WO2016202089A1 - 一种远端存储设备的数据加密方法、装置及系统 - Google Patents

一种远端存储设备的数据加密方法、装置及系统 Download PDF

Info

Publication number
WO2016202089A1
WO2016202089A1 PCT/CN2016/079925 CN2016079925W WO2016202089A1 WO 2016202089 A1 WO2016202089 A1 WO 2016202089A1 CN 2016079925 W CN2016079925 W CN 2016079925W WO 2016202089 A1 WO2016202089 A1 WO 2016202089A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
encryption
storage device
module
remote storage
Prior art date
Application number
PCT/CN2016/079925
Other languages
English (en)
French (fr)
Inventor
唐可心
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016202089A1 publication Critical patent/WO2016202089A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to, but is not limited to, the field of information security in information technology, and in particular, to a data encryption method, device and system for a remote storage device.
  • Storage gateway refers to the use of devices such as servers to implement protocol conversion between different storages in order to achieve access to multiple brands and types of storage.
  • the main function of the storage gateway is to support the protocol requirements of different network storage devices and to manage all storage devices in a unified manner.
  • storage systems evolve from local direct connections to networked and distributed, and are shared by many computers on the network, storage systems become more vulnerable, and storage security incidents such as data theft, tampering, or corruption are increasing. And the known leak data is only the tip of the iceberg.
  • the current trusted storage gateway encryption technology generally adopts a file system encryption method, that is, encrypts and decrypts data at the file system layer of the operating system.
  • the basic principle is based on the driver layered architecture, adding a layer of filtering driver layer to complete data encryption and decryption, and encrypting and decrypting data in real time during the application reading and writing process.
  • the file system-based encryption method does not have a password, and the file content seen is a bunch of garbled characters.
  • the file system-based encryption method can largely protect the data.
  • the data stored in the traditional plaintext mode on the storage device is stored in cipher text mode.
  • the current storage system security incidents are gradually rising. If the disk is taken by a hacker or the disk itself has a backdoor, the file partition can be analyzed and the file system super block (the super block containing the control information part of the file volume) can be obtained to obtain the file.
  • the metadata of the system because the file system itself is not encrypted, so the hacker may analyze a series of information such as file name, attribute, modification time, etc., which leads to a security risk of the storage gateway based on file system encryption.
  • the present invention provides a data encryption method, device and system for a remote storage device, which solves the problem that the storage gateway encrypts and decrypts the data of the remote storage device using the system file in the related art.
  • a data encryption method for a remote storage device includes:
  • the storage gateway acquires unencrypted data stored in the remote storage device
  • the storage gateway blocks the unencrypted data to obtain at least two data blocks
  • the storage gateway encrypts at least one of the at least two data blocks according to a preset encryption rule
  • the storage gateway sends the encrypted data to the remote storage device for storage.
  • the storage gateway storing, by the storage gateway, encrypting at least one of the at least two data blocks according to a preset encryption rule, where the storage gateway is configured in the at least two data blocks according to a preset encryption rule. All data blocks are encrypted.
  • the storing, by the storage gateway, the unencrypted data is divided into blocks: the storage gateway averages or blocks the unencrypted data according to a preset number of blocks; or the storage gateway is configured according to The data block size is set to block the unencrypted data.
  • the hardware encryption manner includes: the storage gateway encrypts all the data blocks by using a trusted password module TCM module;
  • the software encryption method includes: the storage gateway encrypts all the data blocks by using at least one of a 3DES algorithm, an AES algorithm, an SM1 algorithm, an SM2 algorithm, an SM3 algorithm, and an SM4 algorithm;
  • the hybrid encryption method includes: the storage gateway uses a hardware device to save a key, and encrypts all the data blocks by using a software encryption manner.
  • the storing, by the storage gateway, all the data blocks in the at least two data blocks according to the preset encryption rule further includes: the storage gateway encrypting the entire data block by using different encryption methods.
  • a data encryption device for a remote storage device comprising:
  • a data acquisition module configured to acquire, by the storage gateway, unencrypted data stored in the remote storage device
  • a data blocking module configured to block the unencrypted data to obtain at least two data blocks
  • a data encryption module configured to encrypt at least one of the at least two data blocks according to a preset encryption rule
  • the data sending module is configured to send the encrypted data to the remote storage device for storage.
  • the encrypting, by the data encryption module, the at least one of the at least two data blocks according to the preset encryption rule comprises: encrypting all the data blocks according to a preset encryption rule.
  • the data blocking module includes: a first blocking submodule and/or a second blocking submodule;
  • the first blocking sub-module is configured to average block or randomly block the unencrypted data according to a preset number of blocks
  • the second blocking submodule is configured to block the unencrypted data according to a preset data block size.
  • the data encryption module includes: a hardware encryption submodule, a software encryption submodule, and a hybrid encryption submodule;
  • the hardware encryption submodule is configured to encrypt all the data blocks according to a hardware encryption manner
  • the software encryption submodule is configured to encrypt all the data blocks according to a software encryption manner
  • the hybrid encryption submodule is configured to encrypt the entire data block according to a hybrid encryption mode.
  • the hardware encryption manner includes: encrypting all the data blocks by using a trusted password module TCM module;
