WO2021036511A1 - 数据加密存储和读取的方法、终端设备及存储介质 - Google Patents

数据加密存储和读取的方法、终端设备及存储介质 Download PDF

Info

Publication number
WO2021036511A1
WO2021036511A1 PCT/CN2020/100426 CN2020100426W WO2021036511A1 WO 2021036511 A1 WO2021036511 A1 WO 2021036511A1 CN 2020100426 W CN2020100426 W CN 2020100426W WO 2021036511 A1 WO2021036511 A1 WO 2021036511A1
Authority
WO
WIPO (PCT)
Prior art keywords
data block
storage area
terminal device
encryption
file
Prior art date
Application number
PCT/CN2020/100426
Other languages
English (en)
French (fr)
Inventor
汤增宏
Original Assignee
百富计算机技术（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 百富计算机技术（深圳）有限公司 filed Critical 百富计算机技术（深圳）有限公司
Publication of WO2021036511A1 publication Critical patent/WO2021036511A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database

Definitions

  • This application belongs to the field of communication technology, and in particular relates to a method, terminal device, and storage medium for data encryption storage and reading.
  • the embodiments of the present application provide a method, terminal device, and storage medium for data encryption storage and reading, to solve the current problem of high cost of file or data encryption storage.
  • an embodiment of the present application provides a method for data encryption storage, including: obtaining a file write operation request; the file write operation request is used to access a file system of a terminal device, the terminal device is provided with an actual storage area, and A preset virtual storage area corresponding to an actual storage area; convert the file write operation request into a corresponding data block write request; the data block write request is used to access the actual storage area; obtain the data block The ciphertext data block corresponding to the plaintext data block in the write request; storing the ciphertext data block in the actual storage area.
  • the obtaining the ciphertext data block corresponding to the plaintext data block in the data block write request includes: extracting and sending the plaintext data block in the data block write request Receiving the ciphertext data block corresponding to the plaintext data block; the ciphertext data block is a ciphertext data block generated after the plaintext data block is encrypted according to the current encryption algorithm and key.
  • the method for data encryption storage before obtaining a file write operation request, further includes: when the actual storage area does not contain a preset identifier, checking the actual The terminal device corresponding to the storage area is authenticated; after the terminal device is authenticated, the current encryption algorithm and key of the terminal device are obtained according to the secure storage configuration file corresponding to the terminal device.
  • the plaintext data block is encrypted by the cloud encryption and decryption server and according to the current encryption algorithm and key to generate the corresponding ciphertext data block.
  • the plaintext data block is encrypted through a local encryption and decryption service program and according to the current encryption algorithm and key to generate the corresponding ciphertext data block.
  • an embodiment of the present application provides a method for decrypting and reading data, including: obtaining a file read operation request; the file read operation request is used to access a file system of a terminal device, and the terminal device is provided with an actual storage area And a preset virtual storage area corresponding to the actual storage area; convert the file read operation request into a corresponding data block read request and read the ciphertext data block; the data block read request is used to access the actual Storage area; the ciphertext data block is a ciphertext data block generated by the method for data encryption storage according to the first aspect or any one of the first aspect of the implementation; obtain the plaintext data block corresponding to the ciphertext data block; The plaintext data block is stored in the virtual storage area, and the plaintext data block is read through the virtual storage area.
  • an embodiment of the present application provides a terminal device, including: a first input unit, configured to obtain a file write operation request, and convert the file write operation request into a corresponding data block write request; the file The write operation request is used to access the file system of the terminal device.
  • the terminal device is provided with an actual storage area and a preset virtual storage area corresponding to the actual storage area; the encryption unit is used to obtain the plaintext data block in the data block write request Corresponding ciphertext data block; ciphertext storage unit for storing the ciphertext data block in the actual storage area.
  • an embodiment of the present application provides a terminal device, including: a second input unit, configured to obtain a file read operation request, and convert the file read operation request into a corresponding data block read request and read the secret Text data block; the file read operation request is used to access the file system of the terminal device, the terminal device is provided with an actual storage area and a preset virtual storage area corresponding to the actual storage area; the ciphertext data block is A ciphertext data block generated by the method for data encryption storage in one aspect or any one of the first aspect; a decryption unit for obtaining a plaintext data block corresponding to the ciphertext data block; a plaintext reading unit for storing The plaintext data block is stored in the virtual storage area, and the plaintext data block is read through the virtual storage area.
  • an embodiment of the present application provides a terminal device, including a memory, a processor, and a computer program stored in the memory and running on the processor.
  • the processor executes the computer program, Implement the steps of the method for data encryption and storage as described in the first aspect or any one of the implementation manners of the first aspect; or, when the processor executes the computer program, implement the steps of the method for decrypting and reading data as described in the second aspect .
  • an embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it implements any of the first aspect or the first aspect.
  • the steps of the method for encrypting and storing data in one embodiment; or, when the computer program is executed by a processor, the steps of the method for decrypting and reading data as described in the second aspect are implemented.
  • the method for data encryption storage sets a virtual storage area to prevent applications and file systems from directly accessing the actual storage area. Instead, they access the virtual storage area, so that the application and the file system themselves do not know
  • the data in the actual storage area is encrypted before being saved.
  • not only the encrypted storage of files or data is realized, but there is no need to modify the application and file system. While protecting the security of the data on the storage device, the applicability of the data encryption storage method provided in the embodiments of the present application is improved.
  • FIG. 1 is a schematic diagram of an implementation process of a specific example of a method for data encryption storage provided by an embodiment of the present application
  • FIG. 2 is a schematic diagram of an implementation process of another specific example of a method for data encryption storage provided by an embodiment of the present application;
  • FIG. 3 is a schematic diagram of an implementation process of a specific example of a method for decrypting and reading data provided by an embodiment of the present application
  • FIG. 4 is a schematic diagram of a specific example of a terminal device provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of another specific example of a terminal device provided by an embodiment of the present application.
  • Fig. 6 is a schematic diagram of a third specific example of a terminal device provided by an embodiment of the present application.
  • the data encryption storage method uses software, virtual storage device partitions or entire storage devices, to complete 1:1 simulation of real storage device partitions or the entire storage device, so that the file system cannot directly access the real storage device. Instead, access the virtual storage device. In this way, even if the data stored in the real storage device is encrypted data, it will not cause obstacles to the normal operation of the application.
  • the application does not need to be modified, but the purpose of data encryption, decryption and storage is achieved. Compatible with existing applications.
  • the embodiment of the present application provides a method for data encryption storage.
  • the method for data encryption storage may include the following steps:
  • Step S101 Obtain a file write operation request.
  • the file write operation request is used to access the file system of the terminal device, and the terminal device is provided with an actual storage area and a preset virtual storage area corresponding to the actual storage area.
  • a file read/write operation request is an operation for an application program to access the file system (a certain part of the operating system).
  • the file system converts read/write operation requests into data block read/write operation requests.
  • the data block read/write operation request is used to access the virtual storage area and the subsequent actual storage area.
