Key protection implementation method, device and electronic device

Abstract

The present application proposes a key protection implementation method, device and electronic device. During the operation of the electronic device operating system, in order to realize encryption protection of the electronic device data, after starting the data protection application of the electronic device and obtaining the key information used for encrypting the electronic device data, the embodiment of the present application sends the key information to the first storage space of the first controller for storage. Since the first controller is a component in the electronic device, the key information will not be lost due to loss like a USB flash memory device; and since the first controller is the controller that guides the operating system to start running when the electronic device passes the system power-on self-test, the security of the key information storage is improved, and it is convenient to view the stored key information before the operation is started, which solves the problem that in the application of hard disk storage of key information, the stored key information cannot be viewed when the operating system starts normally.

Description

Technical Field

[0001] The present application mainly relates to the field of data protection applications, and more specifically to a key protection implementation method, device and electronic device. Background Art

[0002] Electronic devices usually use installed data protection applications such as BitLocker to implement encryption protection of important data such as the operating system and user data of the electronic device. Among them, BitLocker can better protect the important data of the electronic device by encrypting all data stored on the entire drive volume, and the encryption key Key of the BitLocker is usually stored in the hard disk or USB flash memory device of the electronic device, so that the stored encryption key Key can be viewed when accessing the disk of the BitLocker encrypted data later.

[0003] However, in scenarios such as hardware changes or updating of system configuration data of electronic devices, the operating system of the electronic device cannot run, resulting in the inability to perform read operations on the hard disk, and the encryption key Key stored on the hard disk cannot be viewed; and for the solution of using USB flash memory devices to store the encryption key Key, the storage content of the USB flash memory device is easily lost, and the storage security of the BitLocker encryption key Key cannot be guaranteed. Summary of the invention

[0004] In view of this, this application provides the following technical solutions:

[0005] On the one hand, the present application proposes a key protection implementation method, the method comprising:

[0006] The first controller acquires key information, wherein the key information is obtained when the second controller responds to a disk encryption startup request for the electronic device and triggers the data protection application to run during the operation of the operating system of the electronic device; the first controller is used to guide the operating system to start running when the system power-on self-test of the electronic device passes;

[0007] The key information is sent to the first storage space of the first controller for storage.

[0008] In some embodiments, the process of obtaining the key information includes:

[0009] The second controller responds to the disk encryption startup request for the electronic device, triggers the data protection application to run, generates a disk encryption key, and outputs key security storage prompt information; wherein the key security storage prompt information is used to remind the user whether to store the disk encryption key in the first storage space of the first controller;

[0010] The second controller obtains key information including the disk encryption key in response to a confirmation operation on the key security storage prompt information.

[0011] In some embodiments, the method further comprises:

[0012] In response to the system configuration operation on the electronic device, a system configuration page is output; wherein the system configuration page includes a key query item for a disk encryption key;

[0013] In response to a confirmation query operation on a target key identifier displayed by the key query item, generating a target key query event for the target key identifier;

[0014] Execute the target key query event to obtain the target disk encryption key associated with the target key identifier in the first storage space;

[0015] The target disk encryption key is output.

[0016] In some embodiments, obtaining key information including the disk encryption key includes:

[0017] The second controller outputs a query encryption interface for the disk encryption key;

[0018] The second controller obtains the key identification and decryption authentication information of the disk encryption key in response to the input operation on the query encryption interface;

[0019] The second controller encrypts the disk encryption key using the decryption authentication information, and the encrypted disk encryption key, the key identifier and the decryption authentication information constitute key information.

[0020] In some embodiments, executing the target key query event to obtain the target disk encryption key associated with the target key identifier in the first storage space includes:

[0021] Execute the target key query event to obtain the information to be authenticated and the target decryption authentication information for the target key identifier;

[0022] Matching and comparing the information to be authenticated with the target decryption authentication information;

[0023] If the information to be authenticated matches the target decryption authentication information, a target disk encryption key encrypted by the target authentication information in the first storage space is obtained.

[0024] In some embodiments, in response to a confirmation query operation on the target key identifier presented by the key query item, generating a target key query event for the target key identifier includes:

[0025] In response to a triggering operation on the key query item, outputting a key query page, wherein the key query page includes a key identifier corresponding to each disk encryption key stored in the first storage space;

[0026] In response to a key identifier selection operation on the key query page, a target key identifier of the disk encryption key to be queried is determined, and a target key query event including the target key identifier is generated.

[0027] In some embodiments, executing the target key query event to obtain the information to be authenticated and the target decryption authentication information for the target key identifier includes:

[0028] Executing the target key query event, reading the target decryption authentication information associated with the target key identifier in the first storage space, and outputting a key query authentication page;

[0029] In response to an input operation on the key query authentication page, information to be authenticated for a target key identifier is obtained.

[0030] On the other hand, the present application also proposes a key protection implementation device, the device comprising the following modules located in a first controller, the first controller being used to guide the operating system of the electronic device to start running when the electronic device passes the system power-on self-test:

[0031] A key information acquisition module, used to acquire key information, wherein the key information is obtained by the second controller starting the data protection application in response to a disk encryption startup request for the electronic device during the operation of the operating system of the electronic device;

[0032] The key information transmission module is used to send the key information to the first storage space of the first controller for storage.

