CN101751536A

CN101751536A - Transparent file encryption method for increasing file header

Info

Publication number: CN101751536A
Application number: CN200910188873A
Authority: CN
Inventors: 胡跃; 卓勇; 于泳涛
Original assignee: SHENZHEN HONGAN INFORMATION TECHNOLOGY Co Ltd
Current assignee: SHENZHEN HONGAN INFORMATION TECHNOLOGY Co Ltd
Priority date: 2009-12-16
Filing date: 2009-12-16
Publication date: 2010-06-23

Abstract

The invention relates to a transparent file encryption method for increasing file header, which comprises the following steps: setting a mapping rule for progress and file; scanning a whole hard disk and encrypting the file needing encryption; a kernel module automatically increases one file header and encrypts data behind the file header when discovering a file needing encryption is not encrypted; adding one offset onto all the IO relevant with offset for a designated progress accessing encryption file, reading in the data decryption of an internal memory and writing in the data decryption of a disc.

Description

Increase the file transparent encryption method of file header

Technical field

The present invention is applied to field of data encryption, especially file encryption.Use the method encrypt file of add file head, can under the situation that does not change user's use habit, realize the encryption and the protection of data.The present invention can be applied to data security protecting initiatively and passive data security protecting.

Background technology

Now, be from many-sided for the threat of the security of system on the computing machine, hacker and wooden horse are difficult to estimate to the loss that enterprise brings.Data presentation, China every year is divulged a secret the economic loss that causes up to over ten billion because of network.

The continuous development of infotech day by day highlights the double-edged sword of Internet resources.Come the security threat of automatic network serious day by day, as network data burglar, hacker invasion and attack, virus distribution, even internal system divulges a secret, and made information security become matter of utmost importance in the every profession and trade informatization.

According to the responsible official of state security department, there is 63.6% enterprise customer to be in " height risk " rank, therefore, network security technology more and more receives the concern of industry-by-industry as the field of a uniqueness.

If the network information security can not get effective guarantee, enterprise will face that network can't normally use, file is lost or many-sided threat such as damage, production and management system paralysis, server and the damage of client hardware facility, confidential information and intellecture property be stolen, and these all can bring direct economic loss to enterprise.

In information security field, encrypted sensitive information must become indispensable necessary link of data storage.

Existing solution is, file manually encrypted and at specific process the HOOK module of Application and Development layer, revised file read-write behavior.Manually the defective of encryption method is, does not go manual encryption if the employee forgets manual encryption or employee's malice, will bring the risk of divulging a secret.Application layer HOOK module defective is that compatibility is very poor, can't support the encryption of many programs.

Summary of the invention

The purpose of this invention is to provide a kind of add file head mode, realize general file transparent encryption method.

Technical scheme of the present invention is:

1 at first to the total system initialization:

Setting process matched rule and file matched rule and encryption key;

Use the application layer program scanning overall, increase the logo file head of a fixed size in the file front that needs are encrypted, and with the data encryption behind the file header.

Workflow during 2 operate as normal

Kernel module interception file operation, and whether identification be the file that satisfies process matched rule and file matched rule, is not then to be left intact; If then walk following flow process.

At the file that does not have to encrypt, kernel module replenishes a file header to file, and with the data encryption behind the file header;

At encrypt file, kernel module all is offset a file header size with the IO operation relevant with side-play amount and handles;

At encrypt file, kernel module is to writing the data encryption of disk, to reading in the data decryption of internal memory.

Owing to use the kernel driver module to realize, can be by revising matched rule, the file of the designated suffix type that designated program is visited is encrypted, and does not need the employee manually to encrypt, and compatibility is also good than application layer HOOK.

Because what use is the mode of add file head, encryption indicator can stably be stored in the file, the problem that does not exist power down to cause encryption indicator information to be damaged.

Because what use is that the data mapping that different processes is seen is different according to the cipher mode of process as recognition rule.Decryption process can be seen data decryption, but non-decryption process sees there is not decrypted data.This data isolation mode according to process, the data leak that can stop hacker, wooden horse supervisor to produce.

Description of drawings:

Fig. 1: system initialization flow process

Fig. 2: the flow process when system normally moves

Fig. 3: the concrete diagram of implementing

Embodiment:

As follows based on the software and hardware structure that the file transparent of file header is encrypted:

The transparent encryption software of PC, add file head, windows system.As shown in Figure 3, the operational process of total system is as follows:

Step 1: use " process matching files coupling encryption key is provided with instrument " configuration encryption rule, what file encryption of what process operation.

