WO2018099157A1

WO2018099157A1 - Method and device for encrypting file system

Info

Publication number: WO2018099157A1
Application number: PCT/CN2017/101226
Authority: WO
Inventors: 浦世亮; 叶敏; 林鹏; 汪渭春; 林起芊
Original assignee: 杭州海康威视数字技术股份有限公司
Priority date: 2016-12-02
Filing date: 2017-09-11
Publication date: 2018-06-07
Also published as: CN108154042B; CN108154042A

Abstract

Disclosed are a method and device for encrypting a file system. The method comprises: when carrying out a formatting operation on a target disk, generating a first random number corresponding to a metadata index region created and generated by means of the formatting operation, wherein the formatting operation is used for installing a target file system on the target disk (S101); based on the first random number, encrypting data stored in the metadata index region to obtain first encrypted data (S102); and storing the first encrypted data in the metadata index region (S103). By applying the method and the device, the security of data stored in a file system is improved.

Description

File system encryption method and device

The present application claims the priority of the Chinese Patent Application entitled "A File System Encryption Method and Apparatus" filed on Dec. 2, 2016, filed on Dec. 2, 2016, the content of which is hereby incorporated by reference. .

Technical field

The present application relates to the field of file system technologies, and in particular, to a file system encryption method and apparatus.

Background technique

Currently, there are various file systems in the related art, such as a file system such as FAT16 (File Allocation Table) and NTFS (New Technology File System). These file systems manage data on disks and writes to disk. The data may be any type of data such as text or video.

Generally, when a file system needs to be mounted on a disk, a file system including a metadata boot area, a metadata index area, and a data area can be created on the disk by a formatting operation. The metadata boot area is used to store information of the file system itself, that is, file system information, such as version information of the file system, location information of the metadata index area, size information of the data block in the data area, and location information of the data block. Wait. The data area includes a plurality of data blocks for storing the data itself to be stored. The metadata index area is used for storing index data corresponding to each data block in the data area, and each index data record has data attribute information of data stored in the corresponding data block, such as data size information, data owner information, and data occupation. The number information of the data block, etc.

However, since the metadata boot area, the metadata index area, and the data area of the current file system are all stored in plaintext data, the attacker can crack the storage structure of the file system by analyzing the plaintext, and obtain the file in the crack. After the storage structure of the system, the storage location information of the data stored in the file system can be obtained, and the data stored in the file system can be obtained, and the stored data cannot be secured.

Summary of the invention

The purpose of the embodiment of the present application is to provide a file system encryption method and device to improve the text. The security of the data stored in the system.

In a first aspect, the embodiment of the present application provides a file system encryption method, where the method may include:

Generating, by the formatting operation of the target disk, a first random number corresponding to the metadata index area created by the formatting operation; wherein the formatting operation is for installing the target file on the target disk system;

And encrypting, according to the first random number, data stored in the metadata index area to obtain first encrypted data;

The first encrypted data is stored in the metadata index area.

Optionally, in an embodiment of the present application, the method may further include:

Generating a second random number corresponding to the metadata boot area created by the formatting operation when performing a formatting operation on the target disk;

And encrypting data stored in the metadata guiding area to obtain second encrypted data based on the second random number;

The second encrypted data is stored in the metadata boot area.

Optionally, before the step of storing the first encrypted data in the metadata index area, the method may further include:

Encrypting the first random number to obtain first random number encrypted data;

Correspondingly, the step of storing the first encrypted data in the metadata index area may include:

And storing the first encrypted data and the first random number encrypted data in the metadata index area.

Optionally, before the step of storing the second encrypted data in the metadata boot area, the method may further include:

Encrypting the second random number to obtain second random number encrypted data;

Correspondingly, the step of storing the second encrypted data in the metadata boot area may be include:

And storing the second encrypted data and the second random number encrypted data in the metadata boot area.

Optionally, the step of generating a first random number corresponding to the metadata index area created by the formatting operation when performing a formatting operation on the target disk may include:

Generating a first random number corresponding to the metadata index area created by the formatting operation when performing a formatting operation on the target disk;

or,

When performing a formatting operation on the target disk, determining the number of index data existing in the metadata index area created by the formatting operation, generating a target number of first random numbers, the target quantity and the number of the pieces The number is the same.

Optionally, in still another embodiment of the present application, the method may further include:

When the target video needs to be stored in the installed target file system, the I frame in the target video is encrypted to obtain the third encrypted data;

And storing the third encrypted data and the remaining video frames in the target video to a data area created by the formatting operation, wherein the remaining video frames are in the target video except the I frame Video frame.

Optionally, after storing the third encrypted data and the remaining video frames in the target video to the data area created by the formatting operation, the method further includes:

Obtaining a first number of a data block storing the third encrypted data, and storing a second number of the data block of the remaining video frame;

Decrypting the first encrypted data stored in the metadata index area based on the first random number to obtain first decrypted data;

Determining, by the first decrypted data, first target data corresponding to the first number, and second target data corresponding to the second number;

Replacing the first target data with data attribute information corresponding to the I frame, and using the Data attribute information of the remaining video frames, replacing the second target data, to obtain new first decrypted data;

Generating a third random number corresponding to the new first decrypted data;

And encrypting the new first decrypted data based on the third random number to obtain new first encrypted data.