[0033] In some embodiments, the apparatus further comprises the following module located in the second controller:

[0034] A key generation module, used to respond to a disk encryption startup request for an electronic device, trigger the data protection application to run, and generate a disk encryption key;

[0035] A key storage prompt module, used for outputting key security storage prompt information; wherein the key security storage prompt information is used to remind the user whether to store the disk encryption key in the first storage space of the first controller;

[0036] The key information obtaining module is used to obtain the key information including the disk encryption key in response to a confirmation operation on the key security storage prompt information.

[0037] On the other hand, the present application also proposes an electronic device, the electronic device comprising:

[0038] Motherboard;

[0039] A first controller and a second controller are arranged in the mainboard, wherein the first controller is used to guide the operating system of the electronic device to start running when the electronic device passes the system power-on self-test;

[0040] The second controller is used to respond to a disk encryption startup request for the electronic device during the operation of the operating system of the electronic device, trigger the operation of the data protection application, and obtain corresponding key information;

[0041] The first controller is used to obtain the key information and send the key information to the first storage space for storage.

[0042] It can be seen that the present application provides a key protection implementation method, device and electronic device. During the operation of the electronic device operating system, in order to realize encryption protection of the electronic device data, after starting the data protection application of the electronic device and obtaining the key information used to encrypt the electronic device data, the embodiment of the present application sends the key information to the first storage space of the first controller for storage. Since the first controller is a component in the electronic device, it will not cause the loss of key information due to loss like a USB flash memory device; and since the first controller is the controller that guides the operating system to start running when the electronic device passes the system power-on self-test, the security of key information storage is improved, and it is convenient to view the stored key information before the operation is started, which solves the technical problem that in the hard disk storage key information application, the stored key information cannot be viewed when the operating system starts normally, which causes the user to be unable to correctly enter the key information and further view the disk data. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0044] Figure 1 A schematic diagram of a signaling flow of an optional example of a key protection implementation method proposed in this application;

[0045] Figure 2 A signaling flow diagram of another optional example of the key protection implementation method proposed in this application;

[0046] Figure 3 A signaling flow diagram of another optional example of the key protection implementation method proposed in this application;

[0047] Figure 4 A schematic diagram of the structure of an optional example of a key protection implementation device proposed in this application;

[0048] Figure 5 A schematic diagram of the structure of another optional example of the key protection implementation device proposed in this application;

[0049] Figure 6 A schematic diagram of the structure of another optional example of the key protection implementation device proposed in this application;

[0050] Figure 7 The present invention is a schematic diagram of the hardware structure of an optional example of an electronic device suitable for the key protection implementation method and device proposed in the present application. DETAILED DESCRIPTION

[0051] In response to the technical problems described in the background technology part, when an electronic device uses the BitLocker data protection application, it is desired to store the encryption key Key generated by BitLocker for the electronic device in the electronic device to solve the problem of easy loss when stored in a mobile storage device such as a USB flash memory device; at the same time, in order to solve the technical problem that when the encryption key Key is directly written to the hard disk for storage, the data on the hard disk cannot be read before the operating system of the electronic device is run, resulting in the inability to query the encryption key Key stored on the hard disk, the application further proposes to store the encryption key Key in a storage space that can perform data read and write operations without starting the operating system.

[0052] Based on the above considerations, combined with the application of each configuration component of the electronic device, it is proposed to use the first controller that enters the running state before the operating system of the electronic device is started, and store the encryption key Key generated by BitLocker to its preset first storage space, such as writing the encryption key Key into the first storage space of the BIOS (Basic Input Output System) SPI (Service Provider Interface, such as an application program interface that meets a certain service standard, which can be an interface type of the BIOS chip in this application, but is not limited to this interface type) ROM for storage. Combined with the working principle of BIOS, it can be known that this key storage method of the present application solves the technical problems existing in the storage of encryption keys Key in the above-mentioned mobile storage device or hard disk.

[0053] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0054] It should be noted that, for the convenience of description, only the parts related to the relevant invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0055] It should be understood that the "system", "device", "unit" and / or "module" used in this application is a method for distinguishing different components, elements, parts, portions or assemblies at different levels. However, if other words can achieve the same purpose, the word can be replaced by other expressions.

[0056] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "a kind" and / or "the" do not refer to the singular, but also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of clearly identified steps and elements, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements. The elements defined by the sentence "includes a..." do not exclude the existence of other identical elements in the process, method, commodity or device that includes the elements.

[0057] Among them, in the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" refers to two or more than two. The following terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0058] Reference Figure 1 , is a signaling flow diagram of an optional example of the key protection implementation method proposed in this application. The method can be applied to electronic devices, which may include but are not limited to: tablet computers, personal computers (PCs), netbooks, robots, desktop computers, etc. This application does not limit the product type of the computer device, which can be determined according to the situation. In the embodiment of the present application, the electronic device has a first controller and a second controller. The first controller is used to guide the operating system to start running when the electronic device passes the system power-on self-test, such as the above-mentioned BIOS chip.

