作请求；
重定向模块43，用于根据所述操作请求的类型，将所述操作请求重定向至虚拟磁盘文件***或真实文件***，所述虚拟磁盘文件***用于与真实文件***进行交互，所述虚拟磁盘文件用于缓存解密后的所述目标文件，所述真实文件***用于存储加密后的所述目标文件。
在一些实施方式中，重定向模块43包括：
第一重定向单元，用于当所述操作请求的类型为授权操作请求时，将所述操作请求重定向至所述虚拟磁盘文件***；
第一处理单元，用于基于所述虚拟磁盘文件***对所述操作请求进行明文处理。
在一些实施方式中，所述虚拟磁盘文件***包括虚拟磁盘以及加密文件***，所述虚拟磁盘用于挂载所述加密文件***，所述加密文件***用于从所述真实文件***读取加密后的所述目标文件进行解密。
在一些实施方式中，第一处理单元包括：
第一读取子单元，用于读取所述虚拟磁盘中的影子文件，以获得加密后的所述目标文件在所述真实文件***中的访问路径；
第二读取子单元，用于基于所述访问路径从所述真实文件***中读取加密后的所述目标文件；
明文操作子单元，用于利用加密文件***对加密后的所述目标文件进行解密，并利用所述影子文件对解密结果进行缓存，以对所述目标文件进行明文操作。
在一些实施方式中，第一读取子单元包括：
创建子单元，用于当获取到所述目标文件的授权打开请求时，在所述虚拟磁盘中创建影子文件；
记录子单元，用于在所述影子文件中记录加密后的所述目标文件在所述真实文件***中的访问路径。
在一些实施方式中，所述装置还包括：
清除模块，用于当获取到所述目标文件的授权关闭请求时，在所述虚拟磁盘中清除所述影子文件。
在一些实施方式中，所述装置还包括：
第一重定向单元，用于当所述操作请求为非授权操作请求时，将所述操作请求重定向至所述真实文件***；
密文操作单元，用于基于所述真实文件***对所述目标文件进行密文操作。
本实施例中的透明加密装置是以功能单元的形式来呈现，这里的单元是指ASIC电路，执行一个或多个软件或固定程序的处理器和存储器，和/或其他可以提供上述功能的器件。
上述各个模块的更进一步的功能描述与上述对应实施例相同，在此不再赘述。
本发明实施例还提供一种电子设备，具有上述图6所示的透明加密装置。
请参阅图7，图7是本发明可选实施例提供的一种电子设备的结构示意图，如图7所示，该电子设备可以包括：至少一个处理器51，例如CPU（Central Processing Unit，中央处理器），至少一个通信接口53，存储器54，至少一个通信总线52。其中，通信总线52用于实现这些组件之间的连接通信。其中，通信接口53可以包括显示屏（Display）、键盘（Keyboard），可选通信接口53还可以包括标准的有线接口、无线接口。存储器54可以是高速RAM存储器（Random Access Memory，易挥发性随机存取存储器），也可以是非不稳定的存储器（non-volatile memory），例如至少一个磁盘存储器。存储器54可选的还可以是至少一个位于远离前述处理器51的存储装置。其中处理器51可以结合图6所描述的装置，存储器54中存储应用程序，且处理器51调用存储器54中存储的程序代码，以用于执行上述任一方法步骤。
其中，通信总线52可以是外设部件互连标准（peripheral component interconnect，简称PCI）总线或扩展工业标准结构（extended industry standard architecture，简称EISA）总线等。通信总线52可以分为地址总线、数据总线、控制总线等。为便于表示，图7中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
其中，存储器54可以包括易失性存储器（英文：volatile memory），例如随机存取存储器（英文：random-access memory，缩写：RAM）；存储器也可以包括非易失性存储器（英文：non-volatile memory），例如快闪存储器（英文：flash memory），硬盘（英文：hard disk drive，缩写：HDD）或固态硬盘（英文：solid-state drive，缩写：SSD）；存储器54还可以包括上述种类的存储器的组合。
其中，处理器51可以是中央处理器（英文：central processing unit，缩写：CPU），网络处理器（英文：network processor，缩写：NP）或者CPU和NP的组合。
其中，处理器51还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路（英文：application-specific integrated circuit，缩写：ASIC），可编程逻辑器件（英文：programmable logic device，缩写：PLD）或其组合。上述PLD可以是复杂可编程逻辑器件（英文：complex programmable logic device，缩写：CPLD），现场可编程逻辑门阵列（英文：field-programmable gate array，缩写：FPGA），通用阵列逻辑（英文：generic array logic, 缩写：GAL）或其任意组合。
可选地，存储器54还用于存储程序指令。处理器51可以调用程序指令，实现如本申请任一实施例中所示的透明加密方法。
本发明实施例还提供了一种非暂态计算机存储介质，所述计算机存储介质存储有计算机可执行指令，该计算机可执行指令可执行上述任意方法实施例中的透明加密方法。其中，所述存储介质可为磁碟、光盘、只读存储记忆体（Read-Only Memory，ROM）、随机存储记忆体（Random Access Memory，RAM）、快闪存储器（Flash Memory）、硬盘（Hard Disk Drive，缩写：HDD）或固态硬盘（Solid-State Drive，SSD)等；所述存储介质还可以包括上述种类的存储器的组合。
虽然结合附图描述了本发明的实施例，但是本领域技术人员可以在不脱离本发明的精神和范围的情况下做出各种修改和变型，这样的修改和变型均落入由所附权利要求所限定的范围之内。

