Disk decryption method, encryption system and computing device

Abstract

The invention discloses a disk decryption method, an encryption system and computing equipment, and relates to the technical field of decryption. The method comprises the following steps: an encryption service process establishes a session with a proxy process through a socket, and sends a password acquisition request to the proxy process through the socket; the agent process obtains an unlocking password based on the password obtaining request, and sends the unlocking password to the encryption service process; and the encryption service process decrypts the disk to be unlocked according to the unlocking password. In the application, the password acquisition parameter is transmitted through the password acquisition request, so that the situation of privacy data leakage is avoided, the modification of other password acquisition parameters is avoided, and the security of the privacy data is improved. And the socket is created by the proxy process and is bound with the blank file, so that mutual communication between the encryption service process and the proxy process can be realized only through the socket corresponding to the proxy process, the process of acquiring the unlocking password is simplified, and the acquisition efficiency of the unlocking password is improved.

Description

Technical Field

[0001] The present application relates to the field of decryption technology, and in particular to a disk decryption method, encryption system and computing device. Background Art

[0002] With the rapid development of information technology, data security is becoming more and more important. In order to ensure data security, encryption devices are increasingly used. Encrypted disk refers to the technology of encrypting the entire disk or part of it to avoid unauthorized access and data leakage of data stored on the disk, thereby ensuring data security.

[0003] Cryptsetup is a disk encryption tool used to manage / process encrypted disks. Cryptsetup can support multiple types of encrypted disks, including: LUKS (Linux Unified Key Setup, Linux hard disk encryption standard) encrypted disks, TrueCrypt encrypted disks, BitLocker encrypted disks, etc. When the system starts or the encrypted disk is mounted, the user is required to provide an unlock password (key), and cryptsetup uses the unlock password provided by the user to unlock the encrypted disk.

[0004] In the current technology, when there is an encrypted disk that needs to be unlocked, the corresponding cryptsetup process is started, the cryptsetup process randomly creates a corresponding temporary file, stores the path of the temporary file in the ask file, and stores the ask file in the ask file directory; then the cryptsetup process generates a corresponding Unix socket (Unix sockets), and binds the Unix socket to the path of the corresponding temporary file; after the cryptsetup process creates the ask file in the ask file directory, the agent process is notified through the notification program that there is a new ask file in the ask file directory that needs to be processed, so as to obtain the corresponding unlock password through the corresponding user terminal; the agent process returns the unlock password to the corresponding cryptsetup process through the corresponding Unix socket, so that the corresponding cryptsetup process unlocks the corresponding encrypted disk based on the unlock password.

[0005] In the disk decryption method in the current technology, the agent process can access all the ask files in the ask file directory, that is, all the ask files in the ask file directory can be viewed and even modified, and there is a situation of leaking or modifying private data, which is not conducive to the protection of private data. And when the agent process returns the unlock password of the encrypted disk to the corresponding cryptsetup process through the corresponding Unix socket, it is necessary to find the ask file corresponding to the encrypted disk from multiple ask files, so as to determine the path of the temporary file corresponding to the encrypted disk, and find and connect to the corresponding Unix socket through the path of the corresponding temporary file. Therefore, in the current technology, an additional search process is required, which makes the process of obtaining the unlock password cumbersome, resulting in low efficiency in obtaining the unlock password.

[0006] The disk decryption method in the current technology may leak private data, which is not conducive to the protection of private data. In addition, the process of obtaining the unlock password is cumbersome, resulting in low efficiency in obtaining the unlock password. Summary of the invention

[0007] The embodiments of the present application provide a disk decryption method, encryption system, and computing device, which can avoid the leakage of private data, thereby improving the security of private data, and simplify the process of obtaining an unlock password, thereby improving the efficiency of obtaining the unlock password.

[0008] In order to achieve the above objectives, the embodiments of the present application adopt the following technical solutions:

[0009] In the first aspect, the embodiment of the present application provides a method for disk decryption, including: an encryption service process establishes a session with a proxy process through a socket; the encryption service process sends a password acquisition request to the proxy process through the socket; the proxy process obtains an unlock password based on the password acquisition request, and sends the unlock password to the encryption service process; the encryption service process decrypts the disk to be unlocked according to the unlock password. In the embodiment of the present application, the password acquisition parameter is transmitted through the password acquisition request, that is, when the proxy process receives the password acquisition request, it can only obtain the password acquisition parameter determined based on the password acquisition request, and cannot access / acquire the password acquisition parameter determined based on other password acquisition requests, thereby avoiding the leakage of privacy data and avoiding the modification of the password acquisition parameters corresponding to other encrypted disks, thereby improving the security of privacy data. Furthermore, the socket is created by the proxy process and bound to a blank file, and the subsequent encryption service process can establish a session with the proxy process through the socket. If there are multiple encryption service processes, multiple encryption service processes can establish a session with the proxy process through the socket, that is, realize mutual communication with the proxy process, simplify the process of obtaining the unlock password, and improve the efficiency of obtaining the unlock password.

[0010] In a possible implementation, in response to the system startup of the first server, the proxy process creates a socket and determines a local file; the proxy process binds the socket to the local file to obtain a socket corresponding to the proxy process. Since it is a predetermined local file path, the local file path cannot be modified during the unlocking process of the decrypted disk, so the security of data transmission between the encryption service process and the proxy process can be guaranteed.

[0011] In a possible implementation, the proxy process obtains a password acquisition parameter based on a password acquisition request, and the proxy process sends the password acquisition parameter to a display device to obtain an unlock password input by a user, so that the display device displays an input interface for the unlock password, and the user inputs the unlock password of the disk to be unlocked based on the input interface.