[0059] like Figure 1 As shown, the key protection implementation method proposed in the embodiment of the present application may include:

[0060] Step S11, the second controller responds to the disk encryption start request for the electronic device, triggers the data protection application to run, and obtains key information;

[0061] In actual applications of this embodiment, during the operation of the operating system of the electronic device, for example, when the user is using the electronic device normally, he or she wishes to encrypt and protect important data (such as operating system data, user data, etc.) stored in the electronic device so that it cannot be easily viewed by outsiders. This can trigger the operation of a data protection application installed on the electronic device, such as enabling the BitLocker drive encryption service of the electronic device.

[0062] Specifically, the disk encryption startup operation can be performed on the electronic device according to the preset startup mode to generate a corresponding disk encryption startup request. The electronic device responds to the disk encryption startup request, enables the BitLocker drive encryption service, and obtains the corresponding key information, that is, the access key for the access operation of the requested encryption protection disk. At the same time, after the data protection application is run, it will use the key information to implement encryption processing on the disk. In this way, when accessing the disk subsequently, the corresponding key needs to be entered to successfully access the data in the disk, which improves the security of the data stored on the disk.

[0063] For example, when the operating system of the electronic device is successfully started and running, the user can open the control panel of the electronic device, find the BitLocker driver service for implementing the corresponding disk data encryption protection in the local service of the component service, double-click to enter its configuration interface, change its startup type from disabled to enabled, generate a corresponding disk encryption startup request, control the startup of BitLocker, and implement encryption processing of disk data through the BitLocker driver encryption service. However, it is not limited to the working process of the data protection application described in this embodiment.

[0064] It should be noted that the key information obtained after the data protection application of the electronic device is started at least includes the key generated after the data protection application is started, such as the BitLocker encryption key Key generated after the BitLocker drive encryption service is started, but is not limited to this information content and can be determined according to actual application requirements. The embodiments of this application will not be described in detail here.

[0065] Step S12, the first controller obtains the key information obtained by the second controller;

[0066] Step S13: The first controller sends the key information to its first storage space for storage.

[0067] In an embodiment of the present application, after the second controller obtains the key information in the above manner, it can actively write the key information into the first storage space of the first controller for storage; or when the electronic device determines that the first storage space of the first controller stores the key information obtained by starting the data protection application, the first controller actively detects whether the second controller obtains the key information. If it is determined that the second controller obtains the key information, the first controller can actively read the key information from the cache space of the second controller and write it into its preset first storage space for storage, etc. The specific implementation method of step S12 is not described in detail in this application.

[0068] For example, if the first controller is a BIOS chip and the second controller is a CPU, the first storage space of the first controller may be a BIOS ROM, which may be a PROM (Programmable ROM), an EPROM (Electrically Erasable Programmable ROM), etc. This application does not elaborate on the storage type and storage principle of the first storage space. In combination with the working principle of BIOS refresh and upgrade, the CPU can call a preset application program interface for writing data to the BIOS ROM to implement the storage of the key information of this application.

[0069] Specifically, taking the scenario of storing key information in the first storage space of the BIOS SPI ROM as an example, the obtained key information can be written into the BIOS register through the SPI controller in the Platform Controller Hub (PCH) on the system platform (such as the Intel platform), that is, the first storage space corresponding to the preset storage address of the BIOS SPI ROM is stored. This application does not limit the specific implementation process of enabling the BIOS ROM write operation and completing the writing of the key information into the BIOS ROM, including but not limited to the operation method described above.

[0070] In some embodiments, in order to further improve the storage security of the key information, according to actual needs, after completing the key information writing operation, a write protection operation can be performed on the BIOS ROM. The specific implementation process of the write protection operation is not described in detail in this application.

[0071] To summarize, during the operation of the electronic device operating system, in order to achieve encryption protection of the electronic device data, after starting the data protection application of the electronic device and obtaining the key information used to encrypt the electronic device data, the embodiment of the present application sends the key information to the first storage space of the first controller for storage. Since the first controller is a component in the electronic device, the key information will not be lost due to loss like a USB flash memory device; and since the first controller is the controller that guides the operating system to start running when the electronic device passes the system power-on self-test, the security of the key information storage is improved, and it is convenient to view the stored key information before the operation is started, which solves the technical problem that in the application of hard disk storage of key information, the stored key information cannot be viewed when the operating system starts normally, which in turn causes the user to be unable to correctly enter the key information and further view the disk data.

[0072] Reference Figure 2, which is a signaling flow diagram of another optional example of the key protection implementation method proposed in the present application. This embodiment can provide a detailed description of the process of obtaining the above-mentioned key information, but is not limited to this detailed implementation method, and describes the query application process of the stored key information, which is not limited to the key query implementation method described in this embodiment. The key query implementation method can also be applied to the key data implementation method described in the above embodiment, to obtain another optional example. The implementation process can refer to the description of this embodiment, and this application will not describe them in detail one by one.

[0073] like Figure 2 As shown, the key protection implementation method proposed in the embodiment of the present application may include:

[0074] Step S21, the second controller responds to the disk encryption start request for the electronic device, triggers the data protection application to run, generates a disk encryption key, and outputs key security storage prompt information;

[0075] Among them, the key security storage prompt information can be used to remind the user whether to store the disk encryption key in the first storage space of the first controller. This application does not display the content contained in the key security storage prompt information and its output method.