  • the software encryption method includes: encrypting all the data blocks by using at least one of a 3DES algorithm, an AES algorithm, an SM1 algorithm, an SM2 algorithm, an SM3 algorithm, and an SM4 algorithm;
  • the hybrid encryption method includes: using a hardware device to save a key, and encrypting all the data blocks by using a software encryption manner.
  • a data encryption system of a remote storage device comprising a storage gateway and a remote storage device, the storage gateway comprising the data encryption device of the remote storage device according to any of the above embodiments;
  • the remote storage device includes a communication module and a storage module, the communication module being configured to transmit unencrypted data and receive the encrypted data;
  • the storage module is configured to store the received encrypted data.
  • a computer readable storage medium storing computer executable instructions that, when executed by a processor, implement the data encryption method of the remote storage device described above.
  • the solution of the embodiment of the present invention encrypts the unencrypted user data that needs to be stored in the storage device by using the block-based data encryption mode, thereby avoiding the defects of the current data encryption method based on the file system encryption, and effectively improving the security performance of the storage gateway.
  • FIG. 1 is a schematic flowchart of a data encryption method of a remote storage device according to Embodiment 1 of the present invention
  • FIG. 2 is a schematic flowchart of a method for encrypting data of a remote storage device by using a TCM module (hardware encryption mode) in a storage gateway according to Embodiment 1 of the present invention
  • FIG. 3 is a schematic flowchart of a method for encrypting data of a remote storage device by using an SM2 encryption method by software in a storage gateway according to Embodiment 1 of the present invention
  • FIG. 4 is a schematic flowchart of a method for encrypting data of a remote storage device by using a hybrid encryption method in a storage gateway according to Embodiment 1 of the present invention
  • FIG. 5 is a schematic structural diagram of a data encryption apparatus of a remote storage device according to Embodiment 2 of the present invention.
  • Embodiments of the present invention will be described below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.
  • Embodiment 1
  • a data encryption method for a remote storage device includes step S101.
  • the storage gateway acquires unencrypted data stored in the remote storage device.
  • the storage gateway Before receiving the unencrypted data in the remote storage device, the storage gateway needs to send an unencrypted data read request to the remote storage device for requesting the remote storage device to send the stored unencrypted data to the storage gateway; for example, The storage gateway can receive unencrypted data in the remote storage device by means of a FC SAN (a Fibre Channel storage area network) or an IP SAN (a storage area network using an iSCSI protocol).
  • FC SAN Fibre Channel storage area network
  • IP SAN a storage area network using an iSCSI protocol
  • the storage gateway blocks the unencrypted data to obtain at least two data blocks; the partitioning of the block size may be a random split, a fixed-size block, or a partitioning manner of other block sizes.
  • the storage gateway encrypts at least one of the at least two data blocks according to a preset encryption rule; that is, performs block-based encryption on the at least one data block; in the block-based encryption mode, only Encryption is performed in at least one data block, and may be performed by using the same key for all data blocks that need to be encrypted, or by encrypting all data blocks that need to be encrypted without using the same key.
  • the storage gateway sends the encrypted data to the remote storage device for storage. Similarly, the storage gateway can send the encrypted data to the remote storage device for storage by means of the FC SAN or the IP SAN.
  • step S103 the storing, by the storage gateway, encrypting at least one of the at least two data blocks according to a preset encryption rule, where the storage gateway performs the at least two according to a preset encryption rule. All data blocks in the data block are encrypted.
  • step S102 the storing, by the storage gateway, the unencrypted data is divided into blocks: the storage gateway averages or blocks the unencrypted data according to a preset number of blocks; for example, storing The gateway divides the data block into 10 blocks evenly, or the storage gateway randomly divides the data block into 10 blocks, etc.;
  • the storing, by the storage gateway, the unencrypted data further includes: the storage gateway is configured to block the unencrypted data according to a preset data block size; for example, the storage gateway first receives all the received data.
  • the obtained data is randomly divided into m data blocks of size 1-8 bytes in order, and the m is a positive integer; for example, in the embodiment, the size of the data block is a data block size fixed to 4 bytes in length. Blocking; in other embodiments, the size of the data block can be incremented by 1-8 bytes Dividing the data block in a decrementing manner until the encrypted data is divided into blocks;
  • the hardware encryption manner includes: the storage gateway encrypts all data blocks by using a trusted password module TCM module.
  • the software encryption method includes: the storage gateway performs encryption by using at least one of a 3DES algorithm, an AES algorithm, an SM1 algorithm, an SM2 algorithm, an SM3 algorithm, and an SM4 algorithm.
  • the hybrid encryption method includes: the storage gateway uses a hardware device to save a key, and uses a software encryption method to encrypt the data block.
  • the storing, by the storage gateway, encrypting all the data blocks in the at least two data blocks according to the preset encryption rule further comprising: using, by the storage gateway, different uses for the multiple data blocks in the all data blocks Encryption is used for encryption.
  • the following describes the method for encrypting a data block by using a hardware encryption method, a software encryption method, and a hybrid encryption method.
  • the TCM module hardware encryption method
  • the method for encrypting data of the end storage device includes steps S201 to S204:
  • the storage gateway reads the unencrypted data in the remote storage device by using SCSI.
  • S202 The storage gateway divides the received unencrypted data into data blocks of fixed length.
  • the size of the block in this embodiment is a data block size fixed to 4 bytes in length: the TCM module first divides all received data into m data blocks of size 4 bytes in order.