  • the virtual storage area accesses the encryption and decryption service program in the terminal device according to the data block read and write request, and synchronizes and backs up the data information in the actual storage area for file system access.
  • the actual storage area is only used to store ciphertext data block information.
  • Step S102 Convert the file write operation request into a corresponding data block write request.
  • the file system converts the file read and write operation request into a corresponding data block read and write request for accessing the virtual storage area.
  • Step S103 Obtain the ciphertext data block corresponding to the plaintext data block in the data block write request.
  • the data block write request contains the plaintext data block that needs to be written to the terminal device.
  • the plaintext data block can be encrypted to generate a ciphertext data block corresponding to the plaintext data block.
  • step S103 can be implemented through the following sub-steps:
  • Step S1031 Extract and send the plaintext data block in the data block write request.
  • Step S1032 Receive the ciphertext data block corresponding to the plaintext data block.
  • the ciphertext data block is a ciphertext data block generated after the plaintext data block is encrypted according to the current encryption algorithm and key.
  • the encryption algorithm and key can be obtained by reading the preset security configuration information.
  • the security configuration information includes terminal device information, actual storage area identification, corresponding encryption and decryption algorithms and keys, which can be manually set to various types of encryption and decryption algorithms and keys.
  • the received plaintext data block can be encrypted through the cloud encryption and decryption server and according to the current encryption algorithm and key to generate the corresponding ciphertext data block.
  • the terminal device that needs to perform data encryption and decryption processing and the cloud encryption and decryption server generally communicate through communication networks such as Ethernet, WIFI, 3G, or 4G.
  • the terminal device sends the plaintext data block in the data block write request to the cloud encryption and decryption server, and the cloud encryption and decryption server encrypts the plaintext data block according to the current encryption algorithm and key to generate the corresponding ciphertext data Block, and pass the ciphertext data block back to the terminal device through the communication network.
  • a third-party program (such as a local encryption and decryption service program) sends the plaintext data to the cloud according to the access request of the virtual storage area, completes the encryption process, and stores the obtained ciphertext data in the actual Storage area.
  • the plaintext data block can be encrypted through the local encryption and decryption service program installed on the terminal device and according to the current encryption algorithm and key to generate the corresponding ciphertext data block.
  • a third-party program (such as a local encryption and decryption service program) reads the plaintext data and completes the encryption process according to the access request of the virtual storage area, and then stores the encrypted ciphertext data in the actual storage area.
  • Step S104 Store the ciphertext data block in the actual storage area.
  • step S101 the following steps may be added before step S101:
  • Step S201 Determine whether the actual storage area contains a preset identifier.
  • the preset identification can be used to mark whether the actual storage area is used for the first time.
  • the terminal device used for the first time its actual storage area does not contain a preset identifier, and the terminal device used for the first time needs to be authenticated.
  • terminal devices that are not used for the first time they can directly perform encrypted data write operations because they have been authenticated.
  • step S202 is executed to authenticate the terminal device used for the first time; when the actual storage area contains the preset identification, step S101 can be skipped.
  • Step S202 Authenticate the terminal device corresponding to the actual storage area.
  • the terminal device and the cloud encryption and decryption server can perform two-way identity authentication.
  • the respective digital certificates of both parties can be used to achieve authentication, or the RSA public and private keys can be simply used to digitally sign a piece of information to achieve authentication.
  • the terminal device can use the cloud encryption and decryption server after receiving the digitally signed "identity” information
  • the corresponding public key verifies the "identity" information of the digital signature.
  • step S101 If the verification is passed, it proves that the identity of the cloud encryption and decryption server communicating is legal, and vice versa.
  • the terminal device and the cloud encryption and decryption server After the terminal device and the cloud encryption and decryption server perform two-way identity authentication and pass the authentication, a preset logo can be added to the terminal device and its actual storage area, so that the terminal device and its actual storage area can no longer be used next time.
  • the authentication is performed and the process directly proceeds to step S101.
  • step S202 may be omitted.
  • the preset identifier can be directly added to the terminal device; when the virtual storage area contains the preset identifier, it can jump to step S101.
  • Step S203 Determine whether the terminal device has passed the authentication. After the terminal device has passed the authentication, step S204 can be executed; when the terminal device has not passed the authentication, a message indicating that the authentication has failed can be fed back to the terminal device.
  • Step S204 Acquire the current encryption algorithm and key of the terminal device according to the secure storage configuration file corresponding to the terminal device.
  • the encryption and decryption algorithm can be negotiated between the terminal device and the cloud encryption and decryption server.
  • the cloud encryption and decryption server and the terminal device exchange the encryption algorithm types that they can support, and the cloud encryption and decryption server selects the encryption and decryption algorithm types that can be supported in both directions according to the preset secure storage configuration file, and generates the encryption algorithm. key.
  • the cloud encryption and decryption server transmits the selected algorithm type and key to the terminal device.
  • the terminal device receives the selected encryption and decryption algorithm type and key, it will use the selected algorithm in subsequent communications.
  • the encryption and decryption algorithm type and key are used to encrypt and decrypt the communication content, and the cloud encryption and decryption server also uses the same algorithm type and key to encrypt and decrypt the data communication.
  • the terminal device can select the corresponding encryption and decryption algorithm and generate the corresponding key according to the preset security storage configuration information, and record the selected algorithm type and key in the security configuration file , In preparation for the subsequent steps to directly call the current encryption and decryption algorithm and the corresponding key.
  • the preset security configuration information includes terminal device information, actual storage area identification, corresponding encryption and decryption algorithms and keys, which can be manually set to various types of encryption and decryption algorithms and keys.
  • the method for data encryption storage provided by the embodiments of this application sets a virtual storage area to prevent applications and file systems from directly accessing the actual storage area. Instead, they access the virtual storage area, so that the application and the file system themselves do not know
  • the data in the actual storage area is encrypted before being saved. Without using a storage device with encryption and decryption functions, it not only realizes the encrypted storage of files or data, but also does not require any modification to the application and file system.
  • the applicability of the data encryption storage method provided in the embodiments of the present application is improved.
  • the embodiment of the present application also provides a method for decrypting and reading data.
  • the method for decrypting and reading data may include the following steps:
  • Step S301 Obtain a file read operation request.
  • the file read operation request is used to access the file system of the terminal device, and the terminal device is provided with an actual storage area and a preset virtual storage area corresponding to the actual storage area.
  • Step S302 Convert the file read operation request into a corresponding data block read request.
  • the data block read request can be used to access the actual storage area of the terminal device.
  • Step S303 Read the ciphertext data block.
  • the ciphertext data block is the ciphertext data block generated by the method of data encryption storage as shown in FIG. 1 or FIG. 2.
  • Step S304 Obtain the plaintext data block corresponding to the ciphertext data block.
  • the terminal device When the terminal device is in a networked state, the terminal device can send the ciphertext data block that needs to be decrypted to the cloud encryption and decryption server through the communication network; the cloud encryption and decryption server will calculate the received data according to the current encryption and decryption algorithm and key.