Optionally, the formatting operation further creates an alternate metadata boot area and an alternate metadata index area on the target disk;

The method may further include:

Generating a fourth random number corresponding to the spare metadata boot area and a fifth random number corresponding to the spare metadata index area, when performing a formatting operation on the target disk;

And encrypting, according to the fourth random number, data stored in the spare metadata boot area to obtain fourth encrypted data; storing the fourth encrypted data in the spare metadata boot area;

And encrypting data stored in the spare metadata index area to obtain fifth encrypted data based on the fifth random number; storing the fifth encrypted data in the spare metadata index area.

In a second aspect, the embodiment of the present application provides a file system encryption device, where the device may include:

a formatting module for creating a metadata index area by a formatting operation;

a random number generating module, configured to: when performing a formatting operation on the target disk, generate a first random number corresponding to the metadata index area created by the formatting module formatting operation; wherein the formatting operation is performed Installing a target file system on the target disk;

And an encryption module, configured to encrypt data stored in the metadata index area according to the first random number, to obtain first encrypted data;

And a storage module, configured to store the first encrypted data in the metadata index area.

Optionally, the random number generating module is further configured to: when performing a formatting operation on the target disk, generate a second random number corresponding to the metadata boot area created by the formatting module formatting operation ;

Correspondingly, the encryption module is further configured to: encrypt the data stored in the metadata boot area to obtain second encrypted data based on the second random number; and the storage module is further configured to: The second encrypted data is stored in the metadata boot area.

Optionally, the encryption module is further configured to: encrypt the first random number, and obtain first random number encrypted data;

Correspondingly, the storage module is configured to: store the first encrypted data and the first random number encrypted data in the metadata index area.

Optionally, the encryption module is further configured to: encrypt the second random number, and obtain second random number encrypted data;

Correspondingly, the storage module is configured to: store the second encrypted data and the second random number encrypted data in the metadata boot area.

Optionally, the random number generating module is configured to: when performing a formatting operation on the target disk, generate a first random number corresponding to the metadata index area created by the formatting operation;

or,

Optionally, the encryption module is further configured to:

Correspondingly, the storage module is further configured to: store the third encrypted data, and remaining video frames in the target video, into a data area created by the formatting operation, where the remaining video frames are a video frame other than the I frame in the target video.

Optionally, in an embodiment of the present application, the apparatus may further include: obtaining a module;

The obtaining module is used to:

After the storage module stores the third encrypted data and the remaining video frames in the target video to the data area created by the formatting module formatting operation, obtaining the stored third encrypted data a first number of the data block and a second number of the data block of the remaining video frame;

Replacing the first target data by using data attribute information corresponding to the I frame, and replacing the second target data by using data attribute information of the remaining video frames to obtain new first decrypted data;

Generating a third random number corresponding to the new first decrypted data;

Optionally, the formatting module is further configured to create an alternate metadata boot area and an alternate metadata index area on the target disk by using the formatting operation;

Correspondingly, the random number generating module is further configured to: when performing a formatting operation on the target disk, generate a fourth random number corresponding to the spare metadata boot area, and corresponding to the spare metadata index area Fifth random number;

The cryptographic module is further configured to: encrypt, according to the fourth random number, data stored in the spare metadata boot area to obtain fourth encrypted data; and based on the fifth random number, the spare metadata index area The stored data is encrypted to obtain a fifth encrypted data;

The storage module is further configured to: store the fourth encrypted data into the spare metadata boot area; and store the fifth encrypted data into the spare metadata index area.

In a third aspect, the embodiment of the present application further provides a storage medium for storing executable program code, where the executable program code is executed to execute the file system encryption method according to the embodiment of the present application.

In a fourth aspect, the embodiment of the present application further provides an application program, where the application is used to execute the file system encryption method according to the embodiment of the present application.

In a fifth aspect, an embodiment of the present application further provides an electronic device, including: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside the space enclosed by the housing, the processor and the memory Provided on a circuit board; a power supply circuit for supplying power to each circuit or device; a memory for storing executable program code; and a processor for executing the file described in the embodiment of the present application by running executable program code stored in the memory System encryption method.

In the embodiment of the present application, in the process of creating a metadata index area of the target file system by a formatting operation, generating a first random number corresponding to the metadata index area; and based on the first random number, The data stored in the metadata index area is encrypted to obtain first encrypted data; and the first encrypted data is stored in the metadata index area. In this way, it is ensured that the metadata index area stores ciphertext data, and the attacker cannot parse the index data corresponding to the ciphertext data, thereby improving the security of the data stored in the data area of the target file system.

DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present application and the related art, the drawings used in the embodiments and the related art will be briefly described below. It is obvious that the drawings in the following description are only the present application. For some embodiments, other drawings may be obtained from those of ordinary skill in the art without departing from the drawings.

1 is a flowchart of a file system encryption method according to an embodiment of the present application;

2 is a schematic diagram of a file system according to an embodiment of the present application;

3 is a flowchart of a method for updating data stored in a metadata index area in an embodiment of the present application;

FIG. 4 is a schematic structural diagram of a file system encryption apparatus according to an embodiment of the present disclosure;

FIG. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present application.

detailed description

In order to make the objects, technical solutions, and advantages of the present application more comprehensible, the present application will be further described in detail below with reference to the accompanying drawings. It is apparent that the described embodiments are only a part of the embodiments of the present application, and not all of them. Based on the embodiments in the present application, common in the art All other embodiments obtained by the skilled person without creative efforts are within the scope of the present application.