  • S203 The storage gateway performs block-based encryption on all m data blocks through the TCM module.
  • the m data blocks in this embodiment use the same key for data encryption.
  • S204 The storage gateway sends the encrypted data to the remote storage device for storage.
  • the storage gateway sends the encrypted data to the remote storage device for storage by using a (FCSAN or IPSAN) SCSI command mode.
  • the method for encrypting data of the remote storage device by using the software in the storage gateway to run the SM2 encryption mode in the embodiment includes steps S301-S304:
  • S301 The storage gateway reads the unencrypted data in the remote storage device by using SCSI.
  • S302 The storage gateway randomly divides the received unencrypted data into data blocks whose length is not fixed.
  • the size of the block in this embodiment is a data block size whose length is not fixed: the storage gateway first randomly divides all received data into m data blocks of size 1-8 bytes in order.
  • S303 The storage gateway runs the SM2 encryption algorithm through the encryption software, and performs block-based encryption on the received unencrypted data.
  • the m data blocks in this embodiment use different keys for data encryption.
  • the storage gateway sends the encrypted data to a remote storage device for storage.
  • the storage gateway sends the encrypted data to the remote storage device for storage by using a (FCSAN or IPSAN) SCSI command mode.
  • the method for encrypting data of the remote storage device by using the hybrid encryption method includes steps S401 to S404:
  • S401 The storage gateway reads the unencrypted data in the remote storage device by using SCSI.
  • S402 The storage gateway randomly divides the received unencrypted data into data blocks whose length is not fixed.
  • the size of the block in this embodiment is a data block size whose length is not fixed: the storage gateway first randomly divides all received data into m data blocks of size 1-8 bytes in order.
  • the storage gateway saves the key through the TPM chip, and runs the SM3 encryption algorithm through the software to perform block-based encryption on the received unencrypted data.
  • the m data blocks in this embodiment use the same key for data encryption.
  • S404 The storage gateway sends the encrypted data to the remote storage device for storage.
  • the storage gateway sends the encrypted data to the remote storage device for storage by using a (FCSAN or IPSAN) SCSI command mode.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • the data encryption device 50 of the remote storage device includes: a data acquisition module 501, a data blocking module 502, a data encryption module 503, and a data sending module 504;
  • the data obtaining module 501 is configured to acquire unencrypted data stored in the remote storage device.
  • the data blocking module 502 is configured to block the unencrypted data to obtain at least two data blocks.
  • the data encryption module 503 is configured to encrypt at least one of the at least two data blocks according to a preset encryption rule.
  • the encrypting, by the data encryption module 503, the at least one data block of the at least two data blocks according to the preset encryption rule including: selecting all data in the at least two data blocks according to a preset encryption rule.
  • the block is encrypted.
  • the data sending module 504 is configured to send the encrypted data to the remote storage device for storage.
  • the data blocking module 502 includes: a first blocking submodule and/or a second blocking submodule;
  • the first blocking sub-module is configured to average block or randomly block the unencrypted data according to a preset number of blocks.
  • the second blocking submodule is configured to block the unencrypted data according to a preset data block size.
  • the data encryption module 503 includes: a hardware encryption sub-module, a software encryption sub-module, and a hybrid encryption sub-module.
  • the hardware encryption submodule is configured to encrypt all the data blocks according to a hardware encryption manner.
  • the software encryption sub-module is configured to encrypt all the data blocks according to a software encryption manner.
  • the hybrid encryption submodule is configured to encrypt all of the data blocks according to a hybrid encryption method.
  • the hardware encryption method includes: encrypting all data blocks by using a TCM module.
  • the software encryption method includes: encrypting by using at least one of a 3DES algorithm, an AES algorithm, an SM1 algorithm, an SM2 algorithm, an SM3 algorithm, and an SM4 algorithm.
  • the hybrid encryption method includes: using a hardware device to save a key, and encrypting the data block by using a software encryption method.
  • a data encryption system for a remote storage device including a storage gateway and a remote storage device.
  • the storage gateway includes the data encryption device of the remote storage device as described in any of the above embodiments. Set.
  • the remote storage device includes a communication module configured to transmit unencrypted data and receive encrypted data, and a storage module configured to store the received encrypted data.
  • the embodiment of the present invention provides a data encryption method, device, and system for a remote storage device.
  • the method includes: acquiring, by a storage gateway, unencrypted data that needs to be stored in the remote storage device, and dividing the block Then, the block-based data is subjected to block-based encryption, and finally the encrypted data is sent to the remote storage device for storage.
  • the solution of the embodiment of the present invention encrypts the unencrypted user data that needs to be stored in the storage device by using the block-based data encryption mode, thereby avoiding the defects of the current data encryption method based on the file system encryption, and effectively improving the security performance of the storage gateway.
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.
  • the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
  • the device/function module/functional unit in the above embodiment When the device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • the solution of the embodiment of the present invention encrypts the unencrypted user data that needs to be stored in the storage device by using the block-based data encryption mode, thereby avoiding the defects of the current data encryption method based on the file system encryption, and effectively improving the security performance of the storage gateway.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

