| With the rapid development of emerging technologies such as big data and cloud computing,the demand for large-scale data storage is growing.Sensitive data for individuals and businesses face potential security threats during storage and archive,such as unauthorized access,disclosure,theft and tampering.In order to protect user's data security,many cryptographic file systems are designed to provide transparent and secure data encryption and decryption services when users read and write files.However,cryptographic calculations are often very time consuming and require a large amount of system computing resources.Therefore,the introduction of encryption and decryption computing services in the file system can lead to severe read and write performance degradation.In this paper,the stackable cryptographic file system eCryptfs and the state-of-the-art cryptographic computing acceleration technology: encryption instruction set AES-NI and hardware accelerator QAT are deeply studied.The study found that the cause of the decline in the read and write performance of the cryptographic file system not only exist in the complex cryptographic calculation process,but the synchronous I/O software stack of eCryptfs is also a key factor leading to the performance decline.The synchronous I/O software stack of eCryptfs,including data encryption/decryption and data I/O operations,limits the performance of cryptographic computing,and affects the overall read and write performance of the encrypted file system.In order to solve the problem of declining read and write performance of cryptographic file system,this paper proposes an asynchronous eCryptfs file cryptographic system based on NVM.In this system,a new asynchronous I/O software stack is designed for the stackable cryptographic file system eCryptfs.The non-volatile memory(NVM)is used as the cache of eCryptfs to realize the parallelization of data encryption/decryption and data I/O operations,which effectively mitigates the I/O latency and improves read and write performance of the whole system.This paper also designs an efficient NVM space management scheme for NVM cache,which enables NVM cache to better support eCryptfs fast parallel encryption operations.In addition to providing a directly accessible NVM address space for hardware accelerators,this scheme also records the space allocation status of NVM cache and provides a backup plan to handle NVM shortages.In this paper,an additional index is built for the NVM cache to ensures that the system can determine whether a data is cached in the NVM cache by quickly look up operations.In addition,this paper designs a data cryptographic preprocessing mechanism for the asynchronous eCryptfs file cryptographic system based on NVM,which enables the system to perform data splitting or data aggregation on the data to be encrypted through the data reorganization strategy and according to the access mode of user's I/O requests and the size of the data.Then the system can select the optimal cryptographic acceleration method for the data to be encrypted through the encryption strategy according to the size of data to be encrypted,thereby fully utilizing the instruction set and hardware acceleration to improve the encryption performance of the system and read and write performance.The test results show that the proposed asynchronous eCryptfs file cryptographic system based on NVM can achieve higher read/write performance and lower I/O latency than the eCryptfs cryptographic file system using the original synchronous I/O software stack. |