  • the ciphertext data block is decrypted to generate the corresponding plaintext data block; finally, the cloud encryption and decryption server sends the decrypted plaintext data block to the terminal device.
  • a third-party program such as a local encryption and decryption service program
  • a third-party program can obtain ciphertext data from the actual storage area according to the access request of the virtual storage area, and send it to the cloud to complete the decryption process.
  • the decrypted plaintext data is returned to the virtual storage area, so that the application can obtain the plaintext data from the virtual storage area through the file system and according to the read request.
  • the ciphertext data block can be decrypted through the local encryption and decryption service program and according to the current encryption and decryption algorithm and key to generate the corresponding plaintext data block.
  • a third-party program such as a local encryption and decryption service program
  • a third-party program can obtain the ciphertext data from the actual storage area and complete the decryption process according to the access request of the virtual storage area, and then decrypt it.
  • the latter plaintext data is returned to the virtual storage area, so that the application can obtain the plaintext data from the virtual storage area through the file system and according to the read request.
  • Step S305 Store the plaintext data block in the virtual storage area, and read the plaintext data block through the virtual storage area.
  • the application program that needs to call the plaintext data block can obtain the plaintext by accessing the virtual storage area data block.
  • the application program does not participate. Therefore, when using the file encryption and decryption method provided in the embodiments of the present application to encrypt, store, decrypt and read files or data, there is no need to modify the application program, and it can be universally applied to various existing application programs.
  • steps S201 to S204 shown in FIG. 2 can be added. Specifically, steps S201 to S204 can be added to FIG. 3 Before step S301 shown, and when the terminal device contains a preset identifier, it can jump directly to step S301.
  • the embodiment of the present application also provides a terminal device.
  • the terminal device may include: a first input unit 401, an encryption unit 402, and a ciphertext storage unit 403.
  • the first input unit 401 is used to obtain a file write operation request, and convert the file write operation request into a corresponding data block write request; the file write operation request is used to access the file system of the terminal device, and the terminal device is provided with an actual storage area And the preset virtual storage area corresponding to the actual storage area; the corresponding working process can be referred to as shown in step S101 to step S102 in the above method embodiment.
  • the encryption unit 402 is configured to obtain the ciphertext data block corresponding to the plaintext data block in the data block write request; the corresponding working process can be referred to as shown in step S103 in the foregoing method embodiment.
  • the ciphertext storage unit 403 is used to store the ciphertext data block in the actual storage area; the corresponding working process can be referred to as shown in step S104 in the foregoing method embodiment.
  • a verification unit 400 can also be added to the terminal device shown in FIG. 4.
  • the verification unit 400 can be used to authenticate the terminal device corresponding to the actual storage area; after the terminal device is authenticated, the verification unit 400 can also be used to verify the security of the terminal device.
  • the working process corresponding to the verification unit 400 can be referred to as shown in step S201 to step S204 in the foregoing method embodiment.
  • the embodiment of the present application also provides another terminal device.
  • the terminal device may include: a second input unit 501, a decryption unit 502, and a plaintext reading unit 503.
  • the second input unit 501 is used to obtain a file read operation request, and convert the file read operation request into a corresponding data block read request and read the ciphertext data block; the file read operation request is used to access the file system of the terminal device,
  • the terminal device is provided with an actual storage area and a preset virtual storage area corresponding to the actual storage area; the ciphertext data block is the ciphertext data block generated by the method of data encryption storage as shown in FIG. 1 or FIG. 2; its corresponding For the working process of, refer to the steps S301 to S303 in the above method embodiment.
  • the decryption unit 502 is used to obtain the plaintext data block corresponding to the ciphertext data block; the corresponding working process can be referred to as shown in step S304 in the foregoing method embodiment.
  • the plaintext reading unit 503 is configured to store the plaintext data block in the virtual storage area, and read the plaintext data block through the virtual storage area; the corresponding working process can be referred to step S305 in the foregoing method embodiment.
  • Fig. 6 is a schematic diagram of a third terminal device provided by an embodiment of the present application.
  • the terminal device 600 of this embodiment includes a processor 601, a memory 602, and a computer program 603 stored in the memory 602 and running on the processor 601, such as a program for data encryption storage. Or a program for decrypting and reading data.
  • the processor 601 executes the computer program 603, the steps in the foregoing method embodiments for data encryption storage or data decryption and reading method embodiments are implemented, for example, steps S101 to S104 shown in FIG. 1 or FIG. 3 Steps S301 to S305 are shown.
  • the processor 601 executes the computer program 603
  • the functions of the modules/units in the foregoing device embodiments are implemented, for example, the first input unit 401, the encryption unit 402, and the ciphertext storage unit 403 shown in FIG. Functions, or the functions of the second input unit 501, the decryption unit 502, and the plaintext reading unit 503 shown in FIG. 5.
  • the computer program 603 may be divided into one or more modules/units, and the one or more modules/units are stored in the memory 602 and executed by the processor 601 to complete the application.
  • the one or more modules/units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program 603 in the terminal device 600.
  • the computer program 603 can be divided into a synchronization module, a summary module, an acquisition module, and a return module (a module in a virtual device).
  • the terminal device 600 may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server.
  • the terminal device may include, but is not limited to, a processor 601 and a memory 602.
  • FIG. 6 is only an example of the terminal device 600, and does not constitute a limitation on the terminal device 600. It may include more or less components than shown in the figure, or a combination of certain components, or different components.
  • the terminal device may also include input and output devices, network access devices, buses, and the like.
  • the so-called processor 601 may be a central processing unit (Central Processing Unit, CPU), other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the memory 602 may be an internal storage unit of the terminal device 600, such as a hard disk or a memory of the terminal device 600.
  • the memory 602 may also be an external storage device of the terminal device 600, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), and a secure digital (Secure Digital, SD) equipped on the terminal device 600. Flash card Card) and so on.
  • the memory 602 may also include both an internal storage unit of the terminal device 600 and an external storage device.
  • the memory 602 is used to store the computer program and other programs and data required by the terminal device.
  • the memory 602 can also be used to temporarily store data that has been output or will be output.
  • the disclosed device/terminal device and method may be implemented in other ways.
  • the device/terminal device embodiments described above are only illustrative.
  • the division of the modules or units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units.
  • components can be combined or integrated into another system, or some features can be omitted or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated module/unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • this application implements all or part of the processes in the above-mentioned embodiments and methods, and can also be completed by instructing relevant hardware through a computer program.
  • the computer program can be stored in a computer-readable storage medium. When the program is executed by the processor, it can implement the steps of the foregoing method embodiments.
  • the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file, or some intermediate forms.
  • the computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signals, telecommunications signals, and software distribution media.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • electrical carrier signals telecommunications signals
  • software distribution media any entity or device capable of carrying the computer program code
  • recording medium U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signals, telecommunications signals, and software distribution media.