一种远端存储设备的数据加密方法、装置及系统，该方法包括：存储网关获取存储在所述远端存储设备的未加密数据；所述存储网关将所述未加密数据进行分块，得到至少两个数据块；所述存储网关根据预设加密规则对至少一个数据块进行加密；所述存储网关将加密后的数据发送给所述远端存储设备进行存储。

Description

一种远端存储设备的数据加密方法、装置及系统 技术领域
本申请涉及但不限于信息技术中的信息安全领域，尤其是一种远端存储设备的数据加密方法、装置及系统。
背景技术
存储网关指利用服务器等设备实现不同存储之间的协议转换，以便实现对多个品牌、类型的存储的访问。存储网关的主要功能是支持不同网络存储设备的协议要求，并将所有的存储设备进行统一的管理。随着存储系统由本地直连向着网络化和分布式的方向发展，并被网络上的众多计算机共享，使存储系统变得更易受攻击，数据被窃取、篡改或破坏等存储安全事件日趋增长，且已知的泄密数据仅为冰山一角。
为增强数据存储的安全性和存储网关的可靠性，满足用户不断增长的信息安全需求，存储加密技术应运而生。在可信存储安全体系中，利用技术手段把文件变为乱码(加密)存储，在使用文件的时候，用相同或不同的手段还原(解密)。当前的可信存储网关加密技术普遍采用基于文件系统加密的方式，即在操作系统的文件系统层对数据进行加密、解密操作。其基本原理是基于驱动分层架构，增加一层完成数据加密、解密的过滤驱动层，在应用程序读写过程实时对数据进行加解密。基于文件系统的加密方式在没有密码情况下，看到的文件内容是一堆乱码，对于安全性等级要求一般的存储系统来说，这种基于文件系统的加密方式可以很大程度上保护数据，将传统的明文方式存放在存储设备中的数据变成密文方式存放。然而当前存储系统安全事件逐渐上升，如果磁盘被黑客拿到或者磁盘本身带有后门，可以通过分析磁盘分区、解析文件系统super block(超级块，其中包含文件卷的控制信息部分)，进而获取文件系统的元数据，因为文件系统本身是没有加密的，这样黑客可能分析文件名称、属性、修改时间等一系列信息，这就导致了基于文件系统加密的存储网关依然有安全隐患。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本文提供了一种远端存储设备的数据加密方法、装置及系统，解决了相关技术中存储网关对远端存储设备的数据使用系统文件的方式进行加密容易被解密的问题。
一种远端存储设备的数据加密方法，包括：
存储网关获取存储在所述远端存储设备的未加密数据；
所述存储网关将所述未加密数据进行分块，得到至少两个数据块；
所述存储网关根据预设加密规则对所述至少两个数据块中的至少一个数据块进行加密；
所述存储网关将加密后的数据发送给所述远端存储设备进行存储。
可选地，所述存储网关根据预设加密规则对所述至少两个数据块中的至少一个数据块进行加密包括：所述存储网关根据预设加密规则对所述至少两个数据块中的全部数据块进行加密。
可选地，所述存储网关将所述未加密数据进行分块包括：所述存储网关根据预设块数对所述未加密数据平均分块或随机分块；或者，所述存储网关根据预设数据块大小对所述未加密数据进行分块。
可选地，所述存储网关根据预设加密规则对所述至少两个数据块中的全部数据块进行加密包括：所述存储网关对所述全部数据块根据硬件加密方式、软件加密方式和混合加密方式中的至少一种方式进行加密。
可选地，所述硬件加密方式包括：所述存储网关通过可信密码模块TCM模块对所述全部数据块进行加密；
所述软件加密方式包括：所述存储网关通过3DES算法、AES算法、SM1算法、SM2算法、SM3算法及SM4算法中的至少一种算法对所述全部数据块进行加密；
所述混合加密方式包括：所述存储网关采用硬件设备保存密钥，采用软件加密方式对所述全部数据块进行加密。
可选地，所述存储网关根据预设加密规则对所述至少两个数据块中的全部数据块进行加密还包括：所述存储网关对所述全部数据块使用不同的加密方式进行加密。
一种远端存储设备的数据加密装置，包括：
数据获取模块，设置为存储网关获取存储在所述远端存储设备的未加密数据；
数据分块模块，设置为将所述未加密数据进行分块，得到至少两个数据块；
数据加密模块，设置为根据预设加密规则对所述至少两个数据块中的至少一个数据块进行加密；
数据发送模块，设置为将加密后的数据发送给所述远端存储设备进行存储。
可选地，所述数据加密模块根据预设加密规则对所述至少两个数据块中的至少一个数据块进行加密包括：根据预设加密规则对全部数据块进行加密。
可选地，所述数据分块模块包括：第一分块子模块和/或第二分块子模块；
所述第一分块子模块，设置为根据预设块数对所述未加密数据平均分块或随机分块；
所述第二分块子模块，设置为根据预设数据块大小对所述未加密数据进行分块。
可选地，所述数据加密模块包括：硬件加密子模块、软件加密子模块和混合加密子模块；
所述硬件加密子模块，设置为对所述全部数据块根据硬件加密方式进行加密；
所述软件加密子模块，设置为对所述全部数据块根据软件加密方式进行加密；
所述混合加密子模块，设置为对所述全部数据块根据混合加密方式进行加密。
可选地，所述硬件加密方式包括：通过可信密码模块TCM模块对所述全部数据块进行加密；