In order to ensure the security of the stored data, the embodiment of the present application provides a file system encryption method and device.

A file system encryption method provided by an embodiment of the present application is first described below.

It should be noted that the execution subject of the file system encryption method provided by the embodiment of the present application is a terminal. Terminals include, but are not limited to, computers and mobile phones. In addition, the function software for implementing the file system encryption method provided by the embodiment of the present application may be: a special file system encryption software set in the terminal, or a function plug-in installed in the file system encryption software in the terminal, which is It is reasonable.

Referring to FIG. 1, the file system encryption method provided by the embodiment of the present application may include the following steps:

S101: When performing a formatting operation on the target disk, generating a first random number corresponding to the metadata index area created by the formatting operation; wherein the formatting operation is used to install the target file system on the target disk;

It will be understood by those skilled in the art that when a target file system needs to be installed on a target disk, a metadata boot area, a metadata index area, and a data area can be created on the target disk by a formatting operation.

After the metadata index area is created by the formatting operation, the first random number corresponding to the metadata index area can be generated. Since the data stored in the metadata index area is often composed of multiple pieces of index data, in one implementation, a random first random number may be generated for each index data, the process including: on the target disk When the formatting operation is performed, the number of index data existing in the metadata index area created by the formatting operation is determined, and the first random number of the target quantity is generated, and the target quantity is the same as the number of the number of the pieces, that is, the generated first number The number of random numbers is the same as the number of index data present in the metadata index area. In another implementation, a first random number may be generated for the created metadata index region, that is, only one first random number is generated for the plurality of index data, thereby reducing the time for generating the first random number.

Wherein, the first random number may be generated by a random number generator in the terminal performing the formatting operation, of course, without being limited thereto. In addition, it is important to emphasize that when installing on different target disks When the same target file system is used, the generated first random number for the metadata index area is different.

In addition, it should be noted that the metadata boot area created by the formatting operation is used to store basic information of the target file system to be installed, such as version information of the target file system, location information of the metadata index area, and data area. Size information of the data block, location information of the data block, and the like. The created metadata index area is used to store data attribute information of data stored in the data area, such as data size information, data owner information, and number information of data blocks occupied by the data. The created data area is used to store the data itself, and the data itself can be pictures, videos, texts, etc., of course, not limited to this.

S102: Encrypt data stored in the metadata index area according to the first random number, to obtain first encrypted data.

S103: Store the first encrypted data in a metadata index area.

Since the file system is often installed on the target disk when the target disk needs to be formatted, in order to improve the formatting speed, the formatting operation simply erases and overwrites the data in the metadata boot area of the original file system. The data written before the formatting operation and the index data corresponding to the data are not cleared.

Therefore, the attacker can parse the data attribute information (such as the data size information, the data owner information, and the number information of the data block occupied by the data) of the data written before the formatting operation according to the index data that is not cleared. Further, according to the obtained number information of the data block, the storage location of the data can be accurately located, thereby obtaining data under the storage location.

In order to ensure the security of the stored data, in the embodiment of the present application, the data stored in the metadata index area may be encrypted based on the first random number to obtain the first encrypted data. And storing the first encrypted data in the metadata index area, so that the attacker can only obtain the ciphertext data stored in the metadata index area after finding the metadata index area, that is, the attacker does not know the decryption key. In the case of a key, the plaintext data corresponding to the ciphertext data cannot be obtained. In this way, the data attribute information of the data stored in the target file system cannot be obtained, and the security of the stored data is guaranteed.

Moreover, in combination with the first random number, the manner in which the data stored in the metadata index area is encrypted can effectively prevent the first encrypted data from being cracked. This is because the first random number is generated during the formatting process, that is, each formatting process produces a random first random number. when After the attacker obtains the plaintext data corresponding to the first encrypted data of the target file system on the other disk, the attacker cannot obtain the first encrypted data in the target file system installed on the target disk by using the ciphertext attack mode. The plaintext data ensures the security of the data stored in the data area. The ciphertext attack mode belongs to the prior art and will not be described in detail herein.

In the embodiment of the present application, in the process of creating a metadata index area of the target file system by a formatting operation, generating a first random number corresponding to the metadata index area; and based on the first random number, the metadata index area The stored data is encrypted to obtain first encrypted data; the first encrypted data is stored in a metadata index area. In this way, it is ensured that the metadata index area stores ciphertext data, and the attacker cannot parse the index data corresponding to the ciphertext data, thereby improving the security of the data stored in the data area of the target file system.

The implementation of encrypting the data stored in the metadata index area based on the first random number will be described in detail below.

When only one first random number is generated for the data stored in the metadata index area, in one implementation, the first random number may be added to any position of the data stored in the metadata index area, and then the encryption algorithm is utilized. And encrypting the data after adding the first random number to obtain the first encrypted data.

In another implementation manner, the first random number may be XORed with the data stored in the metadata index area, and then the data obtained by the XOR operation is encrypted by using an encryption algorithm to obtain the first encryption. data.