Abstract

一种数据加密存储和读取的方法、终端设备及存储介质，其中，数据加密存储的方法包括：获取文件写操作请求（S101）；将文件写操作请求转换为对应的数据块写请求（S102）；获取数据块写请求中明文数据块对应的密文数据块（S103）；将密文数据块存入实际存储区域（S104）。该数据加密存储的方法，通过设置虚拟存储区域，从而避免应用程序及文件系统直接访问实际存储区域，而是访问虚拟存储区域，这样能够使应用程序及文件系统本身并不知道实际存储区域中的数据是被加密后才存盘的，在不使用具备加解密功能的存储设备的前提下，实现了文件或数据的加密存储。

Description

数据加密存储和读取的方法、终端设备及存储介质 技术领域
本申请属于通信技术领域，尤其涉及一种数据加密存储和读取的方法、终端设备及存储介质。
 背景技术
在对文件或数据进行加解密处理时，往往需要依赖于具备加解密功能的存储设备，例如加密安全盘，其对数据的加解密功能是集成在安全盘本身的。具备加解密功能的存储设备成本较高，并且不能同时支持云端和本地的加解密算法动态升级和安全存储策略的动态配置。
 技术问题
有鉴于此，本申请实施例提供了一种数据加密存储和读取的方法、终端设备及存储介质，以解决目前文件或数据加密存储成本较高的问题。
 技术解决方案
根据第一方面，本申请实施例提供了一种数据加密存储的方法，包括：获取文件写操作请求；所述文件写操作请求用于访问终端设备的文件系统，终端设备设置有实际存储区域以及与实际存储区域相对应的预设的虚拟存储区域；将所述文件写操作请求转换为对应的数据块写请求；所述数据块写请求用于访问所述实际存储区域；获取所述数据块写请求中明文数据块对应的密文数据块；将所述密文数据块存入所述实际存储区域。
结合第一方面，在本申请的一些实施例中，所述获取所述数据块写请求中明文数据块对应的密文数据块，包括：提取并发送所述数据块写请求中的明文数据块；接收所述明文数据块对应的密文数据块；所述密文数据块为根据当前的加密算法和密钥对所述明文数据块进行加密处理后生成的密文数据块。
结合第一方面，在本申请的一些实施例中在获取文件写操作请求之前，所述数据加密存储的方法还包括：当所述实际存储区域中不含预设的标识时，对所述实际存储区域对应的终端设备进行认证；在所述终端设备认证通过后，根据所述终端设备对应的安全存储配置文件获取所述终端设备当前的加密算法和密钥。
结合第一方面，在本申请的一些实施例中，通过云端加解密服务器并根据当前的加密算法和密钥，对所述明文数据块进行加密处理，生成对应的密文数据块。
结合第一方面，在本申请的一些实施例中，通过本地的加解密服务程序并根据当前的加密算法和密钥，对所述明文数据块进行加密处理，生成对应的密文数据块。
根据第二方面，本申请实施例提供了一种数据解密读取的方法，包括：获取文件读操作请求；所述文件读操作请求用于访问终端设备的文件系统，终端设备设置有实际存储区域以及与实际存储区域相对应的预设的虚拟存储区域；将所述文件读操作请求转换为对应的数据块读请求并读取密文数据块；所述数据块读请求用于访问所述实际存储区域；所述密文数据块为如第一方面或第一方面任一实施方式所述数据加密存储的方法生成的密文数据块；获取所述密文数据块对应的明文数据块；将所述明文数据块存入所述虚拟存储区域，并通过所述虚拟存储区域读取所述明文数据块。
根据第三方面，本申请实施例提供一种终端设备，包括：第一输入单元，用于获取文件写操作请求，并将所述文件写操作请求转换为对应的数据块写请求；所述文件写操作请求用于访问终端设备的文件系统，终端设备设置有实际存储区域以及与实际存储区域相对应的预设的虚拟存储区域；加密单元，用于获取所述数据块写请求中明文数据块对应的密文数据块；密文存储单元，用于将所述密文数据块存入所述实际存储区域。
根据第四方面，本申请实施例提供一种终端设备，包括：第二输入单元，用于获取文件读操作请求，并将所述文件读操作请求转换为对应的数据块读请求并读取密文数据块；所述文件读操作请求用于访问终端设备的文件系统，终端设备设置有实际存储区域以及与实际存储区域相对应的预设的虚拟存储区域；所述密文数据块为如第一方面或第一方面任一实施方式所述数据加密存储的方法生成的密文数据块；解密单元，用于获取所述密文数据块对应的明文数据块；明文读取单元，用于将所述明文数据块存入所述虚拟存储区域，并通过所述虚拟存储区域读取所述明文数据块。
根据第五方面，本申请实施例提供一种终端设备，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现如第一方面或第一方面任一实施方式所述数据加密存储的方法的步骤；或者，所述处理器执行所述计算机程序时实现如第二方面所述数据解密读取的方法的步骤。
根据第六方面，本申请实施例提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行时实现如第一方面或第一方面任一实施方式所述数据加密存储的方法的步骤；或者，所述计算机程序被处理器执行时实现如第二方面所述数据解密读取的方法的步骤。
 有益效果
本申请实施例提供的数据加密存储的方法，通过设置虚拟存储区域，从而避免应用程序及文件系统直接访问实际存储区域，而是访问虚拟存储区域，这样能够使应用程序及文件系统本身并不知道实际存储区域中的数据是被加密后才存盘的，在不使用具备加解密功能的存储设备的前提下，不仅实现了文件或数据的加密存储，而且无需对应用程序及文件系统进行任何修改，保护存储设备上的数据安全的同时，提高了本申请实施例提供的数据加密存储方法的适用性。
 附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例提供的数据加密存储的方法的一个具体示例的实现流程示意图；
图2是本申请实施例提供的数据加密存储的方法的另一个具体示例的实现流程示意图；
图3是本申请实施例提供的数据解密读取的方法的一个具体示例的实现流程示意图；
图4是本申请实施例提供的终端设备的一个具体示例的示意图；
图5是本申请实施例提供的终端设备的另一个具体示例的示意图；
图6是本申请实施例提供的终端设备的第三个具体示例的示意图。
 本发明的实施方式
以下描述中，为了说明而不是为了限定，提出了诸如特定系统结构、技术之类的具体细节，以便透彻理解本申请实施例。然而，本领域的技术人员应当清楚，在没有这些具体细节的其它实施例中也可以实现本申请。在其它情况中，省略对众所周知的系统、装置、电路以及方法的详细说明，以免不必要的细节妨碍本申请的描述。
应用程序在访问存储设备时，一般需要通过操作系统中的各种文件系统实现数据访问。本申请实施例提供的数据加密存储方法通过软件的方式，虚拟存储设备分区或整个存储设备，完成1：1模拟真实存储设备分区或整个存储设备，从而使文件系统不能直接访问真实的存储设备，而是访问虚拟存储设备。这样，即使真实的存储设备中所存储的数据为加密数据，也不会对应用程序的正常运行造成障碍，实现了应用程序不需要做任何修改，但却达到了数据加解密存储的目的，同时兼容现有应用程序。
为了说明本申请所述的技术方案，下面通过具体实施例来进行说明。
本申请实施例提供了一种数据加密存储的方法，如图1所示，该数据加密存储的方法可以包括以下步骤：
步骤S101：获取文件写操作请求。
具体的，文件写操作请求用于访问终端设备的文件系统，终端设备设置有实际存储区域以及与实际存储区域相对应的预设的虚拟存储区域。
文件读/写操作请求是应用程序访问文件系统（操作系统中的某个部分）的操作。文件系统会将读/写操作请求转换为数据块读/写操作请求。数据块读/写操作请求是用来访问虚拟存储区域，以及访问后续的实际存储区域。在实际应用中，虚拟存储区域根据数据块读写请求来访问终端设备中的加解密服务程序，以及同步备份实际存储区域中的数据信息，供文件系统访问使用。实际存储区域仅用于存储密文数据块信息。
步骤S102：将文件写操作请求转换为对应的数据块写请求。
具体的，文件系统将文件读写操作请求转换为对应的数据块读写请求，用于访问虚拟存储区域。
步骤S103：获取数据块写请求中明文数据块对应的密文数据块。