[0012] In a possible implementation, the password acquisition request includes: a password acquisition command and a storage path of a request file corresponding to the disk to be unlocked, wherein the password acquisition command is a command for obtaining an unlock password. The proxy process parses the password acquisition request to obtain the storage path of the request file corresponding to the disk to be unlocked; reads the corresponding request file from the storage path of the request file to obtain the password acquisition parameters in the corresponding request file. The request file corresponding to the disk to be unlocked is stored in a local storage path, and there is no need to store the request file in a temporary file list; when the proxy process receives a password acquisition request, it can only access the request file under the storage path carried by the password acquisition request, rather than all request files under the temporary file list, thereby avoiding the leakage of privacy data and avoiding the modification of data in the request files corresponding to other encrypted disks.

[0013] In a possible implementation, the request file is a pre-encrypted request file, and the method further includes: the encryption service process sends the corresponding key to the proxy process through the socket; the proxy process reads the corresponding encrypted request file from the storage path of the request file, and decrypts the encrypted request file based on the corresponding key to obtain the decrypted request file to obtain the password acquisition parameter in the request file. The request file stored in the storage path of the request file included in the password acquisition request is encrypted in advance, which further ensures the security of the private data and avoids the leakage of the private data.

[0014] In a possible implementation, the password acquisition request includes: a password acquisition command and a password acquisition parameter, wherein the password acquisition command is a command for acquiring an unlock password; the proxy process parses the password acquisition request to obtain the password acquisition parameter corresponding to the disk to be unlocked. The password acquisition parameter is sent to the proxy process directly through the password acquisition request, and the password acquisition parameter does not need to be written to the disk. When the proxy process receives a password acquisition request, it can only access the password acquisition parameter carried by the password acquisition request, and cannot access the password acquisition parameters carried by other password acquisition requests, thereby avoiding the leakage of privacy data and avoiding the modification of the password acquisition parameters corresponding to other encrypted disks.

[0015] In a possible implementation, the proxy process obtains parameters based on the password and performs security verification; when the security verification passes, the proxy process sends the unlock password to the encryption service process through the socket. Only when the security verification passes, the proxy process sends the unlock password to the encryption service process. If the security verification fails, the proxy process does not send the unlock password to the encryption service process, which can improve the security and reliability of the unlock password transmission.

[0016] In a possible implementation, the proxy process sends a password return request to the encryption service process through a socket; wherein the password return request includes a password return command and a corresponding unlock password, and the password return command is a command for returning the unlock password. Exemplarily, the password return request is PASSWD: unlock password, which makes the interaction clearer and easier to understand.

[0017] In the second aspect, the embodiment of the present application provides an encryption system for managing the unlocking of an encrypted disk, the encryption system comprising: an encryption service module and an agent module; the encryption service module is used to establish a session with the agent module through a socket; wherein the socket is created by the agent module and bound to a blank file; the encryption service module is also used to send a password acquisition request to the agent module through the socket; wherein the password acquisition request is used to determine the password acquisition parameter corresponding to the disk to be unlocked, and the password acquisition parameter is a parameter for requesting to obtain the unlock password of the disk to be unlocked; the agent module is used to obtain the unlock password based on the password acquisition request, and send the unlock password to the encryption service module through the socket; the encryption service module is also used to decrypt the disk to be unlocked according to the unlock password. In the embodiment of the present application, the password acquisition parameter is transmitted through the password acquisition request, that is, when the agent module receives the password acquisition request, it can only obtain the password acquisition parameter determined based on the password acquisition request, and cannot access / acquire the password acquisition parameter determined based on other password acquisition requests, thereby avoiding the leakage of privacy data, and avoiding the modification of the password acquisition parameters corresponding to other encrypted disks, thereby improving the security of privacy data. Furthermore, the socket is created by the proxy module and bound to a blank file. The subsequent encryption service module can establish a session with the proxy module through the socket. If there are multiple encryption service modules, multiple encryption service modules can establish sessions with the proxy process through the socket, that is, realize mutual communication with the proxy modules, simplify the process of obtaining the unlocking password, and improve the efficiency of obtaining the unlocking password.

[0018] In one possible implementation, before the encryption service process establishes a session with the proxy process through a socket, the proxy module is also used to create a socket and determine a local file in response to the system startup of the first server; and is also used to bind the socket to the local file to obtain a socket corresponding to the proxy process.

[0019] In a third aspect, an embodiment of the present application provides a computing device, including: a processor, a first memory, and a second memory; the first memory is a disk to be unlocked, and an encryption service process and an agent process are running on the processor;

[0020] The second memory is used to store computer program instructions; the processor is used to execute the computer program instructions stored in the second memory to implement the disk decryption method in the above-mentioned first aspect and its possible implementation methods.

[0021] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon. When the computer program instructions are executed on a computing device, the computing device implements the disk decryption method in the above-mentioned first aspect and its possible implementation methods.

[0022] In a fifth aspect, the present application provides a computer program product, which includes computer program instructions. When the computer program instructions are executed on a computing device, the computing device implements the disk decryption method in the above-mentioned first aspect and its possible implementation methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 An example diagram of an application scenario of a disk decryption method provided in an embodiment of the present application;

[0024] Figure 2 A flowchart of a disk decryption method provided in an embodiment of the present application;

[0025] Figure 3 A schematic diagram of a process for obtaining an unlock password by a proxy process provided in an embodiment of the present application;

[0026] Figure 4 An example diagram of an interface for inputting an unlock password provided in an embodiment of the present application;

[0027] Figure 5 A schematic diagram of the composition of an encryption system provided in an embodiment of the present application;

[0028] Figure 6 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The terms "first", "second", "third", etc. in the specification, claims and drawings of this application are used to distinguish different objects rather than to limit a specific order.