For example, if the data stored in the metadata index area is INDEX and the obtained first random number is RAND_IM, the XOR operation can be performed by using INDEX and RAND_IM: INDEX⊕RAND_IM, and the result of the exclusive OR operation is performed. Encrypted to obtain the first encrypted data: Enc(INDEX⊕RAND_IM).

It should be noted that the encryption algorithm involved in the foregoing two implementation manners may adopt a symmetric encryption algorithm or an asymmetric encryption algorithm. The symmetric encryption algorithm includes but is not limited to the DES (Data Encryption Standard) algorithm, the 3DES (Triple Data Encryption) algorithm, and the AES (Advanced Encryption Standard) algorithm. Method; asymmetric encryption algorithms include but are not limited to the RSA algorithm and the Elgamal algorithm. Moreover, since the DES algorithm, the 3DES algorithm, the AES algorithm, the RSA algorithm, and the Elgamal algorithm are all existing algorithms, the process of performing encryption calculation using the above encryption algorithm is not described in detail herein.

When a plurality of random first random numbers are generated for the data stored in the metadata index area, each of the index data may be encrypted by using the foregoing method, thereby obtaining the first encrypted data, which is not described in detail herein.

Since the formatting operation creates a metadata boot area on the target disk when the target disk is formatted, if the basic information of the obtained target file system is directly written to the metadata boot area, when the attacker obtains When the basic information is used, the location information corresponding to the data area can be known, and the data desired by the attacker can be found from all the data stored in the data area. The basic information has been described above, and will not be described here.

Therefore, in order to further ensure the security of the stored data, in an embodiment of the present application, the second random corresponding to the metadata boot area created by the formatting operation may be generated when the target disk is formatted. The data stored in the metadata boot area is encrypted based on the second random number to obtain the second encrypted data; and the second encrypted data is stored in the metadata boot area.

It can be understood that, after encrypting the data stored in the created metadata index area by using the generated first random number, the created metadata may also be guided for the second random number of the metadata boot area. The data stored in the area is encrypted, so that after the attacker finds the metadata boot area, the attacker cannot obtain the basic information of the target file system according to the ciphertext data stored in the metadata boot area, thereby further ensuring the security of the stored data. .

It should be noted that, because the second random number is combined, the data stored in the metadata boot area is encrypted, and the second encrypted data is obtained, so that the second encrypted data can also effectively resist the attack of the ciphertext attack mode, thereby improving the attack. The security of the stored data.

In addition, based on the second random number, the data stored in the metadata boot area is encrypted to obtain an implementation manner of the second encrypted data, and an implementation manner of obtaining the first encrypted data may be adopted. For example, if the data stored in the metadata boot area is SUPER and the obtained first random number is RAND_MAIN, the exclusive OR operation may be performed by using SUPER and RAND_MAIN: SUPER ⊕ RAND_MAIN, and the result of the exclusive OR operation is performed. Encrypt to obtain the second encrypted data: Enc(SUPER⊕RAND_MAIN).

In another embodiment of the present application, after the data stored in the metadata index area is encrypted, after obtaining the first encrypted data, in order to facilitate the decryption, and in order to prevent the first random number from being obtained by the attacker, the first Before the step of storing the encrypted data in the metadata index area, encrypting the first random number to obtain the first random number encrypted data;

For example, assuming that the first encrypted data is RAND_IM, after the RAND_IM is encrypted, the first encrypted data is obtained: Enc(RAND_IM).

Correspondingly, the step of storing the first encrypted data in the metadata index area may include storing the first encrypted data and the first random number encrypted data in a metadata index area.

Similarly, in another embodiment of the present application, after the data stored in the metadata boot area is encrypted, after obtaining the second encrypted data, in order to facilitate the decryption, and in order to prevent the second random number from being obtained by the attacker, Encrypting the second random number to obtain the second random number encrypted data before storing the second encrypted data in the metadata boot area;

Accordingly, the step of storing the second encrypted data in the metadata boot area may include storing the second encrypted data and the second random number encrypted data in the metadata boot area.

In addition, in order to ensure that the metadata (ie, the data stored in the metadata index area and the metadata boot area) is lost, the target file system can still work normally. In still another embodiment of the present application, the formatting operation is also performed. Create an alternate metadata boot area and an alternate metadata index area on the target disk;

Moreover, in order to improve the security of the data stored in the spare metadata boot area and the spare metadata index area, the method may further include:

And performing a format operation on the target disk, generating a fourth random number corresponding to the spare metadata boot area, and a fifth random number corresponding to the spare metadata index area;

And encrypting data stored in the spare metadata boot area to obtain fourth encrypted data based on the fourth random number; storing the fourth encrypted data in the spare metadata boot area;

The data stored in the spare metadata index area is encrypted based on the fifth random number to obtain the fifth encrypted data; and the fifth encrypted data is stored in the spare metadata index area.

It should be noted that the encryption method for obtaining the fourth encrypted data and the fifth encrypted data may be an encryption method for obtaining the first encrypted data, and details are not described herein.

The file system created by the embodiment of the present application will be described below with reference to FIG. 2 .

As shown in FIG. 2, the target file system installed by the formatting operation may include: a metadata index area, a metadata boot area, a data area, an alternate metadata index area, and an alternate metadata boot area.