[0076] In a possible implementation, the second controller can display a key security storage prompt window on the current display page when the data protection application is successfully started or when the disk encryption key is generated, and display the key security storage prompt information through the key security storage prompt window, such as presenting in the key security storage prompt window, "The key is securely stored in the first storage space of the first controller" and two function buttons "Yes" and "No" for the user to choose, and the user can choose the corresponding function button according to actual needs. It should be noted that the output method of the key security storage prompt information is not limited to this implementation method, and can be determined according to actual needs, and this application does not list them one by one.

[0077] Step S22, the second controller obtains key information including the disk encryption key in response to a confirmation operation on the key security storage prompt information;

[0078] Continuing the optional example described above, the user can select the "Yes" function button in the output key security storage prompt window, that is, confirm the key security storage prompt information, so that the second controller of the electronic device detects the selection operation of this function button, that is, the confirmation operation of the key security storage prompt information, and determines the subsequent storage path of the obtained key information for disk encryption, that is, the storage path for writing the obtained disk encryption key information into the first storage space of the first controller for storage. The specific storage path can be determined according to the implementation method of writing data into the first storage space of the first controller, which is not described in detail in the embodiments of the present application.

[0079] It should be noted that the present application can obtain key information containing the disk encryption key after obtaining a confirmation operation on the key security storage prompt information, such as automatically reading the generated disk encryption key and thereby generating corresponding key information, etc.; of course, it is also possible to output the key security storage prompt information after obtaining the key information containing the disk encryption key and before performing the storage operation, and then determine the storage path of the key information in the above manner. The present application does not impose any restrictions on the execution order of obtaining the key information and outputting the key security storage prompt information, which can be determined according to the circumstances.

[0080] Step S23, the second controller sends the key information to the first storage space of the first controller for storage;

[0081] For the specific implementation process of step S23, please refer to the description of the corresponding part of the above embodiment, and the embodiment of the present application will not be repeated here.

[0082] Step S24, the first controller outputs a system configuration page in response to the system configuration operation on the electronic device;

[0083] In actual application, when it is necessary to view the data in the disk encrypted by the key information, the user needs to first obtain the key information used to encrypt the disk, specifically the disk encryption key. As described above, the key information is stored in the first storage space of the first controller. Combined with the above description of the application process of the first controller, the system configuration page of the first controller can be entered, such as entering the BIOS working mode and outputting the BIOS system configuration page. In this case, the system configuration operation of the electronic device can specifically refer to the startup operation of the BIOS working mode. The specific implementation method of the startup operation is not described in detail in this application, and can be determined according to the working principle of the BIOS.

[0084] Therefore, in the embodiment of the present application, whether in the operation process of the electronic device or in the power-on startup process of the electronic device, the BIOS working mode can be entered to output the BIOS system configuration page to query the key information stored in the BIOS ROM. This application does not describe in detail the implementation method of how to enter the BIOS working mode.

[0085] As analyzed above, the system configuration page output by this application may include a key query item for the disk encryption key, but the specific representation of the key query item is not limited. Optionally, the key query item can be a function button displayed on the system configuration page; it can also be a lower-level menu option in the query menu on the system configuration page, etc. Its deployment relationship in the system configuration page can be determined according to actual conditions, and this application does not list them one by one.

[0086] Step S25, the first controller generates a target key query event for the target key identifier in response to a confirmation query operation on the target key identifier displayed by the key query item;

[0087] Continuing the above description, after the electronic device outputs the system configuration page, selecting the key query item it contains can display the key identifiers of various encryption keys, such as the key names configured in the process of generating each encryption key. The present application does not restrict the content of the key identifier. Normally, the content of the key identifier can directly represent which service's encryption password the corresponding encryption key is, so as to facilitate the user to directly determine the key identifier of the target disk encryption key to be queried based on the content of each displayed key identifier, and determine it as the target key identifier.

[0088] It should be noted that this application does not limit the number, content and display method of the key identifiers contained in the key query items, and can be configured according to actual needs, such as displaying each key identifier in a list format, and the user views the content of each key identifier and selects the target key identifier corresponding to the target key to be queried. For example, clicking the displayed target key identifier can realize the confirmation query operation of the target key identifier, but it is not limited to this confirmation query operation.

[0089] When the user performs a confirmation query operation on the target key identifier displayed by the key query item, the first controller in the electronic device will detect this confirmation query operation and generate a target key query event for the target key identifier. The target key query event can be a control instruction or a request to query the target disk encryption key, etc. The present application does not impose any restrictions on the representation form of the target key query event, which may be determined depending on the circumstances.

[0090] Step S26, the first controller executes the target key query event to obtain the target disk encryption key associated with the target key identifier in the first storage space;

[0091] Step S27: the first controller outputs the target disk encryption key.

[0092] After determining the target key identifier of the target disk encryption key to be queried in the above manner, the first controller executes the corresponding target key query event, and can query the target disk encryption key associated with the target key identifier from its first storage space. The specific query method is not described in detail in this application. The queried target disk encryption key can be directly displayed on the system configuration page, such as generating a key display window, and outputting the queried target disk encryption key in the key display window, so that the user can intuitively see the target disk encryption key and record it.

[0093] After that, when accessing the disk data encrypted by the target disk encryption key, the key input window is output, and the user can directly input the target disk encryption key that has been queried and recorded in advance into the corresponding position in the key input window. After verification, the disk data can be successfully accessed. Of course, after the target disk encryption key is successfully queried, the queried key input window can also be automatically input into the corresponding position in the key input window when the key input window is output, without the need for the user to record and manually input it.