[0030] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0031] In order to make the description of the following embodiments clear and concise, a brief introduction to the related technology is first given:

[0032] systemd is a manager for handling and managing systems and services. systemd is designed to increase system startup speed, simplify server management and provide better dependency tracking.

[0033] Cryptsetup, or systemd-cryptsetup, is a component of the systemd system service manager that is specifically used to manage and process encrypted disks. Specifically, using the functions of cryptsetup, users can unlock encrypted disks when the system starts, thereby allowing the system to access the data on the encrypted disk.

[0034] Socket is an interface for implementing inter-process communication (IPC). It provides an abstraction layer for applications to encapsulate the details of the underlying network protocol. Sockets enable different processes to communicate with each other, for example, different processes on the same server can communicate with each other, or different processes on different servers can communicate with each other.

[0035] Unix Socket is a socket, specifically an interface for communication between processes within the same server, that is, Unix socket enables different processes on the same server to communicate with each other. And Unix socket is identified by file path, and does not require the participation of network protocol stack, so Unix socket has higher performance and lower overhead.

[0036] The embodiment of the present application provides a method for disk decryption, including: an encryption service process establishes a session with a proxy process through a socket; the encryption service process sends a password acquisition request to the proxy process through the socket; the proxy process acquires an unlock password based on the password acquisition request, and sends the unlock password to the encryption service process; the encryption service process decrypts the disk to be unlocked according to the unlock password. In the embodiment of the present application, the password acquisition parameter is transmitted through the password acquisition request, that is, when the proxy process receives the password acquisition request, it can only obtain the password acquisition parameter determined based on the password acquisition request, and cannot access / acquire the password acquisition parameter determined based on other password acquisition requests, thereby avoiding the leakage of privacy data and avoiding the modification of the password acquisition parameters corresponding to other encrypted disks, thereby improving the security of privacy data.

[0037] Furthermore, the socket is created by the proxy process and bound to a blank file. The subsequent encryption service process can establish a session with the proxy process through the socket. If there are multiple encryption service processes, multiple encryption service processes can establish a session with the proxy process through the socket, that is, realize mutual communication with the proxy process, simplify the process of obtaining the unlock password, and improve the efficiency of obtaining the unlock password.

[0038] Embodiment 1:

[0039] Combine the following Figure 1-Figure 4 , a disk decryption method provided by an embodiment of the present application is introduced in detail.

[0040] First combine Figure 1 , an example is given to introduce an application scenario of a disk decryption method provided in an embodiment of the present application.

[0041] like Figure 1 As shown, the server 100 includes multiple encrypted disks, taking encrypted disk A, encrypted disk B and encrypted disk C as examples, specifically, encrypted disk A, encrypted disk B and encrypted disk C are encrypted disks mounted to the server 100. An agent process 150 runs on the server 100, and the agent process 150 pre-creates a corresponding socket 140 and binds the corresponding socket 140 to a preset blank file, so that the encryption service process can establish a session with the agent process 150 through the socket 140.

[0042] The agent process is an application program running in the user space of the first server, and is used to interact with the systemd-cryptsetup process (encryption service process) and the user end, so as to obtain the unlocking password input by the user.

[0043] In response to the startup of its own system, the server 100 starts the encryption service process 110 corresponding to the encryption disk A, the encryption service process 120 corresponding to the encryption disk B, and the encryption service process 130 corresponding to the encryption disk C. The encryption service process 110, the encryption service process 120, and the encryption service process 130 respectively establish a session with the proxy process 150 through the socket 140, thereby realizing the interaction between the encryption service process and the proxy process.

[0044] Among them, the encryption service process (systemd-cryptsetup process, which can be referred to as cryptsetup process for short) is the encryption service process corresponding to the encrypted disk, which is used to handle the unlocking and mounting of the encrypted disk, thereby realizing the unlocking of the encrypted disk during the startup process.

[0045] The above combination Figure 1 The following example introduces an application scenario of a disk decryption method provided by an embodiment of the present application. Figure 2 , a detailed description of an encrypted disk (for example: Figure 1 In the case of any one of the encrypted disk A, encrypted disk B and encrypted disk C shown in the figure), an embodiment of the present application provides a method for disk decryption. It should be noted that the encrypted disk can also be called a disk to be unlocked.

[0046] like Figure 2 As shown, a disk decryption method provided in an embodiment of the present application is applied to a first server (the first server is a server that is intended to mount / need to mount a disk to be unlocked), and the method includes the following steps:

[0047] S201, the encryption service process establishes a session with the proxy process through a socket.

[0048] The socket is created by the proxy process and bound to a blank file.

[0049] Exemplarily, the socket corresponding to the proxy process can be obtained in the following manner: the proxy process creates a socket in advance, and the proxy process determines a local file path in advance; then the socket is bound to the local file path, thereby obtaining the socket corresponding to the proxy process. For example, the proxy process creates a Unix socket in advance, and determines a local file path / usr / lib / systemd / tty-ask-password-agent.sock; then the bind() function is called to bind the Unix socket to the local file path.

[0050] The bind() function is a function used in network programming to associate a socket with a specific address, file path, or port number.

[0051] Exemplarily, after the proxy process obtains the corresponding socket, that is, the proxy process completes the socket binding (binding the generated socket to a predetermined local file path), the encryption service process finds the socket corresponding to the proxy process through the local file path and communicates with the corresponding socket, thereby establishing a session with the proxy process.

[0052] A session refers to an interaction between two or more entities over a period of time. In the embodiment of the present application, a session established between an encryption service process and an agent process refers to a temporary, two-way communication connection established between the two, that is, the encryption service process and the agent process can transmit data to each other through a socket.