The metadata index area may be used to store the first encrypted data corresponding to the data to be stored, and the first random number encrypted data. Wherein, when the data area is divided into N data blocks, since each data block corresponds to one index data, as shown in FIG. 2, the data to be stored in the metadata index area may include: index data 1 to index data N, The first random number 1 to the first random number N, so that the N pieces of index data can be encrypted based on the first random, thereby obtaining the first encrypted data, so that the metadata index area stores the first encrypted data.

The metadata boot area may be used to store second encrypted data corresponding to data to be stored (ie, boot area data), and second random number encrypted data. Wherein, as shown in FIG. 2, the data to be stored in the metadata boot area may include: boot area data and a second random number. Therefore, the boot area data can be encrypted based on the second random number to obtain the second encrypted data, so that the metadata boot area stores the second encrypted data. It can be understood by those skilled in the art that the metadata boot area can be used to store basic information of the target file system, and can also be used to store block bitmap information, and the block bitmap information refers to the usage of each data block (ie, data). Block idle state) information. That is to say, it is reasonable to encrypt the basic information and the block bitmap information based on the second random number to obtain the second encrypted data.

It should be noted that the spare metadata index area is different from the first encrypted data to be stored in the metadata index area, but the index data corresponding to the stored first encrypted data is the same. This is because the first random number is randomly generated, that is, since the first random number generated each time is different, the first encrypted data and the metadata stored in the backup metadata index area are backed up in the case where the index data is the same. The first encrypted data stored in the index area is not the same. In the same way, the spare metadata is stored in the boot area. The stored second encrypted data is not the same as the second encrypted data stored in the metadata boot area, and will not be described in detail herein.

The data block is used to store the data itself to be stored, and the data stored in the data block includes but is not limited to text, pictures and video. When the data stored in the data block is text or picture, since the data amount of the text and the picture is small, in order to further ensure the security of the stored text and picture, the text or the picture may be encrypted, and then the encrypted data is encrypted. Stored in the corresponding data block.

When the data stored in the data block is a video, since the data amount of the video is generally large, it takes a lot of time to encrypt the video data. Therefore, in order to further improve the security of the video to be stored under the premise of ensuring the storage performance of the target file system, in another embodiment of the present application, the method may further include:

S1: when the target video needs to be stored in the installed target file system, encrypt the I frame in the target video to obtain the third encrypted data;

S2: storing the third encrypted data, and the remaining video frames in the target video, into a data area created by a formatting operation, and the remaining video frames are video frames other than the I frame in the target video.

For example, suppose the I frame in the target video is DATA, encrypt the DATA with an encryption algorithm, obtain the third encrypted data: Enc(DATA), and store Enc(DATA) to the data area created by the formatting operation. .

Those skilled in the art can understand that the I frame in the target video refers to the key frame of the target video. Taking the video of the H264 code stream as an example, when the video of the H264 code stream needs to be stored in the target file system, the target video is divided into I frames, B frames, and P frames for storage. Since these frames include specific frame header information, the attacker can determine which frames are key frames by parsing the frame header information of the frames after obtaining the storage location of the video, and then crack the target video according to the key frames. The H264 code stream is an existing video coding format, which is not described in detail herein.

When the key frame cannot be obtained, the target video cannot be parsed, so only the I frame in the target video can be encrypted to obtain the third encrypted data; and the third encrypted data and the target video are excluded from the I frame. The remaining video frames (such as B frames and P frames) are stored in the data area of the target file system.

It should be noted that the I frame, the B frame, and the P frame of the video are all existing concepts, and can be identified by the prior art, and will not be described in detail herein.

In still another embodiment of the present application, the third encrypted data, and the remaining video frames in the target video are stored in the data area created by the formatting operation in step S2, in order to update the data block storing the data. Corresponding index data, as shown in FIG. 3, the method may further include:

S3: obtaining a first number of the data block storing the third encrypted data, and storing a second number of the data block of the remaining video frame;

S4: Decrypt the first encrypted data stored in the metadata index area according to the first random number, to obtain the first decrypted data;

S5: determining first target data corresponding to the first number in the first decrypted data, and determining second target data corresponding to the second number;

S6: replacing the first target data by using the data attribute information corresponding to the I frame, and replacing the second target data by using the data attribute information of the remaining video frame to obtain new first decrypted data;

S7: Generate a third random number corresponding to the new first decrypted data;

S8: Encrypt the new first decrypted data based on the third random number to obtain new first encrypted data.

It can be understood that when data is newly written in the data area, that is, when the target video is written, the corresponding index data in the metadata index area also needs to be changed accordingly. In the process of changing the corresponding index data, the first encrypted data in the metadata index area is decrypted first, and the first decrypted data is obtained; and the data attribute information corresponding to the target video is replaced by the first decrypted data. Corresponding information; and encrypting the replaced data (ie, the new first decrypted data). In order to ensure the security of the obtained new first decrypted data, the third random number is used to encrypt the new first decrypted data, and then the encrypted data is stored.

For example, the decrypting operation of the first encrypted data stored in the metadata index area may include: obtaining the first encrypted data stored in the metadata index area: Enc (INDEX ⊕ RAND_IM), and according to the first encrypted data The encryption algorithm corresponding to the encryption algorithm: Dec{Enc(INDEX⊕RAND_IM)}, decrypts the first decrypted data: INDEX⊕RAND_IM; obtains the first random number encrypted data: Enc(RAND_IM), and the decryption algorithm corresponding to the encryption algorithm of the first random number encrypted data: Dec{Enc(RAND_IM), decrypting to get RAND_IM; thus, the decrypted INDEX⊕RAND_IM and RAND_IM can be XORed to obtain INDEX.