在数据块写请求中，包含需要写入终端设备的明文数据块。为了提高数据使用的安全性，可以对明文数据块进行加密处理，从而生成与明文数据块对应的密文数据块。
在一具体实施方式中，可以通过以下几个子步骤实现步骤S103的过程：
步骤S1031：提取并发送数据块写请求中的明文数据块。
步骤S1032：接收明文数据块对应的密文数据块。具体的，密文数据块为根据当前的加密算法和密钥对明文数据块进行加密处理后生成的密文数据块。
在实际应用中，可以通过读取预设的安全配置信息获取加密算法和密钥。安全配置信息中包含了终端设备信息、实际存储区域标识、对应的加解密算法和密钥，可人为设置为各种类型的加解密算法和密钥。
在实际应用中，当终端设备处于联网状态下，可以通过云端加解密服务器并根据当前的加密算法和密钥，对接收到的明文数据块进行加密处理，生成对应的密文数据块。需要进行数据加解密处理的终端设备与云端加解密服务器之间，一般通过以太网、WIFI、3G或4G等通信网络进行通讯。
在联网状态下，终端设备将数据块写请求中的明文数据块发送至云端加解密服务器，云端加解密服务器根据当前的加密算法和密钥对明文数据块进行加密处理，生成对应的密文数据块，并通过通信网络将密文数据块回传至终端设备。
具体的，在联网状态下，第三方程序（例如本地的加解密服务程序）根据虚拟存储区域的访问请求，将明文数据发送到云端，完成加密过程，并将获取到的密文数据存储到实际存储区域。
当终端设备处于断网状态下，可以通过安装在终端设备上的本地的加解密服务程序并根据当前的加密算法和密钥，对明文数据块进行加密处理，生成对应的密文数据块。
具体的，在断网状态下，第三方程序（例如本地的加解密服务程序）根据虚拟存储区域的访问请求，读取明文数据并完成加密过程，而后将加密得到的密文数据存储到实际存储区域。
步骤S104：将密文数据块存入实际存储区域。
在获取与数据块写请求中的明文数据块对应的密文数据块后，直接将密文数据块写入终端设备的实际存储区域中，可以将数据以密文的形式保存下来，有利于提高数据存储的安全性。
可选的，如图2所示，还可以在步骤S101之前增设以下步骤：
步骤S201：判断实际存储区域中是否包含预设的标识。预设的标识可以用于对实际存储区域是否为首次使用进行标记。对于首次使用的终端设备，其实际存储区域并不包含预设的标识，需要对首次使用的终端设备进行认证。对于并非首次使用的终端设备，因其已经进行过认证，可以直接进行加密的数据写操作。
当实际存储区域中不含预设的标识时，执行步骤S202，从而对首次使用的终端设备进行认证；当实际存储区域中包含预设的标识时，可以跳转至步骤S101。
步骤S202：对实际存储区域对应的终端设备进行认证。
当终端设备处于联网状态下，可以将终端设备与云端加解密服务器进行双向身份认证。具体的，可以用双方各自的数字证书实现认证，也可以简单地使用RSA公私钥对一段信息进行数字签名来实现认证。以RSA公私钥数字签名认证为例，如果云端加解密服务器用RSA私钥对“身份”两个字进行数字签名，终端设备收到被数字签名的“身份”信息后，可以使用云端加解密服务器对应的公钥对数字签名的“身份”信息进行验签，如果验签通过，就证明所进行通讯的云端加解密服务器的身份是合法，反之亦然。在终端设备与云端加解密服务器进行双向身份认证并认证通过后，可以在终端设备及其实际存储区域上添加预设的标识，从而使终端设备及其实际存储区域在下一次使用时，可以不再进行认证而直接进入步骤S101。
需要说明的是，当终端设备处于断网状态下，由于无需使用云端加解密服务器进行文件或数据的加解密操作，因此可以省略步骤S202。这种情况下，当虚拟存储区域中不含预设的标识时，可以直接在终端设备中增设预设的标识；当虚拟存储区域中含有预设的标识时，可以跳转至步骤S101。
步骤S203：判断终端设备是否通过认证。当终端设备通过认证后，可以执行步骤S204；当终端设备未通过认证时，可以向终端设备反馈认证失败的消息。
步骤S204：根据终端设备对应的安全存储配置文件获取终端设备当前的加密算法和密钥。
当终端设备处于联网状态下，且终端设备与云端加解密服务器之间认证通过后，可以在终端设备与云端加解密服务器之间协商加解密算法。具体的，云端加解密服务器与终端设备双方交换自己所能支持的加密算法类型，由云端加解密服务器根据预设的安全存储配置文件来选定双向都能支持的加解密算法类型，并生成密钥。然后由云端加解密服务器把选定的算法类型与密钥传给终端设备，终端设备收到已选定的加解密算法类型和密钥后，在后续的各种通讯中，会使用选定的加解密算法类型和密钥对通讯内容进行加解密，云端加解密服务器也用同样的算法类型和密钥对数据通信进行加解密。
当终端设备处于断网状态下，终端设备可以根据预设的安全存储配置信息，选择对应的加解密算法和产生对应的密钥，并把选定的算法类型和密钥记录到安全配置文件中，以备后续步骤直接调用当前的加解密算法和对应的密钥。预设的安全配置信息中包含了终端设备信息、实际存储区域标识、对应的加解密算法和密钥，可人为设置为各种类型的加解密算法和密钥。
本申请实施例提供的数据加密存储的方法，通过设置虚拟存储区域，从而避免应用程序及文件系统直接访问实际存储区域，而是访问虚拟存储区域，这样能够使应用程序及文件系统本身并不知道实际存储区域中的数据是被加密后才存盘的，在不使用具备加解密功能的存储设备的前提下，不仅实现了文件或数据的加密存储，并且无需对应用程序及文件系统进行任何修改，提高了本申请实施例提供的数据加密存储方法的适用性。
本申请实施例还提供了一种数据解密读取的方法，如图3所示，该数据解密读取的方法可以包括以下步骤：
步骤S301：获取文件读操作请求。
具体的，文件读操作请求用于访问终端设备的文件系统，终端设备设置有实际存储区域以及与实际存储区域相对应的预设的虚拟存储区域。
步骤S302：将文件读操作请求转换为对应的数据块读请求。
在实际应用中，数据块读请求可以用于访问终端设备的实际存储区域。
步骤S303：读取密文数据块。
在实际应用中，密文数据块为采用如图1或图2所示的数据加密存储的方法，生成的密文数据块。
步骤S304：获取密文数据块对应的明文数据块。
当终端设备处于联网状态下，终端设备可以通过通信网络将需要进行解密处理的密文数据块发送至云端加解密服务器；由云端加解密服务器根据当前的加解密算法和密钥，对接收到的密文数据块进行解密处理，生成对应的明文数据块；最后，云端加解密服务器将解密获得的明文数据块发送至终端设备。
具体的，当终端设备处于联网状态下，第三方程序（例如本地的加解密服务程序）可以根据虚拟存储区域的访问请求，从实际存储区域中获取密文数据，发送到云端，完成解密过程，然后将解密后的明文数据返回给虚拟存储区域，从而使应用程序可以通过文件系统并根据读请求，从虚拟存储区域中获取明文数据。
当终端设备处于断网状态下，可以通过本地的加解密服务程序并根据当前的加解密算法和密钥，对密文数据块进行解密处理，生成对应的明文数据块。
具体的，当终端设备处于断网状态下，第三方程序（例如本地的加解密服务程序）可以根据虚拟存储区域的访问请求，从实际存储区域中获取密文数据并完成解密过程，然后将解密后的明文数据返回给虚拟存储区域，从而使应用程序可以通过文件系统并根据读请求，从虚拟存储区域中获取明文数据。
步骤S305：将明文数据块存入虚拟存储区域，并通过虚拟存储区域读取明文数据块。
在得到实际存储区域中存储的密文数据块相对应的明文数据块后，通过将明文数据块存入虚拟存储区域，可以使需要调用该明文数据块的应用程序通过访问虚拟存储区域得到该明文数据块。在对实际存储区域中存储的密文数据块进行解密操作的过程中，应用程序并未参与进来。因此，使用本申请实施例提供的文件加解密方法对文件或数据进行加密存储和解密读取时，无需对应用程序进行修改，能够普遍适用于现有的各种应用程序。
需要说明的是，在实际应用中可以在图3所示的数据解密读取的方法中，增设图2所示的步骤S201至步骤S204，具体的，可以将步骤S201至步骤S204添加到图3所示步骤S301之前，并且在终端设备中含有预设的标识时可以直接跳转至步骤S301。