[0053] In the embodiment of the present application, the socket corresponding to the proxy process can be bound to a predetermined local file path, and the subsequent encryption service process finds the socket corresponding to the proxy process through the local file path and communicates with the corresponding socket, thereby establishing a session with the proxy process. Due to the predetermined local file path, the local file path cannot be modified during the unlocking process of the decrypted disk, so the security of data transmission between the encryption service process and the proxy process can be guaranteed.

[0054] In a possible implementation, the first server starts the encryption service process (cryptsetup process) corresponding to the disk to be unlocked in response to the startup of its own system, so as to facilitate the subsequent unlocking and mounting of the disk to be decrypted. When the encryption service process corresponding to the disk to be decrypted is started, the encryption service process establishes a session with the proxy process through the socket corresponding to the proxy process.

[0055] Specifically, in response to system startup of the first server, systemd in the first server starts a cryptsetup process corresponding to the disk to be unlocked.

[0056] In a possible implementation, before the first server is started, an encrypted disk that is automatically unlocked when the system is started can be set in advance in a configuration file in the system of the first server. For example, in advance in the configuration file / etc / cryptsetup or / etc / systemd / cryptsetup in the system of the first server, it is set that encrypted disk A is automatically unlocked when the system is started. Therefore, when the system of the first server is started, systemd will start the cryptsetup service process corresponding to encrypted disk A according to the settings in the configuration file.

[0057] S202: The encryption service process sends a password acquisition request to the proxy process through a socket.

[0058] The password acquisition request is used to confirm the password acquisition parameters corresponding to the disk to be unlocked. The password acquisition parameters are parameters used to request the unlock password of the disk to be unlocked, that is, various parameters required to decrypt the disk to be unlocked, including but not limited to interaction parameters and environment parameters.

[0059] In a possible implementation, the password acquisition request includes: a password acquisition command and a storage path of a requested file, wherein the password acquisition command is a command for requesting to obtain an unlock password of a disk to be unlocked.

[0060] Exemplarily, the format of the password acquisition request is ASK: / XXX / XXX.ask.

[0061] ASK stands for the password acquisition command (command). In the embodiment of the present application, the password acquisition command (ASKcommand) refers to a command initiated by the encryption service process, the purpose of which is to obtain the unlock password of the disk to be unlocked. That is, ASK indicates that the request sent by the encryption service process to the proxy process is a password acquisition request, which is used to request the unlock password of the disk to be unlocked.

[0062] Wherein, / XXX / XXX.ask represents the storage path of the request file (ask file), that is, the request file is stored in the local / XXX / XXX.ask path, and the corresponding request file (ask file) is obtained through the stored storage path ( / XXX / XXX.ask). In a possible implementation, the password acquisition request includes the storage path where the request file is stored, and the request file includes password acquisition parameters, so the password acquisition request is used to determine the password acquisition parameters of the disk to be unlocked.

[0063] Among them, the request file (ask file) is a file containing the parameters required to unlock the encrypted disk. The request file is used to store the various parameters required to unlock the encrypted disk, which helps the proxy process to correctly identify and process the password acquisition request for obtaining the unlock password of the encrypted disk. That is, in the embodiment of the present application, the request file is a file containing the password acquisition parameters.

[0064] Specifically, the request file includes but is not limited to interactive parameters and environmental parameters, that is, the password acquisition parameters include but are not limited to interactive parameters and environmental parameters. Among them, the interactive parameters are mainly used to describe the specific details of the unlocked encrypted disk, which helps the agent process to correctly identify the encrypted disk; the environmental parameters, also known as environment variables, usually refer to variables defined in the system environment, which provide context information and help the agent process better process the request command.

[0065] Exemplarily, the exchange parameters include: the name of the encrypted disk, the UUID or path of the device, the encryption type, the encryption mode, etc.

[0066] Among them, the name of the encrypted disk is used to identify the encrypted disk to be unlocked. In this embodiment of the present application, the name of the encrypted disk is the name of the encrypted disk, that is, it is used to identify the encrypted disk; the UUID or path of the device is used to identify the physical device where the encrypted disk is located. In this embodiment of the present application, the UUID or path of the device is the UUID or path of the first server, which is used to identify the first server where the encrypted disk is located; the encryption type is used to identify the encryption type used by the encrypted disk, for example: LUKS (Linux Unified Key Setup), dm-crypt (Device Mapper CryptTarget, device mapper encryption target), etc. In this embodiment of the present application, the encryption type is the encryption type used by the encrypted disk; the encryption mode is used to identify the encryption mode used by the encrypted disk, for example: AEX-XTS (Advanced Encryption Standard-XTS Mode, Advanced Encryption Standard-XTS Mode), AES-CBC (Advanced Encryption Standard-Cipher Block Chaining Mode, Advanced Encryption Standard-Cipher Block Chaining Mode), etc. In this embodiment of the present application, the encryption mode is the encryption mode used by the encrypted disk.

[0067] Exemplarily, the environmental parameters include: user ID (UID), UID of the user to which the disk belongs, timeout period, system startup phase, current time, etc.

[0068] Among them, the user ID (UID) is used to identify the user ID of the current user; the UID of the user to which the disk belongs is used to identify the user ID of the user to which the encrypted disk belongs. In this embodiment of the application, the UID of the user to which the disk belongs is the UID of the user to which the encrypted disk belongs; the timeout period is used to specify the maximum time the system waits for the user to enter the unlock password; the system startup phase is used to identify the startup phase the system is currently in. In this embodiment of the application, the system startup phase is the startup phase of the system of the first server; the current time is used to identify the current timestamp.

[0069] Exemplarily, the disk user refers to a user in the system who is designated to own or manage a specific disk or disk partition. This user usually has read and write permissions on the disk, and has certain permissions to perform disk-related management operations. Exemplarily, the disk user has full control permissions on the disk, including reading, writing, modifying attributes, etc., that is, only the disk user can access and manage the data on the disk.

