Application-based data encryption system and method thereof

1. An application-based data encryption system, comprising:

a first executable file, further comprising a first file header and a first program code, wherein the first file header comprises a first encryption bit;

a second executable file, further comprising a second file header, a second program code, and an encrypted application key, wherein the second file header comprises a second encryption bit;

a system key;

a program security utility, further comprising:

a key generation model, providing an application key; and

a key encryption model, encrypting the application key utilizing the system key to generate the encrypted application key;

wherein the program security utility processes the first executable file to generate the second executable file; and

a crypto operating system, decrypting the encrypted application key using the system key, further comprising:

a file management system, further comprising:

a virtual file system, when the file management system receives a write system call corresponding to an application, determining a file system to which a file to be written for the application belongs and then passing a write request to the determined file system; and

a file system, when the write request is received, calculating a specified address of the file to be written in a storage device based on a file information data structure corresponding to the application and passing the write request;

a crypto driver, receiving the write request from the file system, identifying an encryption bit of a process data structure corresponding to the application to determine whether the application is assigned a secure state, acquiring the application key from the process data structure if the application is assigned the secure state, and encrypting the file to be written utilizing the application key to generate an encrypted file; and

hardware driver, retrieving the write request from the crypto driver and writing the encrypted file into the specified address of the storage device.

2. The system as claimed in claim 1 , wherein the first encryption bit is “0”.

3. The system as claimed in claim 1 , wherein the first executable file is a disk image file of an application not designated.

4. The system as claimed in claim 1 , wherein the second encryption bit is “1”.

5. The system as claimed in claim 1 , wherein the system key is saved as a file or in a memory device.

6. The system as claimed in claim 1 , wherein the system key is provided by the program security utility.

7. The system as claimed in claim 6 , wherein the system key and the application key are embedded keys of the crypto operating system.

8. The system as claimed in claim 1 , wherein data access by an application of the second executable file is encrypted or decrypted utilizing the application key decrypted from the encrypted application key.

9. The system as claimed in claim 1 , wherein the system key or the application key comprises an encryption key and a decryption key.

10. The system as claimed in claim 1 , further comprising a process management system, wherein the program security utility and the process management system further designates the crypto operating system to the secure state.

11. The system as claimed in claim 10 , wherein the crypto operating system in the secure state performs corresponding encryption or decryption operations for all output or input data of all applications.

12. An application-based data encryption method, comprising:

providing a system key, a first executable file, and a second executable file, wherein the first executable file comprises a first file header and a first program code and the first file header comprises a first encryption bit, and the second executable file comprises a second file header, a second program code, and an encrypted application key and the second file header comprises a second encryption bit;

providing a program security utility, further comprising:

a key generation model, providing an application key; and

a key encryption model, encrypting the application key utilizing the system key to generate the encrypted application key;

processing the first executable file to generate the second executable file using the program security utility; and

decrypting the encrypted application key according to the system key using a crypto operating system, wherein the crypto operating system comprises a file management system, a crypto driver, and hardware driver and, when the file management system receives a write system call corresponding to an application, the method further comprises:

determining a file system to which a file to be written for the application belongs and then passing a write request to the determined file system using a virtual file system;

when the write request is received, calculating a specified address of the file to be written in a storage device based on a file information data structure corresponding to the application and passing the write request to the crypto driver using the file system;

the crypto driver receiving the write request from the file system, identifying an encryption bit of a process data structure corresponding to the application to determine whether the application is assigned a secure state, acquiring the application key from the process data structure if the application is assigned the secure state, and encrypting the file to be written utilizing the application key to generate an encrypted file; and

retrieving the write request from the crypto driver and writing the encrypted file into the specified address of the storage device using the hardware driver.

13. The method as claimed in claim 12 , wherein the first encryption bit is “0”.

14. The method as claimed in claim 12 , wherein the first executable file is a disk image file of an application not designated.

15. The method as claimed in claim 12 , wherein the second encryption bit is “1”.

16. The method as claimed in claim 12 , wherein the system key is saved as a file or in a memory device.

17. The method as claimed in claim 12 , wherein the system key is provided by the program security utility.

18. The method as claimed in claim 17 , wherein the system key and the application key are embedded keys of the crypto operating system.

19. The method as claimed in claim 12 , wherein data access by an application of the second executable file is encrypted or decrypted utilizing the application key decrypted from the encrypted application key.

20. The method as claimed in claim 12 , wherein the system key or the application key comprises an encryption key and a decryption key.

21. The method as claimed in claim 12 , wherein the crypto operating system is designated to the secure state using the program security utility.

22. The method as claimed in claim 21 , wherein corresponding encryption or decryption operations are performed for all output or input data of all applications using the crypto operating system in the secure state.

23. The system as claimed in claim 1 , wherein:

when the file management system receives a read system call corresponding to the application, the virtual file system of the file management system determines a file system to which the file belongs and then passes a read request to the determined file system;

when the read request is received, the file system calculates the specified address of the file in the storage device based on the file information data structure and passes the read request to crypto driver;

the crypto driver passes the read request to the hardware driver;

the hardware driver reads the file from storage device into a buffer cache;

the crypto driver identifies the encryption bit to determine whether the application is assigned the secure state, if the application is assigned the secure state, acquires the application key from the process data structure to decrypt the file, and passes the decrypted file to the file management system; and

the file management system provides the decrypted file to the application.

24. The method as claimed in claim 12 , further comprising:

determining a file system to which the file belongs and then passing a read request to the determined file system using the virtual file system when the file management system receives a read system call corresponding to the application;

calculating the specified address of the file in the storage device based on the file information data structure and passing the read request to crypto driver using the file system when the read request is received;

passing the read request to the hardware driver using the crypto driver;

reading the file from storage device into a buffer cache using the hardware driver;

identifying the encryption bit to determine whether the application is assigned the secure state, if the application is assigned the secure state, acquiring the application key from the process data structure to decrypt the file, and passing the decrypted file to the file management system using the crypto driver; and

providing the decrypted file to the application by the file management system.