所述软件加密方式包括：通过3DES算法、AES算法、SM1算法、SM2算法、SM3算法及SM4算法中的至少一种算法对所述全部数据块进行加密；
所述混合加密方式包括：采用硬件设备保存密钥，采用软件加密方式对所述全部数据块进行加密。
可选地，所述数据加密模块根据预设加密规则对所述至少两个数据块中的全部数据块进行加密包括：所述存储网关对所述全部数据块使用不同的加密方式进行加密。
一种远端存储设备的数据加密系统，包括存储网关及远端存储设备，所述存储网关包括如上述任一实施例所述的远端存储设备的数据加密装置；所述远端存储设备包括通信模块及存储模块，所述通信模块设置为对未加密数据进行发送，并接收加密后的数据；所述存储模块设置为将接收到的加密后的数据进行存储。
一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被处理器执行时实现上述的远端存储设备的数据加密方法。
本发明实施例方案通过基于块的数据加密方式，对需要存入存储设备的未加密用户数据进行加密，避免了当前基于文件系统加密的数据加密方式的缺陷，有效地提高存储网关的安全性能。
附图概述
图1本发明实施例一提供的远端存储设备的数据加密方法的流程示意图；
图2本发明实施例一提供的通过存储网关中的TCM模块(硬件加密方式)加密方式对远端存储设备的数据加密的方法流程示意图；
图3为本发明实施例一提供的通过存储网关中的软件运行SM2加密方式对远端存储设备的数据加密的方法流程示意图；
图4为本发明实施例一提供的通过存储网关中的混合加密方式对远端存储设备的数据加密的方法流程示意图；
图5为本发明实施例二提供的远端存储设备的数据加密装置的结构示意图。
本发明的实施方式
下面结合附图对本发明的实施方式进行描述。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。实施例一：
请参考图1所示，一种远端存储设备的数据加密方法包括步骤S101～ S104：
S101：存储网关获取存储在所述远端存储设备的未加密数据；
存储网关在接收远端存储设备中的未加密数据前，需要先发送未加密数据读取请求给远端存储设备，用于请求远端存储设备将其存储的未加密数据发送给存储网关；例如，所述存储网关可以通过FC SAN(采用光纤通道的存储局域网络)或者IP SAN(采用iSCSI协议的存储局域网络)的方式接收远端存储设备中的未加密数据。
S102：存储网关将所述未加密数据进行分块，得到至少两个数据块；块大小的划分可以是随机分割，也可以是固定大小的块，或者其他块大小的划分方式。
S103：存储网关根据预设加密规则对所述至少两个数据块中的至少一个数据块进行加密；即对至少一个数据块进行基于块的加密；所述基于块的加密方式中，只需要在至少一个数据块中进行加密，可以是对需要加密的所有数据块使用相同的密钥进行加密，也可以是对需要加密的所有数据块不使用相同的密钥进行加密。
S104：存储网关将加密后的数据发送给所述远端存储设备进行存储。同样地，所述存储网关可以通过FC SAN或者IP SAN的方式，将加密后的数据发送给远端存储设备进行存储。
可选地，在步骤S103中，所述存储网关按照预设加密规则对所述至少两个数据块中的至少一个数据块进行加密包括：所述存储网关根据预设加密规则对所述至少两个数据块中的全部数据块进行加密。
可选地，在步骤S102中，所述存储网关将所述未加密数据进行分块包括：所述存储网关根据预设块数对所述未加密数据平均分块或随机分块；如，存储网关将数据块平均分成10块，或者所述存储网关将数据块随机分成10块等；
可选地，所述存储网关将所述未加密数据进行分块还包括：所述存储网关根据预设数据块大小对所述未加密数据进行分块；如，所述存储网关先将所有接收到的数据按照顺序随机分成m个大小为1-8字节的数据块，所述m为正整数；如，在本实施例中数据块的大小是采用长度固定为4字节的数据块大小进行分块；在另一些实施例中，数据块的大小可以按照1-8字节递增 再递减的方式对数据块进行分块，直到将加密数据分块完成；
可选地，所述存储网关根据预设加密规则对所述至少两个数据块中的全部数据块进行加密包括：所述存储网关对所述全部数据块根据硬件加密方式、软件加密方式和混合加密方式中的至少一种方式进行加密；
可选地，所述硬件加密方式包括：所述存储网关通过可信密码模块TCM模块对全部数据块进行加密。
所述软件加密方式包括：所述存储网关通过3DES算法、AES算法、SM1算法、SM2算法、SM3算法及SM4算法中的至少一种算法进行加密。
所述混合加密方式包括：所述存储网关采用硬件设备保存密钥，采用软件加密方式对数据块进行加密。
可选地，所述存储网关根据预设加密规则对所述至少两个数据块中的全部数据块进行加密还包括：所述存储网关对所述全部数据块中的多个数据块使用不同的加密方式进行加密。
下面分别从使用硬件加密方式、软件加密方式及混合加密方式对数据块进行加密的方法进行说明，如图2所示，本实施例通过存储网关中的TCM模块(硬件加密方式)加密方式对远端存储设备的数据加密的方法包括步骤S201～S204：
S201：存储网关通过SCSI的方式读取远端存储设备中的未加密数据.
S202：存储网关将接收到的未加密数据分成长度固定的数据块。