应理解，上述实施例中各步骤的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本申请实施例还提供了一种终端设备，如图4所示，该终端设备可以包括：第一输入单元401、加密单元402和密文存储单元403。
其中，第一输入单元401用于获取文件写操作请求，并将文件写操作请求转换为对应的数据块写请求；文件写操作请求用于访问终端设备的文件系统，终端设备设置有实际存储区域以及与实际存储区域相对应的预设的虚拟存储区域；其对应的工作过程可参见上述方法实施例中步骤S101至步骤S102所示。
加密单元402用于获取数据块写请求中明文数据块对应的密文数据块；其对应的工作过程可参见上述方法实施例中步骤S103所示。
密文存储单元403用于将密文数据块存入实际存储区域；其对应的工作过程可参见上述方法实施例中步骤S104所示。
在一具体实施方式中，还可以在图4所示的终端设备中增设验证单元400。当实际存储区域中不含预设的标识时，验证单元400可以用于对实际存储区域对应的终端设备进行认证；在终端设备认证通过后，验证单元400还可以用于根据终端设备对应的安全存储配置文件获取终端设备当前的加密算法和密钥。验证单元400对应的工作过程可参见上述方法实施例中步骤S201至步骤S204所示。
本申请实施例还提供了另一种终端设备，如图5所示，该终端设备可以包括：第二输入单元501、解密单元502和明文读取单元503。
其中，第二输入单元501用于获取文件读操作请求，并将文件读操作请求转换为对应的数据块读请求并读取密文数据块；文件读操作请求用于访问终端设备的文件系统，终端设备设置有实际存储区域以及与实际存储区域相对应的预设的虚拟存储区域；密文数据块为如图1或图2所示的数据加密存储的方法生成的密文数据块；其对应的工作过程可参见上述方法实施例中步骤S301至步骤S303所示。
解密单元502用于获取密文数据块对应的明文数据块；其对应的工作过程可参见上述方法实施例中步骤S304所示。
明文读取单元503用于将明文数据块存入虚拟存储区域，并通过虚拟存储区域读取明文数据块；其对应的工作过程可参见上述方法实施例中步骤S305所示。
图6是本申请一实施例提供的第三种终端设备的示意图。如图6所示，该实施例的终端设备600包括：处理器601、存储器602以及存储在所述存储器602中并可在所述处理器601上运行的计算机程序603，例如数据加密存储的程序或数据解密读取的程序。所述处理器601执行所述计算机程序603时实现上述各个数据加密存储的方法实施例或数据解密读取的方法实施例中的步骤，例如图1所示的步骤S101至步骤S104，或者图3所示的步骤S301至步骤S305。或者，所述处理器601执行所述计算机程序603时实现上述各装置实施例中各模块/单元的功能，例如图4所示的第一输入单元401、加密单元402和密文存储单元403的功能，或者图5所示的第二输入单元501、解密单元502和明文读取单元503的功能。
所述计算机程序603可以被分割成一个或多个模块/单元，所述一个或者多个模块/单元被存储在所述存储器602中，并由所述处理器601执行，以完成本申请。所述一个或多个模块/单元可以是能够完成特定功能的一系列计算机程序指令段，该指令段用于描述所述计算机程序603在所述终端设备600中的执行过程。例如，所述计算机程序603可以被分割成同步模块、汇总模块、获取模块、返回模块（虚拟装置中的模块）。
所述终端设备600可以是桌上型计算机、笔记本、掌上电脑及云端服务器等计算设备。所述终端设备可包括，但不仅限于，处理器601、存储器602。本领域技术人员可以理解，图6仅仅是终端设备600的示例，并不构成对终端设备600的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件，例如所述终端设备还可以包括输入输出设备、网络接入设备、总线等。
所称处理器601可以是中央处理单元(Central Processing Unit，CPU)，还可以是其他通用处理器、数字信号处理器 (Digital Signal Processor，DSP)、专用集成电路 (Application Specific Integrated Circuit，ASIC)、现成可编程门阵列 (Field-Programmable Gate Array，FPGA) 或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
所述存储器602可以是所述终端设备600的内部存储单元，例如终端设备600的硬盘或内存。所述存储器602也可以是所述终端设备600的外部存储设备，例如所述终端设备600上配备的插接式硬盘，智能存储卡（Smart Media Card, SMC），安全数字（Secure Digital, SD）卡，闪存卡（Flash Card）等。进一步地，所述存储器602还可以既包括所述终端设备600的内部存储单元也包括外部存储设备。所述存储器602用于存储所述计算机程序以及所述终端设备所需的其他程序和数据。所述存储器602还可以用于暂时地存储已经输出或者将要输出的数据。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，仅以上述各功能单元、模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能单元、模块完成，即将所述装置的内部结构划分成不同的功能单元或模块，以完成以上描述的全部或者部分功能。实施例中的各功能单元、模块可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中，上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。另外，各功能单元、模块的具体名称也只是为了便于相互区分，并不用于限制本申请的保护范围。上述系统中单元、模块的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述或记载的部分，可以参见其它实施例的相关描述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
在本申请所提供的实施例中，应该理解到，所揭露的装置/终端设备和方法，可以通过其它的方式实现。例如，以上所描述的装置/终端设备实施例仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通讯连接可以是通过一些接口，装置或单元的间接耦合或通讯连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的模块/单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实现上述实施例方法中的全部或部分流程，也可以通过计算机程序来指令相关的硬件来完成，所述的计算机程序可存储于一计算机可读存储介质中，该计算机程序在被处理器执行时，可实现上述各个方法实施例的步骤。其中，所述计算机程序包括计算机程序代码，所述计算机程序代码可以为源代码形式、对象代码形式、可执行文件或某些中间形式等。所述计算机可读介质可以包括：能够携带所述计算机程序代码的任何实体或装置、记录介质、U盘、移动硬盘、磁碟、光盘、计算机存储器、只读存储器（ROM，Read-Only Memory）、随机存取存储器（RAM，Random Access Memory）、电载波信号、电信信号以及软件分发介质等。需要说明的是，所述计算机可读介质包含的内容可以根据司法管辖区内立法和专利实践的要求进行适当的增减，例如在某些司法管辖区，根据立法和专利实践，计算机可读介质不包括电载波信号和电信信号。
以上所述实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围，均应包含在本申请的保护范围之内。