Step 2: use " process matching files coupling encryption key is provided with instrument ", use the file matched rule of front, travel through whole computing machine, the file that needs are encrypted increases a file header, and to content-encrypt.

Step 3: the user normally used a computer according to former mode.When the process of appointment was opened an encrypt file, kernel module read file header automatically, extracted decryption information, and the key information in the coupling access rule is to reading in the data decryption of internal memory, to writing the data encryption of disk.Open a unencrypted file or new files when (comprising covering) when the process of appointment, kernel module increases file header with the unencrypted file automatically, with content-encrypt; To write the data encryption of disk then, read in the data decryption of internal memory.

Be described below with regard to relevant issues below:

1 file header

Have a mark in the file header, whether file of mark is encrypted, and preserves some other additional information; There is a random key in the file header, is used for enciphered data; User key is encrypted file header.

2 file identification

Use file suffixes, catalogue, or the combination of asterisk wildcard realizes.Support is also supported the file encryption to a type to the encryption of single file, also supports the file encryption under the catalogue.

The identification of 3 processes

Use process name identification or the identification of process complete trails, perhaps the condition code of executable file is discerned.

The deciphering of 4 file headers

After the deciphering, inner mark is consistent with the mark that calculates.

The intercepting and capturing and the processing of 5IO request

The intercepting and capturing of I/O request realize at inner nuclear layer.There are three kinds of situations in request for I/O:

First kind: I/O request (as the inquiry file attribute) is not need to tackle, and for this IO request, directly issues just passable.

Second kind: the IRP (IO Request Packet) for the CACHE mode of file is read and write, directly let slip.

The third: for the IRP (IO Request Packet) that the non-CACHE mode of file is read and write, the position with a file header of read-write deflection will write data encryption, then with the data decryption of reading.

The decrypted state of 6 files and the switching of encrypted state

When a file becomes encryption by deciphering in internal memory, perhaps conversely the time, need to use the mode of clear buffer memorys (CACHE), data in buffer in the internal memory is all flushed on the disk, destroy buffer memory.Allow system rebuild buffer memory then.

7 applications

Reference under the Windows system realizes:

The present invention is successful Application in WINDOWS XP system, and its concrete system is composed as follows: Windows XPProfessional (sp3); User interface program of the present invention and driver.

Process description is as follows:

The present invention has comprised user class under Windows and kernel level is two-layer calls;

The main function that user class is called comprises:

SetPolicyToDriver: be responsible for the rule downloading of process coupling and file coupling is arrived in the driving;

ScanFileAndEncrypt:: be responsible for the scanning DISK to Image, with the file add file head of needs encryption, and encrypted file data.

Operating process is as follows:

Initialization:

Strategy is provided with facility invokes SetPolicyToDriver strategy is set to driving;

Strategy is provided with facility invokes ScanFileAndEncrypt scanning totally, and the file of this encryption is added file header, and data encryption.

Normal operation:

The user operates popular software according to mode in the past.

Claims

1. increase the file transparent encryption method of file header, it is characterized in that comprising following steps:

During initialization, the matched rule of process and file is set;

During initialization, scan DISK to Image, will need the file encryption of encrypting according to the file matched rule;

During normal operation, kernel module at a process file of visit of finding appointment but this file do not encrypt, increase a file header automatically, and with the data encryption behind the file header;

During normal the operation, the process of kernel module discovery appointment is opened an encrypt file, the legitimacy of service marking verification file head;

During normal the operation, kernel module is for encrypt file, and the IO action need relevant with side-play amount adds a side-play amount;

During normal the operation, kernel module reads in the data decryption of internal memory for encrypt file, writes the data encryption of disk.

2. the method for the increase file header that requires according to right 1 is characterized in that:

When using for the first time, the file of user's appointment scanned encrypt all files that need encrypt, need the add file head;

In the normal use of user,, increase file header automatically by driving for the file that does not have in the past to encrypt;

For the file of having encrypted, kernel module uses the data in the file header to do the legitimacy verification.

3. according to the method for right 1 described IO operation skew, it is characterized in that:

All need skew for the IO that writes disk, side-play amount is a file header size;

For not being the IO that writes disk, then do not need skew;

For the file size that application program need be seen, need cut a file header size.

4. described based on encryption method according to right 1, it is characterized in that:

For the data that write disk, increase a file header displacement after, data encryption is write disk;

For the data of reading from disk, increase a file displacement after, data are read and are deciphered.

5. based on the method for right 1 described kill file, it is characterized in that:

Use asterisk wildcard identification filename.

6. based on the method for right 1 described filter course, it is characterized in that:

Use the condition code of the executable program file of the asterisk wildcard coupling process name or the process of use to come the identification process.