[0094] It can be seen that the above-mentioned step S24 can be that the first controller directly outputs the queried target disk encryption key; according to application requirements, the first controller can also send it to the corresponding application for display. This application does not limit the specific implementation method of step S24 and is not limited to the output implementation method described in this application.

[0095] In summary, in an embodiment of the present application, during the operation of the electronic device operating system, the data protection application of the electronic device is started, and after obtaining the key information used to encrypt the data of the electronic device, the present application can prompt the user whether the disk encryption key contained in the key information needs to be sent to the first storage space of the first controller for storage, so as to improve the storage security of the disk encryption key. At this time, the user can select yes or no according to the actual security requirements for key storage. If yes is selected, the obtained key information containing the disk encryption key is sent to the first storage space of the first controller for storage, thereby solving the technical problem that the disk encryption key stored in the mobile storage device is easily lost or deleted.

[0096] And in the case where it is necessary to view the disk encryption key, since the present application writes the disk encryption key into the first storage space of the first controller for storage, the first controller can run before the operating system is started and read the data stored in its first storage space. Therefore, when it is necessary to view the disk encryption key before starting the operating system, the present application can enter the system configuration page of the first controller, and in the key query item of the system configuration page, select the target key identifier corresponding to the disk encryption key to be queried, so that the first controller executes the target key query event generated thereby, queries the target disk encryption key from its first storage space and outputs it, thereby solving the technical problem that the hard disk of the electronic device or an independent mobile storage device stores the disk encryption key, and cannot perform data reading operations before the operating system is successfully started and run, and therefore cannot view the required target disk encryption key.

[0097] Reference Figure 3 , which is a signaling flow diagram of another optional example of the key protection implementation method proposed in this application. This embodiment can be another optional detailed implementation method of the key protection implementation method described in the above embodiment, but is not limited to the detailed implementation method described in this embodiment. For the steps performed in the two stages of disk encryption key storage and query, they can be adaptively adjusted according to the corresponding technical concepts proposed in this application. The specific adjustment implementation process is not described in detail in this application.

[0098] like Figure 3 As shown, the key protection implementation method proposed in this embodiment may include:

[0099] Step S31, the second controller responds to the disk encryption start request for the electronic device, triggers the data protection application to run, generates a disk encryption key, and outputs key security storage prompt information;

[0100] For the specific implementation process of step S31, reference may be made to the description of the corresponding part of the above embodiment, which will not be elaborated in this embodiment.

[0101] Step S32, the second controller outputs a query encryption interface for the disk encryption key in response to a confirmation operation on the key security storage prompt information;

[0102] Step S33, the second controller obtains the key identification and decryption authentication information of the disk encryption key in response to the input operation on the query encryption interface;

[0103] In combination with the description of the corresponding parts of the above embodiments, in order to further improve the storage security of the disk encryption key, the embodiment of the present application proposes to encrypt it first and then send it to the first storage space of the first controller for storage.

[0104] Based on this, during the operation of the operating system of the electronic device, such as under the Windows OS operating system, after the user starts BitLocker, the user can be prompted whether to store the disk encryption key Key generated by BitLocker to the first storage space of the first controller. If yes is selected, the display interface of the electronic device can output a query encryption interface for the disk encryption key, for the user to enter the key identification and decoding authentication information of the disk encryption key, such as the name of the Key and the encryption password. This application does not restrict the content of the key identification and decoding authentication information and the input method, which can be determined according to the circumstances.

[0105] In some embodiments, the above-mentioned decoded authentication information can be information composed of characters such as numbers, letters, symbols, and text, or it can be composed of the user's physiological characteristics such as facial images, voiceprints, fingerprints, etc., depending on the situation, and this application will not describe them in detail here.

[0106] Step S34, the second controller encrypts the disk encryption key using the decryption authentication information, and the encrypted disk encryption key, the key identifier and the decryption authentication information constitute the key information;

[0107] In the actual application of this embodiment, an encryption tool such as Bitlocker can be used to complete the encryption processing of the disk encryption key using the preset decryption authentication information; of course, other encryption application tools can also be used to implement the encryption processing of the disk encryption key. This application does not limit the specific encryption processing process of step S34, which can be determined according to the situation.

[0108] Step S35, the second controller sends the key information to the first storage space of the first controller for storage;

[0109] Step S36, the first controller outputs a system configuration page in response to the system configuration operation on the electronic device;

[0110] As analyzed above, the system configuration page of this embodiment may include a key query item for a disk encryption key, but the specific output method of the key query item is not limited.

[0111] Step S37, the first controller outputs a key query page in response to the triggering operation on the key query item;

[0112] In combination with the description of the disk encryption key query process in the above embodiment, the present application can be performed by the first controller to query the target disk encryption key stored in its first storage space before the electronic device is powered on and the operating system is booted.

[0113] Specifically, taking the first controller as a BIOS chip as an example, when you want to query the target disk encryption key, you can enter BIOS Steup, output the system configuration page, and display the key identifiers corresponding to each encryption key that can be queried. This embodiment can be displayed on the output key query page, that is, the key query page can include the key identifiers corresponding to each disk encryption key stored in the first storage space. The specific implementation process can refer to the description of the corresponding part of the above embodiment.