可选地，本实施例中块的大小是采用长度固定为4字节的数据块大小：所述TCM模块先将所有接收到的数据按照顺序，分成m个大小为4字节的数据块。
S203：存储网关通过TCM模块，对全部m个数据块进行基于块的加密。
可选地，本实施例中的m个数据块采用相同的密钥进行数据加密。
S204：存储网关将加密后的数据发送给远端存储设备进行存储。
可选地，所述存储网关通过(FCSAN或者IPSAN)SCSI命令方式，将加密过的数据发送给远端存储设备进行存储。
如图3所示，本实施例通过存储网关中的软件运行SM2加密方式对远端存储设备的数据加密的方法包括步骤S301～S304：
S301：存储网关通过SCSI的方式读取远端存储设备中的未加密数据。
S302：存储网关将接收到的未加密数据随机分成长度不固定的数据块。
可选地，本实施例中块的大小是采用长度不固定的数据块大小：所述存储网关先将所有接收到的数据按照顺序，随机分成m个大小为1-8字节的数据块。
S303：存储网关通过加密软件运行SM2加密算法，对接收到的未加密数据进行基于块的加密。
可选地，本实施例中的m个数据块采用不同的密钥进行数据加密。
S304：所述存储网关将加密后的数据发送给远端存储设备进行存储。
可选地，所述存储网关通过(FCSAN或者IPSAN)SCSI命令方式，将加密过的数据发送给远端存储设备进行存储。
如图4所示，本实施例通过混合加密方式对远端存储设备的数据加密的方法包括步骤S401～S404：
S401：存储网关通过SCSI的方式读取远端存储设备中的未加密数据。
S402：存储网关将接收到的未加密数据随机分成长度不固定的数据块。
可选地，本实施例中块的大小是采用长度不固定的数据块大小：所述存储网关先将所有接收到的数据按照顺序，随机分成m个大小为1-8字节的数据块。
S403：存储网关通过TPM芯片保存密钥，通过软件运行SM3加密算法，对接收到的未加密数据进行基于块的加密；
可选地，本实施例中的m个数据块采用相同的密钥进行数据加密。
S404：存储网关将加密后的数据发送给远端存储设备进行存储。
可选地，所述存储网关通过(FCSAN或者IPSAN)SCSI命令方式，将加密过的数据发送给远端存储设备进行存储。
实施例二：
请参考图5所示，本实施例提供的远端存储设备的数据加密装置50包括：数据获取模块501、数据分块模块502、数据加密模块503和数据发送模块504；
所述数据获取模块501，设置为获取存储在所述远端存储设备的未加密数据。
所述数据分块模块502，设置为将所述未加密数据进行分块，得到至少两个数据块。
所述数据加密模块503，设置为根据预设加密规则对所述至少两个数据块中的至少一个数据块进行加密。
可选地，所述数据加密模块503根据预设加密规则对所述至少两个数据块中的至少一个数据块进行加密包括：根据预设加密规则对所述至少两个数据块中的全部数据块进行加密。
所述数据发送模块504，设置为将加密后的数据发送给所述远端存储设备进行存储。
可选地，所述数据分块模块502包括：第一分块子模块和/或第二分块子模块；
所述第一分块子模块，设置为根据预设块数对所述未加密数据平均分块或随机分块。
所述第二分块子模块，设置为根据预设数据块大小对所述未加密数据进行分块。
所述数据加密模块503包括：硬件加密子模块、软件加密子模块和混合加密子模块。
硬件加密子模块，设置为对所述全部数据块根据硬件加密方式进行加密。
软件加密子模块，设置为对所述全部数据块根据软件加密方式进行加密。
混合加密子模块，设置为对所述全部数据块根据混合加密方式进行加密。
所述硬件加密方式包括：通过TCM模块对全部数据块进行加密。
所述软件加密方式包括：通过3DES算法、AES算法、SM1算法、SM2算法、SM3算法及SM4算法中的至少一种算法进行加密。
所述混合加密方式包括：采用硬件设备保存密钥，采用软件加密方式对数据块进行加密。
所述数据加密模块503根据预设加密规则对所述至少两个数据块中的全部数据块进行加密包括：所述存储网关对所述全部数据块使用不同的加密方式进行加密。
一种远端存储设备的数据加密系统，包括存储网关及远端存储设备。
所述存储网关包括如上述任一实施例所述的远端存储设备的数据加密装 置。
所述远端存储设备包括通信模块及存储模块，所述通信模块设置为对未加密数据进行发送，并接收加密后的数据；所述存储模块设置为将接收到的加密后的数据进行存储。
本发明实施例方案提了一种远端存储设备的数据加密方法、装置及系统，该方法包括：通过存储网关获取需要存储在所述远端存储设备的未加密数据，并对其进行分块，再将分块后的数据进行基于块的加密，最后将加密后的数据发送给远端存储设备进行存储。本发明实施例方案通过基于块的数据加密方式，对需要存入存储设备的未加密用户数据进行加密，避免了当前基于文件系统加密的数据加密方式的缺陷，有效地提高存储网关的安全性能。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。
上述实施例中的装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
工业实用性
本发明实施例方案通过基于块的数据加密方式，对需要存入存储设备的未加密用户数据进行加密，避免了当前基于文件系统加密的数据加密方式的缺陷，有效地提高存储网关的安全性能。