[0070] In an embodiment of the present application, the request file corresponding to the disk to be unlocked is stored in a local storage path, and there is no need to store the request file in a temporary file list; when the proxy process receives a password acquisition request, it can only access the request file under the storage path carried by the password acquisition request, rather than all request files under the temporary file list, thereby avoiding privacy data leakage and avoiding modification of data in request files corresponding to other encrypted disks.

[0071] Furthermore, in a possible implementation method, the request file stored in the storage path of the request file included in the password acquisition request is encrypted in advance. The encryption service process sends the password acquisition request to the proxy process through the corresponding socket, and at the same time sends the key corresponding to the request file to the proxy process, thereby further ensuring the security of the privacy data and avoiding the leakage of the privacy data.

[0072] In another possible implementation, the password acquisition request includes a password acquisition command and a password acquisition parameter, wherein the password acquisition command is a command for requesting to obtain the unlock password of the disk to be unlocked; and the password acquisition parameter is a parameter for requesting to obtain the unlock password of the disk to be unlocked.

[0073] Exemplarily, the format of the password acquisition request is ASK: password acquisition parameter.

[0074] In an embodiment of the present application, the password acquisition parameters are sent to the proxy process directly through the password acquisition request. The password acquisition parameters do not need to be written to the disk. When the proxy process receives a password acquisition request, it can only access the password acquisition parameters carried by the password acquisition request, and cannot access the password acquisition parameters carried by other password acquisition requests, thereby avoiding the leakage of privacy data and avoiding the modification of the password acquisition parameters corresponding to other encrypted disks.

[0075] S203: The proxy process obtains the unlock password based on the password acquisition request.

[0076] Specifically, the proxy process obtains the password acquisition parameter carried in the password acquisition request based on the password acquisition request; and sends the password acquisition parameter to the display device to obtain the unlock password input by the user.

[0077] It should be noted that the display device may be a display device located on the first server, or a display device located on other servers, or of course, a separate display device, and this application does not make any specific limitation.

[0078] For different formats of password acquisition requests, the methods for obtaining the password acquisition parameters carried in the password acquisition request are different, which are introduced below:

[0079] In one possible implementation, when a password acquisition request includes a password acquisition command and a storage path of a request file, the proxy process parses the received password acquisition request to obtain the storage path where the request file is stored; and reads the corresponding request file from the storage path to obtain the password acquisition parameters carried by the corresponding request file.

[0080] Further, when the corresponding request file is pre-encrypted, the proxy process obtains the storage path included in the request based on the received password, reads the corresponding encrypted request file, and decrypts the encrypted request file based on the received key to obtain the decrypted request file.

[0081] In another possible implementation, when the password acquisition request includes a password acquisition command and a password acquisition parameter, the proxy process parses the password acquisition request to obtain the password acquisition parameter carried in the password acquisition request.

[0082] Further, for ease of understanding, the following is combined Figure 3 and Figure 4 , an example is given to introduce a method for a proxy process to obtain an unlock password.

[0083] like Figure 3 As shown in the figure, the agent process obtains the unlock password in the following steps:

[0084] S301. The proxy process obtains corresponding password parameters and transmits them to the display device.

[0085] The display device may be a display device located on the first server or a display device located on another server.

[0086] Specifically, the proxy process transmits the password acquisition parameters carried in the request file to the display device through a message.

[0087] The message method refers to transmitting the password acquisition parameters to the display device in a structured and readable manner, which helps the display device to display more clearly, orderly, and easy to read and understand, thereby helping users to better understand and process the password acquisition parameters in the request.

[0088] S302: The display device obtains parameters based on the password and displays an input interface.

[0089] Specifically, the display device displays an input interface for the unlock password corresponding to the disk to be unlocked based on the received password acquisition parameter, so that the user can input the unlock password of the disk to be unlocked based on the input interface.

[0090] The input interface of the unlock password is used to prompt the user to input the unlock password of the disk to be unlocked. In the embodiment of the present application, the input interface of the unlock password is used to prompt the user to input the unlock password of the disk to be unlocked. Exemplarily, the input interface of the unlock password can be a command line interface (CLI) or a graphical user interface (GUI), depending on the system environment and configuration of the display device.

[0091] The Command Line Interface (CLI) is a text-based user interface where users interact with the server by entering command lines. The command line interface includes a command line prompt, command line input, and command line output, wherein the command line prompt refers to the location in the command line interface that waits for the user to enter a command line. In an embodiment of the present application, when the input interface for the unlock password is a command line interface, the relevant parameters of the disk to be unlocked, such as the encryption type, device path, etc. (obtained based on the password acquisition parameters) will be displayed on the command line interface; the command line prompt prompts the user to enter the unlock password of the disk to be unlocked. That is, in the command line interface, the user can see the password acquisition parameters in the request file, and is prompted by the command line prompt to enter the unlock password of the disk to be unlocked.

[0092] A graphical user interface (GUI) is a graphical user interface that allows users to interact with a server by clicking on images, buttons, and using menus. Compared to a command line interface, a graphical user interface provides a more intuitive and friendly way of interaction. In an embodiment of the present application, when the input interface for the unlock password is a graphical user interface, a label, an input box, and a confirmation button are displayed on the graphical user interface. The label is used to display the relevant parameters of the disk to be unlocked, such as the encryption type, device path, etc. (obtained based on the password to obtain the parameters); the input box is used to prompt the user to enter the location of the unlock password of the disk to be unlocked; and the confirmation button is used to submit the unlock password of the disk to be unlocked.

[0093] For ease of understanding, the following Figure 4 An input interface provided in an embodiment of the present application is introduced by way of example.