Claims (10)

  1. 一种透明加密方法，其特征在于，包括：
    获取目标文件的操作请求，所述操作请求中携带有所述目标文件的属性信息；
    基于所述属性信息确定所述操作请求的类型，所述操作请求的类型包括授权操作请求或非授权操作请求；
    根据所述操作请求的类型，将所述操作请求重定向至虚拟磁盘文件***或真实文件***，所述虚拟磁盘文件***用于与真实文件***进行交互，所述虚拟磁盘文件用于缓存解密后的所述目标文件，所述真实文件***用于存储加密后的所述目标文件。
  2. 根据权利要求1所述的方法，其特征在于，所述根据所述操作请求的类型，将所述操作请求重定向至虚拟磁盘文件***或真实文件***，包括：
    当所述操作请求的类型为授权操作请求时，将所述操作请求重定向至所述虚拟磁盘文件***；
    基于所述虚拟磁盘文件***对所述操作请求进行明文处理。
  3. 根据权利要求2所述的方法，其特征在于，所述虚拟磁盘文件***包括虚拟磁盘以及加密文件***，所述虚拟磁盘用于挂载所述加密文件***，所述加密文件***用于从所述真实文件***读取加密后的所述目标文件进行解密。
  4. 根据权利要求3所述的方法，其特征在于，所述基于所述虚拟磁盘文件***对所述目标文件进行明文操作，包括：
    读取所述虚拟磁盘中的影子文件，以获得加密后的所述目标文件在所述真实文件***中的访问路径；
    基于所述访问路径从所述真实文件***中读取加密后的所述目标文件；
    利用加密文件***对加密后的所述目标文件进行解密，并利用所述影子文件对解密结果进行缓存，以对所述目标文件进行明文操作。
  5. 根据权利要求4所述的方法，其特征在于，所述读取所述虚拟磁盘中的影子文件，以获得加密后的所述目标文件在所述真实文件***中的访问路径，包括：
    当获取到所述目标文件的授权打开请求时，在所述虚拟磁盘中创建影子文件；
    在所述影子文件中记录加密后的所述目标文件在所述真实文件***中的访问路径。
  6. 根据权利要求4所述的方法，其特征在于，所述方法还包括：
    当获取到所述目标文件的授权关闭请求时，在所述虚拟磁盘中清除所述影子文件。
  7. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    当所述操作请求为非授权操作请求时，将所述操作请求重定向至所述真实文件***；
    基于所述真实文件***对所述目标文件进行密文操作。
  8. 一种透明加密装置，其特征在于，包括：
    获取模块，用于获取目标文件的操作请求，所述操作请求中携带有所述目标文件的属性信息；
    确定模块，用于基于所述属性信息确定所述操作请求的类型，所述操作请求的类型包括授权操作请求或非授权操作请求；
    重定向模块，用于根据所述操作请求的类型，将所述操作请求重定向至虚拟磁盘文件***或真实文件***，所述虚拟磁盘文件***用于与真实文件***进行交互，所述虚拟磁盘文件用于缓存解密后的所述目标文件，所述真实文件***用于存储加密后的所述目标文件。
  9. 一种电子设备，其特征在于，包括：
    存储器和处理器，所述存储器和所述处理器之间互相通信连接，所述存储器中存储有计算机指令，所述处理器通过执行所述计算机指令，从而执行权利要求1-7中任一项所述的透明加密方法。
  10. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机指令，所述计算机指令用于使计算机执行权利要求1-7中任一项所述的透明加密方法。
PCT/CN2022/141882 2022-07-29 2022-12-26 透明加密方法、装置、电子设备及存储介质 WO2024021496A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210906526.0A CN115455440A (zh) 2022-07-29 2022-07-29 透明加密方法、装置、电子设备及存储介质
CN202210906526.0 2022-07-29