Claims (14)

  1. 一种远端存储设备的数据加密方法，包括：
    存储网关获取存储在所述远端存储设备的未加密数据；
    所述存储网关将所述未加密数据进行分块，得到至少两个数据块；
    所述存储网关根据预设加密规则对所述至少两个数据块中的至少一个数据块进行加密；
    所述存储网关将加密后的数据发送给所述远端存储设备进行存储。
  2. 如权利要求1所述的远端存储设备的数据加密方法，其中，所述存储网关根据预设加密规则对所述至少两个数据块中的至少一个数据块进行加密包括：所述存储网关根据预设加密规则对所述至少两个数据块中的全部数据块进行加密。
  3. 如权利要求2所述的远端存储设备的数据加密方法，其中，所述存储网关将所述未加密数据进行分块包括：所述存储网关根据预设块数对所述未加密数据进行平均分块或随机分块；或者，所述存储网关根据预设数据块大小对所述未加密数据进行分块。
  4. 如权利要求2所述的远端存储设备的数据加密方法，其中，所述存储网关根据预设加密规则对所述至少两个数据块中的全部数据块进行加密包括：所述存储网关对所述全部数据块根据硬件加密方式、软件加密方式和混合加密方式中的至少一种方式进行加密。
  5. 如权利要求4所述的远端存储设备的数据加密方法，其中，
    所述硬件加密方式包括：所述存储网关通过可信密码模块TCM模块对所述全部数据块进行加密；
    所述软件加密方式包括：所述存储网关通过3DES算法、AES算法、SM1算法、SM2算法、SM3算法及SM4算法中的至少一种算法对所述全部数据块进行加密；
    所述混合加密方式包括：所述存储网关采用硬件设备保存密钥，采用软件加密方式对所述全部数据块进行加密。
  6. 如权利要求2-5任一项所述的远端存储设备的数据加密方法，所述存储网关根据预设加密规则对所述至少两个数据块中的全部数据块进行加密还包括：所述存储网关对所述全部数据块使用不同的加密方式进行加密。
  7. 一种远端存储设备的数据加密装置，包括：
    数据获取模块，设置为获取存储在所述远端存储设备的未加密数据；
    数据分块模块，设置为将所述未加密数据进行分块，得到至少两个数据块；
    数据加密模块，设置为根据预设加密规则对所述至少两个数据块中的至少一个数据块进行加密；
    数据发送模块，设置为将加密后的数据发送给所述远端存储设备进行存储。
  8. 如权利要求7所述的远端存储设备的数据加密装置，其中，所述数据加密模块根据预设加密规则对所述至少两个数据块中的至少一个数据块进行加密包括：根据预设加密规则对所述至少两个数据块中的全部数据块进行加密。
  9. 如权利要求8所述的远端存储设备的数据加密装置，其中，所述数据分块模块包括：第一分块子模块和/或第二分块子模块；
    所述第一分块子模块，设置为根据预设块数对所述未加密数据平均分块或随机分块；
    所述第二分块子模块，设置为根据预设数据块大小对所述未加密数据进行分块。
  10. 如权利要求8所述的远端存储设备的数据加密装置，其中，所述数据加密模块包括：硬件加密子模块、软件加密子模块和混合加密子模块；
    所述硬件加密子模块，设置为对所述全部数据块根据硬件加密方式进行加密；
    所述软件加密子模块，设置为对所述全部数据块根据软件加密方式进行加密；
    所述混合加密子模块，设置为对所述全部数据块根据混合加密方式进行加密。
  11. 如权利要求10所述的远端存储设备的数据加密装置，其中，
    所述硬件加密方式包括：通过可信密码模块TCM模块对所述全部数据块进行加密；
    所述软件加密方式包括：通过3DES算法、AES算法、SM1算法、SM2 算法、SM3算法及SM4算法中的至少一种算法对所述全部数据块进行加密；
    所述混合加密方式包括：采用硬件设备保存密钥，采用软件加密方式对所述全部数据块进行加密。
  12. 如权利要求8-11任一项所述的远端存储设备的数据加密装置，其中，所述数据加密模块根据预设加密规则对所述至少两个数据块中的全部数据块进行加密包括：所述存储网关对所述全部数据块使用不同的加密方式进行加密。
  13. 一种远端存储设备的数据加密系统，包括存储网关及远端存储设备，所述存储网关包括如权利要求7-12任一项所述的远端存储设备的数据加密装置；所述远端存储设备包括通信模块及存储模块，所述通信模块设置为对未加密数据进行发送，并接收加密后的数据；所述存储模块设置为将接收到的加密后的数据进行存储。
  14. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被处理器执行时实现权利要求1至6任一项所述的远端存储设备的数据加密方法。
PCT/CN2016/079925 2015-06-19 2016-04-21 一种远端存储设备的数据加密方法、装置及系统 WO2016202089A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510345436.9A CN106257858A (zh) 2015-06-19 2015-06-19 一种远端存储设备的数据加密方法、装置及系统
CN201510345436.9 2015-06-19