[0094] like Figure 4As shown, the display device obtains parameters based on the received password and displays an input interface 400. The input interface 400 has a display box 401, and the display box 401 displays the name of the encrypted disk: encrypted disk A, the encryption type of the encrypted disk: LUKS: The input interface 400 also displays an input box 402, which is used for the user to enter the unlock password of the encrypted disk A in the input box 402 through an external device such as a keyboard; and there is an OK button 403 in the input interface 400. After the user enters the unlock password of the encrypted disk A in the input box 402, the pointer can be controlled by an external device such as a mouse to click the OK button 403, thereby realizing that the display device receives the unlock password of the encrypted disk A input by the user.

[0095] S303: The display device receives the unlock password input by the user, and sends the unlock password to the proxy process.

[0096] In a possible implementation, when receiving the unlock password input by the user, the display device obtains the identification of the user who inputs the unlock password; the display device sends the unlock password and the identification of the user who inputs the unlock password to the proxy process.

[0097] The user identifier may be a user identification number (UID). In a server system (such as a Unix system or a Linux system), each user account has a unique UID. Within the system, ownership and permission control of processes and other resources are determined based on the UID.

[0098] It should be noted that the above combination Figure 3 and Figure 4 In the method for an agent process to obtain an unlock password, the agent process transmits a password obtaining parameter to a display device; the display device displays an input interface to receive the unlock password input by the user based on the input interface.

[0099] S204. The proxy process sends the unlock password to the encryption service process through the corresponding socket.

[0100] In a possible implementation, the proxy process performs security verification; after the security verification is passed, the unlocking password is sent to the encryption service process through the socket.

[0101] Among them, security verification includes: security verification of the encryption service process, security verification of the user to whom the disk belongs, etc.

[0102] Specifically, the security verification of the encryption service process includes: the consistency verification of the identifier (e.g., UID) of the encryption service process. That is, the proxy process verifies whether the UID of the encryption service process of the received password acquisition request and the UID of the encryption service process to which the target sends the unlock password are consistent; if they are consistent, the security verification of the encryption service process passes; if they are inconsistent, the security verification of the encryption service process fails.

[0103] Specifically, the security verification of the user to whom the disk belongs is to verify whether the UID of the user who inputs the unlock password belongs to the UID of the user to whom the disk belongs; if it does, the security verification of the user to whom the disk belongs passes; if it does not, the security verification of the user to whom the disk belongs fails. The UID of the user who inputs the unlock password is transmitted to the proxy process by the second server; the UID of the user to whom the disk belongs is carried in the password acquisition parameter in the request file.

[0104] Furthermore, in another possible implementation, if the security verification fails, the proxy process does not send the unlock password to the encryption service process, which can improve the security and reliability of the unlock password transmission. For example, if the security verification of the encryption service process fails, the proxy process does not send the unlock password to the encryption service process, avoiding the leakage of the unlock password of the disk to be unlocked, avoiding the leakage of private data, and further protecting the security of private data; if the security verification of the user to whom the disk belongs fails, the proxy process does not send the unlock password to the encryption service process, which can prevent unauthorized personnel from trying to unlock the encrypted disk through any means, thereby improving the security and reliability of the unlock password transmission.

[0105] In a possible implementation, the proxy process sends a password return request to the encryption service process through a socket to send the unlock password to the encryption service process. The password return request carries a password return command and an unlock password, and the password return command is a command for returning the unlock password.

[0106] In a possible implementation, the format of the password return request is PASSWD:XXX.

[0107] Wherein, PASSWD represents a password return command (comman). In the embodiment of the present application, the password return command is used to indicate that the request sent by the proxy process is a password return request, and the password return request carries the unlock password of the disk to be unlocked. Wherein, XXX represents the unlock password of the disk to be unlocked.

[0108] S205: The encryption service process decrypts the disk to be unlocked according to the unlock password.

[0109] Furthermore, when the encryption service process receives the unlock password, the disk to be unlocked is decrypted based on the unlock password so as to correctly mount the unlock disk to the first server.

[0110] A method for disk decryption provided by an embodiment of the present application includes: an encryption service process establishes a session with a proxy process through a socket; the encryption service process sends a password acquisition request to the proxy process through the socket; the proxy process obtains an unlock password based on the password acquisition request, and sends the unlock password to the encryption service process; the encryption service process decrypts the disk to be unlocked according to the unlock password. In an embodiment of the present application, password acquisition parameters are transmitted through a password acquisition request, that is, when the proxy process receives a password acquisition request, it can only obtain password acquisition parameters determined based on the password acquisition request, and cannot access / acquire password acquisition parameters determined based on other password acquisition requests, thereby avoiding the leakage of private data and avoiding the modification of password acquisition parameters corresponding to other encrypted disks, thereby improving the security of private data.

[0111] Furthermore, the socket is created by the proxy process and bound to a blank file. The subsequent encryption service process can establish a session with the proxy process through the socket. If there are multiple encryption service processes, multiple encryption service processes can establish a session with the proxy process through the socket, that is, realize mutual communication with the proxy process, simplify the process of obtaining the unlock password, and improve the efficiency of obtaining the unlock password. Exemplarily, there is no need to create a socket corresponding to the encryption service process one by one to realize mutual communication with the proxy process, which reduces the communication cost between the encryption service process and the proxy process.

[0112] Furthermore, in an embodiment of the present application, after the encryption service process establishes a session with the proxy process, the encryption service process directly sends a password acquisition request to the proxy process through the socket to request the unlock password of the disk to be unlocked. There is no need to notify the proxy process through an additional notification program as in the current technology to request the unlock password of the disk to be unlocked, which further simplifies the process of obtaining the unlock password, thereby improving the efficiency of obtaining the unlock password.

[0113] Furthermore, in an embodiment of the present application, the requested file is stored in a local file path and does not need to be stored in a specific requested file directory, thereby avoiding the situation where the unlocking passwords of all encrypted disks cannot be completed / obtained due to storage space limitations of the requested file directory.