Claims (10)

  1. 一种数据加密存储的方法，其特征在于，包括：
    获取文件写操作请求；所述文件写操作请求用于访问终端设备的文件系统，所述终端设备设置有实际存储区域以及与所述实际存储区域相对应的预设的虚拟存储区域；
    将所述文件写操作请求转换为对应的数据块写请求；所述数据块写请求用于访问所述虚拟存储区域；
    获取所述数据块写请求中明文数据块对应的密文数据块；
    将所述密文数据块存入所述实际存储区域。
  2. 如权利要求1所述的数据加密存储的方法，其特征在于，所述获取所述数据块写请求中明文数据块对应的密文数据块，包括：
    提取并发送所述数据块写请求中的明文数据块；
    接收所述明文数据块对应的密文数据块；所述密文数据块为根据当前的加密算法和密钥对所述明文数据块进行加密处理后生成的密文数据块。
  3. 如权利要求2所述的数据加密存储的方法，其特征在于，在获取文件写操作请求之前，所述数据加密存储的方法还包括：
    当所述实际存储区域中不含预设的标识时，对所述实际存储区域对应的终端设备进行认证；
    在所述终端设备认证通过后，根据所述终端设备对应的安全存储配置文件获取所述终端设备当前的加密算法和密钥。
  4. 如权利要求3所述的数据加密存储的方法，其特征在于，通过云端加解密服务器并根据当前的加密算法和密钥，对所述明文数据块进行加密处理，生成对应的密文数据块。
  5. 如权利要求3所述的数据加密存储的方法，其特征在于，通过本地的加解密服务程序并根据当前的加密算法和密钥，对所述明文数据块进行加密处理，生成对应的密文数据块。
  6. 一种数据解密读取的方法，其特征在于，包括：
    获取文件读操作请求；所述文件读操作请求用于访问终端设备的文件系统，所述终端设备设置有实际存储区域以及与所述实际存储区域相对应的预设的虚拟存储区域；
    将所述文件读操作请求转换为对应的数据块读请求并读取密文数据块；所述数据块读请求用于访问所述虚拟存储区域；所述密文数据块为如权利要求1至5中任一项所述的数据加密存储的方法生成的密文数据块；
    获取所述密文数据块对应的明文数据块；
    将所述明文数据块存入所述虚拟存储区域，并通过所述虚拟存储区域读取所述明文数据块。
  7.   一种终端设备，其特征在于，包括：
    第一输入单元，用于获取文件写操作请求，并将所述文件写操作请求转换为对应的数据块写请求；所述文件写操作请求用于访问终端设备的文件系统，所述终端设备设置有实际存储区域以及与所述实际存储区域相对应的预设的虚拟存储区域；
    加密单元，用于获取所述数据块写请求中明文数据块对应的密文数据块；
    密文存储单元，用于将所述密文数据块存入所述实际存储区域。
  8. 一种终端设备，其特征在于，包括：
    第二输入单元，用于获取文件读操作请求，并将所述文件读操作请求转换为对应的数据块读请求并读取密文数据块；所述文件读操作请求用于访问终端设备的文件系统，所述终端设备设置有实际存储区域以及与所述实际存储区域相对应的预设的虚拟存储区域；所述数据块读请求用于访问所述虚拟存储区域；所述密文数据块为如权利要求1至5中任一项所述的数据加密存储的方法生成的密文数据块；
    解密单元，用于获取所述密文数据块对应的明文数据块；
    明文读取单元，用于将所述明文数据块存入所述虚拟存储区域，并通过所述虚拟存储区域读取所述明文数据块。
  9. 一种终端设备，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现如权利要求1至5任一项所述的数据加密存储的方法的步骤；或者，所述处理器执行所述计算机程序时实现如权利要求6所述的数据解密读取的方法的步骤。
  10. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现如权利要求1至5任一项所述的数据加密存储的方法的步骤；或者，所述计算机程序被处理器执行时实现如权利要求6所述的数据解密读取的方法的步骤。
PCT/CN2020/100426 2019-08-30 2020-07-06 数据加密存储和读取的方法、终端设备及存储介质 WO2021036511A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910817412.7A CN110598429B (zh) 2019-08-30 2019-08-30 数据加密存储和读取的方法、终端设备及存储介质
CN201910817412.7 2019-08-30