Publications (1)

Publication Number Publication Date
WO2016202089A1 true WO2016202089A1 (zh) 2016-12-22

Family

ID=57544962

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/079925 WO2016202089A1 (zh) 2015-06-19 2016-04-21 一种远端存储设备的数据加密方法、装置及系统

Country Status (2)

Country Link
CN (1) CN106257858A (zh)
WO (1) WO2016202089A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113225297A (zh) * 2020-01-21 2021-08-06 北京国双科技有限公司 数据混合加密方法、装置及设备

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108429736A (zh) * 2018-02-11 2018-08-21 众算（上海）数据科技有限公司 一种数据解密方法
CN108429735A (zh) * 2018-02-11 2018-08-21 众算（上海）数据科技有限公司 一种数据加密方法
CN110311771B (zh) * 2018-03-20 2022-07-22 北京小米松果电子有限公司 Sm4加解密方法及电路

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7460672B2 (en) * 2003-07-18 2008-12-02 Sanrad, Ltd. Method for securing data storage in a storage area network
CN102088491A (zh) * 2011-02-01 2011-06-08 西安建筑科技大学 一种面向分散式的云存储安全架构及其数据存取方法
CN103414704A (zh) * 2013-07-29 2013-11-27 相韶华 一种通用虚拟数据加密存储系统
CN103916477A (zh) * 2014-04-09 2014-07-09 曙光云计算技术有限公司 用于云环境的数据存储方法和装置、及下载方法和装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101808095B (zh) * 2010-03-22 2012-08-15 华中科技大学 一种分布式存储环境下的加密副本组织方法
CN103259762B (zh) * 2012-02-16 2016-09-28 中兴通讯股份有限公司 一种基于云存储的文件加密、解密方法及系统
US8990589B1 (en) * 2014-09-18 2015-03-24 Kaspersky Lab Zao System and method for robust full-drive encryption

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7460672B2 (en) * 2003-07-18 2008-12-02 Sanrad, Ltd. Method for securing data storage in a storage area network
CN102088491A (zh) * 2011-02-01 2011-06-08 西安建筑科技大学 一种面向分散式的云存储安全架构及其数据存取方法
CN103414704A (zh) * 2013-07-29 2013-11-27 相韶华 一种通用虚拟数据加密存储系统
CN103916477A (zh) * 2014-04-09 2014-07-09 曙光云计算技术有限公司 用于云环境的数据存储方法和装置、及下载方法和装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113225297A (zh) * 2020-01-21 2021-08-06 北京国双科技有限公司 数据混合加密方法、装置及设备

Also Published As

Publication number Publication date
CN106257858A (zh) 2016-12-28

Similar Documents

Publication Publication Date Title
US11108753B2 (en) Securing files using per-file key encryption
US9430659B2 (en) Locating cryptographic keys stored in a cache
Kaaniche et al. A secure client side deduplication scheme in cloud storage environments
US9342701B1 (en) Digital rights management system and methods for provisioning content to an intelligent storage
US9495552B2 (en) Integrated data deduplication and encryption
US9195851B1 (en) Offloading encryption to the client
US9246676B2 (en) Secure access for encrypted data
CN109067814B (zh) 媒体数据加密方法、系统、设备及存储介质
US20170163413A1 (en) System and Method for Content Encryption in a Key/Value Store
US9774445B1 (en) Host based rekeying
US20130268759A1 (en) Digital rights management system transfer of content and distribution
CN107959567A (zh) 数据存储方法、数据获取方法、装置及系统
US20130185569A1 (en) Data protection system and method based on cloud storage
US10970366B2 (en) Method for securing a multimedia content record in a storage medium
CN105245328A (zh) 一种基于第三方的用户及文件的密钥产生管理方法
US10897362B2 (en) De-duplication of encrypted data
US7802102B2 (en) Method for efficient and secure data migration between data processing systems
CN103812927A (zh) 一种存储方法
WO2016202089A1 (zh) 一种远端存储设备的数据加密方法、装置及系统
US10733305B2 (en) System and method for implementing cryptography in a storage system
KR20110139798A (ko) 향상된 보안성을 갖는 데이터 관리 시스템의 제어방법
US9356782B2 (en) Block encryption
US11290277B2 (en) Data processing system
WO2019122242A1 (en) System for securing deployed security cameras
KR20170049700A (ko) 암호데이터를 저장하는 클라우드 시스템 및 그 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16810830

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16810830

Country of ref document: EP

Kind code of ref document: A1