[0114] Step S38, the first controller determines the target key identifier of the disk encryption key to be queried in response to the key identifier selection operation on the key query page, and generates a target key query event including the target key identifier;

[0115] Step S39, the first controller executes a target key query event to obtain information to be authenticated for the target key identifier and target decryption authentication information;

[0116] In this embodiment, since the disk encryption key is encrypted before being sent to the first storage space of the first controller for storage, when the disk encryption key needs to be queried, it needs to be decrypted before the disk encryption key can be read. Therefore, after selecting the target key identifier of the disk encryption key to be queried and executing the generated corresponding target key query event, the user needs to first input the decryption key used to implement the encryption processing of the target disk encryption key, that is, the information to be authenticated.

[0117] In one possible implementation, the first controller can read the target decryption authentication information associated with the target key identifier in the first storage space, and output a key query authentication page so that the user can complete the input operation of the above-mentioned information to be authenticated on the key query authentication page. The first controller can obtain the information to be authenticated for the target key identifier in response to the input operation of the key query authentication page, but is not limited to this method of obtaining the information to be authenticated.

[0118] For the above-mentioned target decryption authentication information acquisition process, the decryption authentication information corresponding to the target key identifier can be queried from the first storage space of the first controller. For the convenience of description, this application will record it as target decryption authentication information.

[0119] Step S310, the first controller matches and compares the authentication information to be authenticated with the target decryption authentication information;

[0120] Step S311, when the first controller determines that the information to be authenticated matches the target decryption authentication information, the first controller obtains the target disk encryption key encrypted by the target authentication information in the first storage space;

[0121] Step S312: the first controller outputs the target disk encryption key.

[0122] In an embodiment of the present application, the specific matching and comparison method of step S310 can be determined based on the content of the preset decryption authentication information. For the decryption authentication information composed of characters, the information to be authenticated and the information content contained in the target decryption authentication information can be compared one by one in order. If the comparison results (including the content of each character and its order) are consistent, it can be considered that the information to be authenticated matches the target decryption authentication information; otherwise, it can be considered that the two do not match. At this time, the user can be prompted to re-enter the correct decryption authentication information, and the specific prompt implementation method is not limited.

[0123] For decryption authentication information of other contents, the matching comparison method adopted may be different, and the conditions for determining whether a match is made may be different. This application does not limit this and it may be determined according to the circumstances. For example, for physiological feature information, a preset recognition model can be used to implement identity authentication of the user to determine whether the user is allowed to query the disk encryption key stored in the first storage space of the first controller of the electronic device. The specific implementation process is not described in detail in this application.

[0124] To summarize, in the embodiments of the present application, relative to the key protection implementation method described in the above embodiments, before the disk encryption key generated by the data protection application (such as Bitlocker) is sent to the first controller for storage, in order to further improve its storage security and avoid inquiries by irrelevant personnel, it will be encrypted first. At the same time, in order to facilitate subsequent inquiries about the disk encryption key, a corresponding key identifier can be configured. The encrypted disk encryption key, key identifier and decryption authentication information obtained, as well as the association between the three, constitute a key information, which is then sent to the first storage space of the first controller for storage.

[0125] In this way, when querying the disk encryption key of this electronic device, the user is required to input the decryption key, that is, the information to be authenticated, and decrypt the disk encryption key in the stored key information. After determining that the input information to be authenticated matches the corresponding target decryption authentication information, the target disk encryption key will be successfully read and output to meet the user's viewing needs for the target disk encryption key, and at the same time solve the technical problems existing in storing disk encryption keys on the hard disk of an electronic device or an independent mobile storage device.

[0126] Reference Figure 4, which is a structural diagram of an optional example of a key protection implementation device proposed in the present application. Combined with the scheme description of the key protection implementation method described above, it can be seen that the key protection implementation device proposed in this embodiment may include the following modules located in the first controller 410. As analyzed above, the first controller 410 can be used to guide the operating system of the electronic device to start running when the system power-on self-test of the electronic device passes, such as a BIOS chip, etc.:

[0127] The key information acquisition module 411 is used to acquire key information;

[0128] Among them, Figure 4 As shown, the key information may be generated by the second controller 420 in response to a disk encryption startup request for the electronic device and starting a data protection application during the operation of the operating system of the electronic device. The specific acquisition process is not described in detail in this application.

[0129] The key information storage module 412 is used to send the key information to the first storage space of the first controller for storage.

[0130] Taking the first controller as a BIOS chip as an example, its first storage space may be a preset storage space in the BIOS ROM. The present application does not restrict the creation process of the first storage space, which may be determined according to the circumstances.

[0131] In some embodiments, the second controller obtains key information, such as Figure 5 As shown, the key protection implementation device proposed in the present application may also include: the following functional modules located in the second controller 420:

[0132] The key generation module 421 is used to respond to the disk encryption start request for the electronic device, trigger the data protection application to run, and generate a disk encryption key;

[0133] The key storage prompt module 422 is used to output key security storage prompt information; wherein the key security storage prompt information is used to remind the user whether to store the disk encryption key in the first storage space of the first controller;

[0134] The key information obtaining module 423 is used to obtain the key information including the disk encryption key in response to the confirmation operation of the key security storage prompt information.