Publications (1)

Publication Number Publication Date
WO2021036511A1 true WO2021036511A1 (zh) 2021-03-04

Family

ID=68856565

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/100426 WO2021036511A1 (zh) 2019-08-30 2020-07-06 数据加密存储和读取的方法、终端设备及存储介质

Country Status (2)

Country Link
CN (1) CN110598429B (zh)
WO (1) WO2021036511A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110598429B (zh) * 2019-08-30 2021-07-13 百富计算机技术（深圳）有限公司 数据加密存储和读取的方法、终端设备及存储介质
CN111931190B (zh) * 2020-08-25 2023-03-14 山东云海国创云计算装备产业创新中心有限公司 一种基于xip处理器系统的启动方法
CN112836221B (zh) * 2021-01-13 2024-02-06 深圳安捷丽新技术有限公司 一种多安全级别分区的便携固态硬盘及其设计方法
CN114244551B (zh) * 2021-09-28 2024-01-30 自然资源部第三地形测量队 数据应用保护方法、设备及野外调绘核查方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101034424A (zh) * 2007-01-12 2007-09-12 深圳兆日技术有限公司 一种数据安全存储系统和装置及方法
CN101488110A (zh) * 2008-12-30 2009-07-22 成都市华为赛门铁克科技有限公司 加密存储的方法、装置和系统
CN109948347A (zh) * 2017-12-21 2019-06-28 中移（杭州）信息技术有限公司 一种数据存储方法及装置、服务器及可读存储介质
CN110598429A (zh) * 2019-08-30 2019-12-20 百富计算机技术（深圳）有限公司 数据加密存储和读取的方法、终端设备及存储介质

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103020537B (zh) * 2011-09-22 2015-07-22 腾讯科技（深圳）有限公司 数据加密方法和装置、数据解密方法和装置
CN104468562B (zh) * 2014-12-03 2017-12-15 南京信息工程大学 一种面向移动应用透明的数据安全保护便携式终端
CN105808977A (zh) * 2014-12-30 2016-07-27 Tcl集团股份有限公司 一种文件读操作、写操作的处理方法及装置
CN104809407B (zh) * 2015-05-05 2018-03-30 南京信息工程大学 云存储前端数据加解密及校验方法和系统
CN106682521B (zh) * 2016-11-28 2020-02-07 北京计算机技术及应用研究所 基于驱动层的文件透明加解密系统及方法
CN106713334B (zh) * 2016-12-31 2020-11-17 云宏信息科技股份有限公司 虚拟存储卷的加密方法、解密方法、访问方法以及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101034424A (zh) * 2007-01-12 2007-09-12 深圳兆日技术有限公司 一种数据安全存储系统和装置及方法
CN101488110A (zh) * 2008-12-30 2009-07-22 成都市华为赛门铁克科技有限公司 加密存储的方法、装置和系统
CN109948347A (zh) * 2017-12-21 2019-06-28 中移（杭州）信息技术有限公司 一种数据存储方法及装置、服务器及可读存储介质
CN110598429A (zh) * 2019-08-30 2019-12-20 百富计算机技术（深圳）有限公司 数据加密存储和读取的方法、终端设备及存储介质

Also Published As

Publication number Publication date
CN110598429B (zh) 2021-07-13
CN110598429A (zh) 2019-12-20

Similar Documents

Publication Publication Date Title
CN111314274B (zh) 一种车载终端与中心平台双向认证方法及系统
WO2021036511A1 (zh) 数据加密存储和读取的方法、终端设备及存储介质
EP2095288B1 (en) Method for the secure storing of program state data in an electronic device
CN101102180B (zh) 基于硬件安全单元的系统间绑定及平台完整性验证方法
CN108924147B (zh) 通信终端数字证书签发的方法、服务器以及通信终端
US9020149B1 (en) Protected storage for cryptographic materials
CN109635572B (zh) 一种基于区块链的合约签订方法、装置及终端设备
US9215070B2 (en) Method for the cryptographic protection of an application
CN109660534B (zh) 基于多商户的安全认证方法、装置、电子设备及存储介质
WO2020102974A1 (zh) 一种数据访问方法、数据访问装置及移动终端
CN111131416A (zh) 业务服务的提供方法和装置、存储介质、电子装置
CN112804217B (zh) 一种基于区块链技术的存证方法和装置
CN112507296B (zh) 一种基于区块链的用户登录验证方法及系统
WO2022048318A1 (zh) 一种建立通信信道的方法及用户终端
CN112202779B (zh) 基于区块链的信息加密方法、装置、设备及介质
CN110545325B (zh) 一种基于智能合约的数据加密分享方法
EP4084484A1 (en) Method and device for encryption of video stream, communication equipment, and storage medium
CN109697603A (zh) 电子印章的保护方法、装置、设备及介质
WO2019037422A1 (zh) 密钥及密钥句柄的生成方法、系统及智能密钥安全设备
CN113141353B (zh) 一种数字证书的存储方法、读取方法、装置及网关
CN114223176B (zh) 一种证书管理方法及装置
CN113535852A (zh) 基于区块链的文件处理方法、文件访问方法、装置及系统
CN113868713A (zh) 一种数据验证方法、装置、电子设备及存储介质
CN113645025A (zh) 数据加密存储方法、存储设备、用户设备及存储介质
CN115438353A (zh) 一种用户数据管理方法以及相关设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20856367

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20856367

Country of ref document: EP

Kind code of ref document: A1