[0114] Furthermore, in an embodiment of the present application, the encryption service process and the proxy process interact using the request format of [commang]: [param]. For example, the password acquisition request is ASK: / XXX / XXX.ask (storage path of the request file) or ASK:XXX (password acquisition parameters), and the password return request is PASSWD:XXX (unlock password), making the interaction clearer and easier to understand.

[0115] Embodiment 2:

[0116] Combine the following Figure 5 , an encryption system provided in an embodiment of the present application is introduced in detail.

[0117] like Figure 5 As shown, the encryption system 500 includes: an encryption service module 510 and an agent module 520. The encryption system 500 runs on the first server, and the encryption system 500 is used to manage the unlocking of the encrypted disk.

[0118] The encryption service module 510 is used to establish a session with the proxy module 520 through a socket. The socket is created by the proxy module 520 and bound to a blank file.

[0119] Exemplarily, the encryption service module 510 is started in response to a system startup of the first server.

[0120] The number of encryption service modules 510 is the same as the number of disks to be unlocked, and the disks to be unlocked correspond one-to-one to the encryption service modules 110. For example, if there are encryption disk A, encryption disk B, and encryption disk C in the first server that need to be unlocked, there are three encryption service modules 510, which correspond one-to-one to encryption disk A, encryption disk B, and encryption disk C.

[0121] The encryption service module 510 is also used to send a password acquisition request to the proxy module 520 through a socket.

[0122] The password acquisition request is used to determine the password acquisition parameter corresponding to the disk to be unlocked, and the password acquisition parameter is a parameter used to request to obtain the unlock password of the disk to be unlocked.

[0123] The proxy module 520 is used to obtain the unlock password based on the password acquisition request, and send the unlock password to the encryption service module 510 through the socket.

[0124] The encryption service module 510 is further used to decrypt the disk to be unlocked according to the unlock password.

[0125] In a possible implementation, the proxy module 520 is further configured to, in response to system startup of the first server, create a socket and determine a local file; bind the socket to the local file to obtain a socket corresponding to the proxy module 110 .

[0126] In a possible implementation, the proxy module 520 is specifically configured to obtain a password acquisition parameter based on a password acquisition request; and send the password acquisition parameter to the display device to obtain the unlock password input by the user.

[0127] In a possible implementation, the password acquisition request includes: a password acquisition command and a storage path of a request file corresponding to the disk to be unlocked, wherein the password acquisition command is a command for acquiring an unlock password. The proxy module 520 is specifically used to:

[0128] Parse the password acquisition request to obtain the storage path of the request file corresponding to the disk to be unlocked; read the corresponding request file from the storage path of the request file to obtain the password acquisition parameters in the corresponding request file.

[0129] In a possible implementation, the request file is a pre-encrypted request file. The encryption service module 510 is also used to send the corresponding key to the proxy module 520 through the socket; the proxy module 520 is specifically used to read the corresponding encrypted request file from the storage path of the request file, and decrypt the encrypted request file based on the corresponding key to obtain the decrypted request file, so as to obtain the password acquisition parameter in the request file.

[0130] In a possible implementation, the password acquisition request includes: a password acquisition command and a password acquisition parameter. The proxy module 520 is specifically configured to parse the password acquisition request and obtain the password acquisition parameter corresponding to the disk to be unlocked.

[0131] In a possible implementation, the proxy module 520 is also used to obtain parameters based on the password and perform security verification; when the security verification passes, the proxy module 520 sends the unlock password to the encryption service module 510 through the socket.

[0132] In a possible implementation, the proxy module 520 is specifically used to send a password return request to the encryption service module 510 through a socket. The password return request includes a password return command and a corresponding unlock password, and the password return command is a command for returning the unlock password.

[0133] An encryption system provided in an embodiment of the present application includes an encryption service module 510 and an agent module 520. The encryption service module 510 is used to establish a session with the agent module 520 through a socket; the encryption service module 510 is also used to send a password acquisition request to the agent module 520 through a socket; the agent module 520 is used to obtain an unlock password based on the password acquisition request, and send the unlock password to the encryption service module 510 through a socket; the encryption service module 510 is also used to decrypt the disk to be unlocked according to the unlock password. In the encryption system of the embodiment of the present application, when the agent module 520 receives a password acquisition request, it can only obtain the password acquisition parameters determined based on the password acquisition request, and cannot access / acquire the password acquisition parameters determined based on other password acquisition requests, thereby avoiding the leakage of privacy data and avoiding the modification of the password acquisition parameters corresponding to other encrypted disks, thereby improving the security of privacy data.

[0134] Furthermore, the socket is created by the proxy module 520 and bound to a blank file. The subsequent encryption service module 510 can establish a session with the proxy module 520 through the socket. If there are multiple encryption service processes, multiple encryption service modules 510 can establish sessions with the proxy module 520 through the socket, that is, realize mutual communication with the proxy module 520, simplifying the process of obtaining the unlocking password and improving the efficiency of obtaining the unlocking password.

[0135] In addition, see Figure 6 The embodiment of the present application further provides a computing device 600 , which includes a processor 610 , a first memory 620 , and a second memory 630 .

[0136] The first memory 620 is a disk to be unlocked; an encryption service process and an agent process are running on the processor 610.

[0137] The second memory 630 is used to store computer program instructions; the processor 610 is used to execute the computer program instructions stored in the second memory 630 to implement any one of the disk decryption methods in the above embodiments.