It should be noted that when the data is encrypted by the encryption method corresponding to the first encrypted data, that is, by performing an exclusive OR operation on the data and the random number, and encrypting the result obtained by the exclusive OR operation, The encrypted data obtained by the encryption may be decrypted by using the above decryption operation, and will not be described in detail herein.

The file system encryption method provided by the embodiment of the present application is described below with specific examples.

When the terminal receives the instruction to format the target disk, it begins to perform the formatting operation: first, it determines whether the target disk is normal. If it is not normal, the terminal prompts the formatting operation failure message; if it is normal, perform the following operations:

Get the basic information of the target file system to be created by the formatting operation (that is, formatting parameters such as version information, block size, encryption algorithm, and metadata storage location). Based on the formatting parameters, a metadata index area, an alternate metadata index area, a metadata boot area, an alternate metadata boot area, and a data area are created on the target disk.

The first random number, the second random number, the fourth random number, and the fifth random number are generated by the random number generator of the terminal. Further, encrypting data stored in the metadata index area based on the first random number, encrypting data stored in the metadata boot area based on the second random number, and encrypting data stored in the spare metadata index area based on the fourth random number, And encrypting the data stored in the spare metadata boot area based on the fifth random number, so that the formatting operation is completed, and the target file system is obtained.

In addition, when it is necessary to store data in the target file system, the following uses the stored data as a text as an example for description.

When the target text needs to be stored in the target file system, the target text may be encrypted and calculated by using a preset encryption algorithm; and the encrypted data is stored in the Nth data block in the data area; and the decrypted metadata in the index area First encrypting data, obtaining first decrypted data; using number of target texts According to the attribute information, the index data corresponding to the data block N in the first decrypted data is replaced; after the replacement is completed, the new first decrypted data is obtained; and the new first decrypted data is encrypted to obtain a new first encrypted data. Complete the update of the index data.

It should be noted that the manner of updating the index data of the spare metadata index area is similar to the above method, and details are not described herein.

Corresponding to the foregoing method embodiment, the embodiment of the present application further provides a file system encryption device, where the device may include:

a formatting module 401, configured to create a metadata index area by using a formatting operation;

The random number generating module 402 is configured to generate, when performing a formatting operation on the target disk, a first random number corresponding to the metadata index area created by the formatting operation of the formatting module 401; wherein the formatting operation is used in The target file system is mounted on the target disk;

The encryption module 403 is configured to encrypt data stored in the metadata index area based on the first random number to obtain first encrypted data.

The storage module 404 is configured to store the first encrypted data in the metadata index area.

Optionally, the random number generating module 402 is further configured to: when performing a formatting operation on the target disk, generate a second random number corresponding to the metadata boot area created by the formatting operation of the formatting module 401;

Correspondingly, the encryption module 403 is further configured to: encrypt the data stored in the metadata boot area to obtain the second encrypted data based on the second random number; and the storage module 304 is further configured to: store the second encrypted data in the metadata. Boot area.

Optionally, the encryption module 403 is further configured to: encrypt the first random number, and obtain the first random number encrypted data;

Correspondingly, the storage module 404 is specifically configured to: store the first encrypted data and the first random number encrypted data in a metadata index area.

Optionally, the encryption module 403 is further configured to: encrypt the second random number, and obtain the second random number encrypted data;

Correspondingly, the storage module 404 is specifically configured to: store the second encrypted data and the second random number encrypted data in the metadata boot area.

Optionally, the random number generating module 402 is specifically configured to: when performing a formatting operation on the target disk, generate a first random number corresponding to the metadata index area created by the formatting operation;

Alternatively, when the target disk is formatted, the number of index data existing in the metadata index area created by the formatting operation is determined, and the first random number of the target quantity is generated, and the target quantity is the same as the number of the number of the pieces.

Optionally, the encryption module 403 is further configured to:

When the target video file needs to be stored in the installed target file system, the I frame in the target video file is encrypted to obtain the third encrypted data;

Correspondingly, the storage module 404 is further configured to: store the third encrypted data, and the remaining video frames in the target video, into a data area created by a formatting operation, where the remaining video frames are videos other than the I frame in the target video. frame.

Optionally, the method further includes: obtaining a module;

The obtaining module is configured to: after the storage module 404 stores the third encrypted data and the remaining video frames in the target video to the data area created by the formatting operation of the formatting module 401, obtain the data block storing the third encrypted data. The first number, and the second number of the data block of the remaining video frame;

Determining first target data corresponding to the first number in the first decrypted data, and determining the second number Corresponding second target data;

Replacing the first target data by using the data attribute information corresponding to the I frame, and replacing the second target data by using the data attribute information of the remaining video frames to obtain new first decrypted data;

Generating a third random number corresponding to the new first decrypted data;

The new first decrypted data is encrypted based on the third random number to obtain new first encrypted data.