[0135] Based on the composition structure of the key protection implementation device described in the above embodiment, in order to query the stored target disk encryption key Key, such as Figure 6 As shown, the first controller 410 may further include:

[0136] A system configuration page output module 413, configured to output a system configuration page in response to a system configuration operation on the electronic device;

[0137] The system configuration page includes a key query item for the disk encryption key.

[0138] A target key query event generating module 414, configured to generate a target key query event for the target key identifier in response to a confirmation query operation on the target key identifier displayed by the key query item;

[0139] A target disk encryption key acquisition module 415 is used to execute the target key query event to acquire the target disk encryption key associated with the target key identifier in the first storage space;

[0140] The target disk encryption key output module 416 is used to output the target disk encryption key.

[0141] Based on this, in the above embodiment, the key information obtaining module 423 in the second controller may specifically include:

[0142] A query encryption interface output unit, used to output a query encryption interface for the disk encryption key;

[0143] An information obtaining unit, used to obtain the key identification and decryption authentication information of the disk encryption key in response to an input operation on the query encryption interface;

[0144] The key information forming unit is used to encrypt the disk encryption key using the decryption authentication information, and the encrypted disk encryption key, the key identifier and the decryption authentication information form the key information.

[0145] Accordingly, in a possible implementation, the target disk encryption key acquisition module 415 may include:

[0146] An authentication information acquisition unit, used to execute the target key query event, obtain the information to be authenticated for the target key identifier and the target decryption authentication information;

[0147] A matching and comparing unit, used for matching and comparing the information to be authenticated with the target decryption authentication information;

[0148] The target disk encryption key acquisition unit is used to acquire the target disk encryption key encrypted by the target authentication information in the first storage space when the matching and comparison result of the matching and comparison unit is a match.

[0149] In some further embodiments, the target key query event generating module 414 may include:

[0150] A key query page output unit, configured to output a key query page in response to a trigger operation on the key query item;

[0151] The key query page includes key identifiers corresponding to each disk encryption key stored in the first storage space.

[0152] The target key query event generating unit is used to determine the target key identifier of the disk encryption key to be queried in response to the key identifier selection operation on the key query page, and generate a target key query event containing the target key identifier.

[0153] Accordingly, the authentication information acquisition unit may include:

[0154] a target decryption authentication information reading unit, configured to execute the target key query event and read the target decryption authentication information associated with the target key identifier in the first storage space;

[0155] A key query authentication page output unit, used for outputting a key query authentication page;

[0156] The to-be-authenticated information obtaining unit is used to obtain the to-be-authenticated information for the target key identifier in response to an input operation on the key query authentication page.

[0157] It should be noted that the various modules, units, etc. in the above-mentioned device embodiments can be stored in the memory as program modules, and the processor executes the above-mentioned program modules stored in the memory to implement the corresponding functions. For the functions implemented by each program module and its combination, as well as the technical effects achieved, please refer to the description of the corresponding parts of the above-mentioned method embodiments, which will not be repeated in this embodiment.

[0158] The present application also provides a storage medium on which a computer program can be stored. The computer program can be called and loaded by a processor to implement each step of the key protection implementation method described in the above embodiment.

[0159] Reference Figure 7 , is a hardware structure diagram of an optional example of an electronic device suitable for the key protection implementation method and device proposed in the present application, the electronic device may include: a mainboard 710, and a first controller 720 and a second controller 730 arranged in the mainboard 710, the first controller 720 is used to guide the operating system of the electronic device to start running when the system power-on self-test of the electronic device passes, such as a BIOS chip.

[0160] In combination with the description of the key protection implementation method and device described in the above embodiments, the second controller 730 is used to respond to the disk encryption startup request for the electronic device during the operation of the operating system of the electronic device, trigger the operation of the data protection application, and obtain the corresponding key information. The specific implementation process can refer to but is not limited to the description of the corresponding part of the above method embodiment, and will not be repeated in this embodiment.

[0161] The first controller 720 can be used to obtain the key information and send it to the first storage space for storage. After the system configuration page is outputted in response to the system configuration operation of the electronic device, the first controller 720 can generate a target key query event for the target key identifier in response to the confirmation query operation of the target key identifier displayed in the key query item of the system configuration page. The target key query event is executed to obtain the target disk encryption key associated with the target key identifier in the first storage space. The target disk encryption key is outputted. The storage and query implementation process of the disk encryption key can refer to but is not limited to the description of the corresponding part of the above method embodiment, which will not be repeated in this embodiment.

[0162] In some embodiments, the first controller 720 can implement the steps of the key protection method performed by the first controller 720 described in the above method embodiment by calling a preset first program. At this time, the first program refers to a program that implements the key protection method performed by the first controller 720 described in the above method embodiment; similarly, the second controller 730 can implement the steps of the key protection method performed by the second controller 730 described in the above method embodiment by calling a preset second program. At this time, the second program refers to a program that implements the key protection method performed by the second controller 730 described in the above method embodiment.

[0163] Understandably, Figure 7 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiment of the present application. In practical applications, the electronic device may include Figure 7 More or fewer components as shown, or a combination of certain components, such as various communication interfaces; at least one input component such as a touch sensing unit for sensing touch events on a touch display panel, a keyboard, a mouse, a camera, a microphone, etc.; at least one output component such as a display, a speaker, a vibration mechanism, a lamp, etc.; a power management module; various sensors, etc., are not listed one by one in this application and can be determined depending on the situation.