Publications (1)

Publication Number Publication Date
WO2024021496A1 true WO2024021496A1 (zh) 2024-02-01

Family

ID=84296897

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/141882 WO2024021496A1 (zh) 2022-07-29 2022-12-26 透明加密方法、装置、电子设备及存储介质

Country Status (2)

Country Link
CN (1) CN115455440A (zh)
WO (1) WO2024021496A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115455440A (zh) * 2022-07-29 2022-12-09 天翼云科技有限公司 透明加密方法、装置、电子设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104200176A (zh) * 2014-08-28 2014-12-10 电子科技大学 对智能移动终端中文件进行透明加解密的***及方法
CN105760779A (zh) * 2016-02-18 2016-07-13 武汉理工大学 一种基于fuse的双向文件加密***
US20180314838A1 (en) * 2017-04-28 2018-11-01 Dell Products L.P. Access path redirection for encrypted files
CN110569651A (zh) * 2019-08-27 2019-12-13 北京明朝万达科技股份有限公司 基于国产操作***的文件透明加解密方法及***
CN115455440A (zh) * 2022-07-29 2022-12-09 天翼云科技有限公司 透明加密方法、装置、电子设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104200176A (zh) * 2014-08-28 2014-12-10 电子科技大学 对智能移动终端中文件进行透明加解密的***及方法
CN105760779A (zh) * 2016-02-18 2016-07-13 武汉理工大学 一种基于fuse的双向文件加密***
US20180314838A1 (en) * 2017-04-28 2018-11-01 Dell Products L.P. Access path redirection for encrypted files
CN110569651A (zh) * 2019-08-27 2019-12-13 北京明朝万达科技股份有限公司 基于国产操作***的文件透明加解密方法及***
CN115455440A (zh) * 2022-07-29 2022-12-09 天翼云科技有限公司 透明加密方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN115455440A (zh) 2022-12-09

Similar Documents

Publication Publication Date Title
US7437429B2 (en) System and method for providing transparent access to distributed authoring and versioning files including encrypted files
US8874625B2 (en) Method, apparatus and system for accessing remote files
US9251201B2 (en) Compatibly extending offload token size
US10756895B2 (en) Using encryption keys to manage data retention
CN102902914B (zh) 一种实现终端无痕的方法及装置
US20070057048A1 (en) Method and/or system to authorize access to stored data
US8122196B2 (en) System and procedure for rapid decompression and/or decryption of securely stored data
TWI620093B (zh) 用於保全電腦大容量儲存資料的方法和裝置
JP2008016037A (ja) ｉＳＣＳＩのためのデータ加速装置及びこれを用いたｉＳＣＳＩ記憶システム
CN105760779B (zh) 一种基于fuse的双向文件加密***
WO2011137743A1 (zh) 一种文件保护方法及***
US8719923B1 (en) Method and system for managing security operations of a storage server using an authenticated storage module
WO2011150762A1 (zh) 一种文件***的操作方法及一种通信装置
JP2004287476A (ja) ノード装置におけるキャッシュ制御
US20130124852A1 (en) File-based application programming interface providing ssh-secured communication
US8387127B1 (en) Storage security appliance with out-of-band management capabilities
US20060080517A1 (en) Accessing a protected area of a storage device
WO2024021496A1 (zh) 透明加密方法、装置、电子设备及存储介质
WO2007056054A1 (en) Content control systems and methods
US10021217B2 (en) Protocol independent way to selectively restrict write-access for redirected USB mass storage devices
GB2426860A (en) Media player cooperating with external storage
WO2024045407A1 (zh) 虚拟磁盘安全存储方法
CN115758420A (zh) 文件访问控制方法、装置、设备及介质
CN108399341B (zh) 一种基于移动端的Windows双重文件管控***
CN114611123A (zh) 一种文件透明加解密方法和***

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22952925

Country of ref document: EP

Kind code of ref document: A1