Optionally, the formatting module 401 is further configured to create an alternate metadata boot area and an alternate metadata index area on the target disk by using a formatting operation;

Correspondingly, the random number generating module 402 is further configured to: when performing a formatting operation on the target disk, generate a fourth random number corresponding to the spare metadata boot area, and a fifth random number corresponding to the spare metadata index area;

The encryption module 403 is further configured to: encrypt the data stored in the spare metadata boot area to obtain the fourth encrypted data based on the fourth random number; and encrypt the data stored in the spare metadata index area based on the fifth random number , obtaining the fifth encrypted data;

The storage module 404 is further configured to: store the fourth encrypted data into the spare metadata boot area; and store the fifth encrypted data into the spare metadata index area.

Corresponding to the foregoing method embodiments, the embodiment of the present application further provides a storage medium for storing executable program code, where the executable program code is used to execute at runtime: file system encryption provided by the embodiment of the present application. method. Specifically, the file system encryption method may include the following steps:

The first encrypted data is stored in the metadata index area.

The second encrypted data is stored in the metadata boot area.

Correspondingly, the step of storing the second encrypted data in the metadata boot area may include:

Or,

Generating a third random number corresponding to the new first decrypted data;

The method may further include:

Corresponding to the above method embodiment, the embodiment of the present application further provides an application program for performing the file system encryption method provided by the embodiment of the present application. Specifically, the file system encryption method may include the following steps:

The first encrypted data is stored in the metadata index area.

The second encrypted data is stored in the metadata boot area.

or,

Obtaining a first number of the data block storing the third encrypted data, and storing the remaining view The second number of the data block of the frequency frame;

Generating a third random number corresponding to the new first decrypted data;

The method may further include:

Corresponding to the above method embodiment, the embodiment of the present application further provides an electronic device, including: a housing 510, a processor 520, a memory 530, a circuit board 540, and a power circuit 550, wherein the circuit board 540 is disposed in the housing 510. Inside the enclosed space, the processor 520 and the memory 530 are disposed on the circuit board 540; the power supply circuit 540 is used to supply power to the respective circuits or devices; the memory 530 is used to store executable program code; and the processor 520 is stored in the running memory. Executable code to execute this application Please provide the file system encryption method provided in the embodiment. The file system encryption method may include the following steps:

The first encrypted data is stored in the metadata index area.

The second encrypted data is stored in the metadata boot area.

or,

Replacing the first target data by using data attribute information corresponding to the I frame, and replacing the second target data by using data attribute information of the remaining video frame to obtain a new first decrypted number according to;

Generating a third random number corresponding to the new first decrypted data;

The method may further include:

It should be emphasized that, for the electronic device, the application, and the storage medium embodiment, since the method content involved is basically similar to the foregoing method embodiment, the description is relatively simple, and the relevant parts are referred to the part of the method embodiment. Description can be.

It should be noted that, in this context, relational terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply such entities or operations. There is any such actual relationship or order between them. Furthermore, the term "comprises" or "comprises" or "comprises" or any other variations thereof is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device that comprises a plurality of elements includes not only those elements but also Other elements, or elements that are inherent to such a process, method, item, or device. An element defined by the phrase "comprising a ..." without further limitation does not exclude the presence of additional identical elements in the process, method, article, or device that comprises the element.

The various embodiments in the specification are described in a related manner, and the same similar parts between the various embodiments may be referred to each other, and each embodiment focuses on the differences from other embodiments. Where. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

The above is only the preferred embodiment of the present application, and is not intended to limit the scope of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application are included in the scope of the present application.

Claims

A file system encryption method, comprising:

Generating, by the formatting operation of the target disk, a first random number corresponding to the metadata index area created by the formatting operation; wherein the formatting operation is for installing the target file on the target disk system;

And encrypting, according to the first random number, data stored in the metadata index area to obtain first encrypted data;

The first encrypted data is stored in the metadata index area.
The method of claim 1 further comprising:

Generating a second random number corresponding to the metadata boot area created by the formatting operation when performing a formatting operation on the target disk;

And encrypting data stored in the metadata guiding area to obtain second encrypted data based on the second random number;

The second encrypted data is stored in the metadata boot area.
The method according to claim 1, wherein before the step of storing the first encrypted data in the metadata index area, the method further comprises:

Encrypting the first random number to obtain first random number encrypted data;

Correspondingly, the step of storing the first encrypted data in the metadata index area comprises:

And storing the first encrypted data and the first random number encrypted data in the metadata index area.
The method according to claim 2 or 3, wherein before the step of storing the second encrypted data in the metadata boot area, the method further comprises:

Encrypting the second random number to obtain second random number encrypted data;

Correspondingly, the step of storing the second encrypted data in the metadata boot area comprises:

And storing the second encrypted data and the second random number encrypted data in the metadata boot area.
The method according to claim 1, wherein the step of generating a first random number corresponding to the metadata index area created by the formatting operation when the formatting operation is performed on the target disk includes :

Generating a first random number corresponding to the metadata index area created by the formatting operation when performing a formatting operation on the target disk;

or,

When performing a formatting operation on the target disk, determining the number of index data existing in the metadata index area created by the formatting operation, generating a target number of first random numbers, the target quantity and the number of the pieces The number is the same.
The method of claim 1 further comprising:

When the target video needs to be stored in the installed target file system, the I frame in the target video is encrypted to obtain the third encrypted data;