[0138] Among them, the processor 610 may include one or more processing cores. The processor 610 uses various interfaces and lines to connect various parts in the computing device 600, and executes the method provided by any one or more of the above embodiments by running or executing instructions, programs, code sets or instruction sets stored in the second memory 630, and calling data stored in the second memory 630. Optionally, the processor 610 can be implemented in at least one hardware form of digital signal processing (digital signal processing, DSP), field-programmable gate array (field-programmable gate array, FPGA), and programmable logic array (programmable logic array, PLA). The processor 610 can integrate one or a combination of a central processing unit (central processing unit, CPU), a graphics processing unit (graphics processing unit, GPU) and a modem. It is understandable that the above-mentioned modem may not be integrated into the processor 610, but implemented separately through a communication chip.

[0139] The second memory 630 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the second memory 630 includes a non-transitory computer-readable storage medium. The second memory 630 may be used to store instructions, programs, codes, code sets, or instruction sets. The second memory 630 may include a storage program area. Among them, the storage program area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), and instructions for implementing the method of the embodiment of the present application, etc.

[0140] The processor 610, the first memory 620 and the second memory 630 are communicatively connected via a bus in the computing device 600, and the bus may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc.

[0141] An embodiment of the present application also provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed on a computing device, the computing device executes any one of the disk decryption methods in the above embodiments.

[0142] For the explanation of the relevant contents in the computer-readable storage medium provided above and the description of the beneficial effects, reference may be made to the corresponding effects of the method for estimating the health score of a data center in the above embodiment, which will not be repeated here.

[0143] An embodiment of the present application also provides a computer program product including instructions, which, when executed on a computing device, enables the computing device to execute any one of the disk decryption methods in the above embodiments.

[0144] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other changes to the disclosed embodiments by viewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple situations. A single processor or other unit may implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0145] Although the present application has been described in conjunction with specific features and embodiments thereof, it is obvious that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely exemplary illustrations of the present application as defined by the appended claims, and are deemed to have covered any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for disk decryption, characterized in that: Applied to a first server, the method comprises: The encryption service process establishes a session with the proxy process through a socket; wherein the socket is created by the proxy process and bound to a blank file; The encryption service process sends a password acquisition request to the proxy process through the socket; wherein the password acquisition request is used to determine a password acquisition parameter corresponding to the disk to be unlocked, and the password acquisition parameter is a parameter used to request to obtain an unlock password of the disk to be unlocked; The proxy process obtains the unlock password based on the password acquisition request, and sends the unlock password to the encryption service process through the socket; The encryption service process decrypts the disk to be unlocked according to the unlock password.

2. The method according to claim 1, characterized in that Before the encryption service process establishes a session with the proxy process through the socket, the method further includes: In response to the system startup of the first server, the proxy process creates a socket and determines a local file; The proxy process binds the socket to the local file to obtain the socket corresponding to the proxy process.

3. The method according to claim 1, characterized in that The agent process obtains the unlock password based on the password acquisition request, including: The proxy process obtains a password acquisition parameter based on the password acquisition request; The proxy process sends the password acquisition parameter to the display device to acquire the unlock password input by the user.

4. The method according to any one of claims 1 to 3, characterized in that: The password acquisition request includes: a password acquisition command and a storage path of a request file corresponding to the disk to be unlocked, wherein the password acquisition command is a command for acquiring an unlock password; The proxy process obtains password acquisition parameters based on the password acquisition request, including: The proxy process parses the password acquisition request to obtain a storage path of a request file corresponding to the disk to be unlocked; The proxy process reads the corresponding request file from the storage path of the request file to obtain the password acquisition parameter in the corresponding request file.

5. The method according to claim 4, characterized in that The request file is a pre-encrypted request file, and the method further includes: The encryption service process also sends the corresponding key to the proxy process through the socket; The proxy process reads the corresponding request file from the storage path of the request file to obtain the password acquisition parameter in the corresponding request file, including: The proxy process reads the corresponding encrypted request file from the storage path of the request file, and decrypts the encrypted request file based on the corresponding key to obtain the decrypted request file to obtain the password acquisition parameter in the request file.

6. The method according to any one of claims 1 to 3, characterized in that: The password acquisition request includes: a password acquisition command and a password acquisition parameter, wherein the password acquisition command is a command for acquiring an unlock password; The proxy process obtains password acquisition parameters based on the password acquisition request, including: The proxy process parses the password acquisition request to obtain a password acquisition parameter corresponding to the disk to be unlocked.

7. The method according to claim 1, characterized in that: The proxy process sends the unlock password to the encryption service process through the socket, including: The proxy process obtains parameters based on the password and performs security verification; When the security verification passes, the proxy process sends the unlock password to the encryption service process through the socket.

8. The method according to claim 1, characterized in that The proxy process sends the unlock password to the encryption service process through the socket, including: The proxy process sends a password return request to the encryption service process through the socket; wherein the password return request includes a password return command and the corresponding unlock password, and the password return command is a command for returning the unlock password.

9. An encryption system, characterized in that: Used to manage the unlocking of encrypted disks, the encryption system includes: an encryption service module and an agent module; The encryption service module is used to establish a session with the proxy module through a socket; wherein the socket is created by the proxy module and bound to a blank file; The encryption service module is further used to send a password acquisition request to the proxy module through the socket; wherein the password acquisition request is used to determine a password acquisition parameter corresponding to the disk to be unlocked, and the password acquisition parameter is a parameter used to request to obtain an unlock password of the disk to be unlocked; The proxy module is used to obtain an unlock password based on the password acquisition request, and send the unlock password to the encryption service module through the socket; The encryption service module is further used to decrypt the disk to be unlocked according to the unlock password.

10. A computing device, characterized in that include: A processor, a first memory and a second memory; the first memory is a disk to be unlocked, and an encryption service process and an agent process are running on the processor; The second memory is used to store computer program instructions; The processor is used to execute the computer program instructions stored in the second memory to implement the disk decryption method according to any one of claims 1 to 8.

Images