[0164] Finally, it should be noted that the various embodiments in this specification are described in a progressive or parallel manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the devices and electronic devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0165] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for implementing key protection, the method comprising: The first controller acquires key information, wherein the key information is key information including a disk encryption key obtained by the second controller in response to a disk encryption startup request for the electronic device during the operation of the operating system of the electronic device, triggering the operation of the data protection application; the first controller is used to guide the operating system to start and run when the system power-on self-test of the electronic device passes; Sending the key information to a first storage space of the first controller for storage; The second controller obtains the key information including the disk encryption key, including: The second controller outputs a query encryption interface for the disk encryption key; The second controller obtains the key identification and decryption authentication information of the disk encryption key in response to the input operation on the query encryption interface; The second controller encrypts the disk encryption key using the decryption authentication information, and the encrypted disk encryption key, the key identifier and the decryption authentication information constitute key information.

2. According to the method of claim 1, the process of obtaining the key information comprises: The second controller responds to the disk encryption startup request for the electronic device, triggers the data protection application to run, generates a disk encryption key, and outputs key security storage prompt information; wherein the key security storage prompt information is used to remind the user whether to store the disk encryption key in the first storage space of the first controller; The second controller obtains key information including the disk encryption key in response to a confirmation operation on the key security storage prompt information.

3. The method according to claim 1 or 2, further comprising: In response to the system configuration operation on the electronic device, a system configuration page is output; wherein the system configuration page includes a key query item for a disk encryption key; In response to a confirmation query operation on a target key identifier displayed by the key query item, generating a target key query event for the target key identifier; Execute the target key query event to obtain the target disk encryption key associated with the target key identifier in the first storage space; The target disk encryption key is output.

4. The method according to claim 3, wherein executing the target key query event to obtain the target disk encryption key associated with the target key identifier in the first storage space comprises: Execute the target key query event to obtain the information to be authenticated and the target decryption authentication information for the target key identifier; Matching and comparing the information to be authenticated with the target decryption authentication information; If the information to be authenticated matches the target decryption authentication information, a target disk encryption key encrypted by the target decryption authentication information in the first storage space is obtained.

5. The method according to claim 3, wherein in response to a confirmation query operation on the target key identifier displayed by the key query item, generating a target key query event for the target key identifier comprises: In response to a triggering operation on the key query item, outputting a key query page, wherein the key query page includes a key identifier corresponding to each disk encryption key stored in the first storage space; In response to a key identifier selection operation on the key query page, a target key identifier of the disk encryption key to be queried is determined, and a target key query event including the target key identifier is generated.

6. The method according to claim 4, wherein executing the target key query event to obtain the information to be authenticated and the target decryption authentication information for the target key identifier comprises: Executing the target key query event, reading the target decryption authentication information associated with the target key identifier in the first storage space, and outputting a key query authentication page; In response to an input operation on the key query authentication page, information to be authenticated for a target key identifier is obtained.

7. A key protection implementation device, the device comprising the following modules located in a first controller, the first controller being used to guide the operating system of the electronic device to start running when the electronic device passes the system power-on self-test: The key information acquisition module is used to obtain key information, wherein: The key information is key information including a disk encryption key obtained by the second controller starting a data protection application in response to a disk encryption start request for the electronic device during the operation of the operating system of the electronic device; A key information transmission module, used for sending the key information to the first storage space of the first controller for storage; The second controller obtains key information including the disk encryption key through a key information obtaining module, and the key information obtaining module includes: A query encryption interface output unit, used to output a query encryption interface for the disk encryption key; An information obtaining unit, used to obtain the key identification and decryption authentication information of the disk encryption key in response to an input operation on the query encryption interface; The key information forming unit is used to encrypt the disk encryption key using the decryption authentication information, and the encrypted disk encryption key, the key identifier and the decryption authentication information form the key information.

8. The apparatus according to claim 7, further comprising the following module located in the second controller: A key generation module, used to respond to a disk encryption startup request for an electronic device, trigger the data protection application to run, and generate a disk encryption key; The key storage prompt module is used to output key security storage prompt information; wherein, The key security storage prompt information is used to remind the user whether to store the disk encryption key in the first storage space of the first controller; The key information obtaining module is used to obtain the key information including the disk encryption key in response to a confirmation operation on the key security storage prompt information.

9. An electronic device, comprising: Motherboard; A first controller and a second controller are arranged in the mainboard, wherein the first controller is used to guide the operating system of the electronic device to start running when the electronic device passes the system power-on self-test; The second controller is used to respond to a disk encryption startup request for the electronic device during the operation of the operating system of the electronic device, trigger the data protection application to run, and obtain corresponding key information including the disk encryption key; The first controller is used to obtain the key information and send the key information to the first storage space for storage; The second controller obtains the key information including the disk encryption key, including: The second controller outputs a query encryption interface for the disk encryption key; The second controller obtains the key identification and decryption authentication information of the disk encryption key in response to the input operation on the query encryption interface; The second controller encrypts the disk encryption key using the decryption authentication information, and the encrypted disk encryption key, the key identifier and the decryption authentication information constitute key information.

Images