And storing the third encrypted data and the remaining video frames in the target video to a data area created by the formatting operation, wherein the remaining video frames are in the target video except the I frame Video frame.
The method according to claim 6, wherein after storing the third encrypted data and the remaining video frames in the target video to the data area created by the formatting operation, :

Obtaining a first number of a data block storing the third encrypted data, and storing a second number of the data block of the remaining video frame;

Decrypting the first encrypted data stored in the metadata index area based on the first random number to obtain first decrypted data;

Determining, by the first decrypted data, first target data corresponding to the first number, and second target data corresponding to the second number;

Replacing the first target data by using data attribute information corresponding to the I frame, and replacing the second target data by using data attribute information of the remaining video frames to obtain new first decrypted data;

Generating a third random number corresponding to the new first decrypted data;

And encrypting the new first decrypted data based on the third random number to obtain new first encrypted data.
The method according to claim 1, wherein said formatting operation further creates an alternate metadata boot area and a spare metadata index area on the target disk;

The method further includes:

Generating a fourth random number corresponding to the spare metadata boot area and a fifth random number corresponding to the spare metadata index area, when performing a formatting operation on the target disk;

And encrypting, according to the fourth random number, data stored in the spare metadata boot area to obtain fourth encrypted data; storing the fourth encrypted data in the spare metadata boot area;

And encrypting data stored in the spare metadata index area to obtain fifth encrypted data based on the fifth random number; storing the fifth encrypted data in the spare metadata index area.
A file system encryption device, comprising:

a formatting module for creating a metadata index area by a formatting operation;

a random number generating module, configured to: when performing a formatting operation on the target disk, generate a first random number corresponding to the metadata index area created by the formatting module formatting operation; wherein the formatting operation is performed Installing a target file system on the target disk;

And an encryption module, configured to encrypt data stored in the metadata index area according to the first random number, to obtain first encrypted data;

And a storage module, configured to store the first encrypted data in the metadata index area.
The apparatus according to claim 9, wherein the random number generating module is further configured to: generate metadata created by the formatting module formatting operation when performing a formatting operation on the target disk a second random number corresponding to the boot area;

Correspondingly, the encryption module is further configured to: encrypt the data stored in the metadata boot area to obtain second encrypted data based on the second random number; and the storage module is further configured to: The second encrypted data is stored in the metadata boot area.
The apparatus according to claim 9, wherein the encryption module is further configured to: encrypt the first random number to obtain first random number encrypted data;

Correspondingly, the storage module is specifically configured to: store the first encrypted data and the first random number encrypted data in the metadata index area.
The apparatus according to claim 10 or 11, wherein the encryption module is further configured to: encrypt the second random number to obtain second random number encrypted data;

Correspondingly, the storage module is specifically configured to: store the second encrypted data and the second random number encrypted data in the metadata boot area.
The device according to claim 9, wherein the random number generating module is specifically configured to: when performing a formatting operation on the target disk, generate a metadata index area created by the formatting operation a first random number;

or,

When performing a formatting operation on the target disk, determining the number of index data existing in the metadata index area created by the formatting operation, generating a target number of first random numbers, the target quantity and the number of the pieces The number is the same.
The device according to claim 9, wherein the encryption module is further configured to:

When the target video needs to be stored in the installed target file system, the I frame in the target video is encrypted to obtain the third encrypted data;

Correspondingly, the storage module is further configured to: store the third encrypted data, and remaining video frames in the target video, into a data area created by the formatting operation, where the remaining video frames are a video frame other than the I frame in the target video.
The device according to claim 14, further comprising: obtaining a module;

The obtaining module is used to:

After the storage module stores the third encrypted data and the remaining video frames in the target video to the data area created by the formatting module formatting operation, obtaining the stored third encrypted data a first number of the data block and a second number of the data block of the remaining video frame;

Decrypting the first encrypted data stored in the metadata index area based on the first random number to obtain first decrypted data;

Determining, by the first decrypted data, first target data corresponding to the first number, and second target data corresponding to the second number;

Replacing the first target data by using data attribute information corresponding to the I frame, and replacing the second target data by using data attribute information of the remaining video frames to obtain new first decrypted data;

Generating a third random number corresponding to the new first decrypted data;

And encrypting the new first decrypted data based on the third random number to obtain new first encrypted data.
The apparatus according to claim 9, wherein the formatting module is further configured to create an alternate metadata boot area and an alternate metadata index area on the target disk by the formatting operation;

Correspondingly, the random number generating module is further configured to: when performing a formatting operation on the target disk, generate a fourth random number corresponding to the spare metadata boot area, and corresponding to the spare metadata index area Fifth random number;

The cryptographic module is further configured to: encrypt, according to the fourth random number, data stored in the spare metadata boot area to obtain fourth encrypted data; and based on the fifth random number, the spare metadata index area The stored data is encrypted to obtain a fifth encrypted data;

The storage module is further configured to: store the fourth encrypted data into the spare metadata boot area; and store the fifth encrypted data into the spare metadata index area.
A storage medium for storing executable program code, the executable program code being operative to perform the file system encryption method of any one of claims 1-8.
An application, the application being operative to perform the file system encryption method of any one of claims 1-8 at runtime.
An electronic device, comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; a circuit for powering each circuit or device; a memory for storing executable program code; the processor executing the file system encryption method of any one of claims 1-8 by running executable program code stored in the memory .