A file storage method, device and storage medium

Abstract

A file storage method, device and storage medium, wherein the method includes encrypting a first file to obtain a second file in a trusted execution environment (TEE), and performing a hash operation on the second file to obtain a first hash value; writing the first hash value to a secure partition in a memory, and writing the second file to a common partition in a memory; the secure partition is used to prevent files from being tampered with and / or rolled back; the first hash value is used to verify whether the second file is legal when the second file is decrypted to obtain the first file. The security of the encryption and hash operation process can be guaranteed in the TEE. The second file and the first hash value are stored separately, which can increase the difficulty of tampering with the second file. The first hash value corresponding to the second file is written into the secure partition, and the second file is written into the common partition, which can prevent the second file from being tampered with and / or rolled back by the first hash value that occupies a smaller memory.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a file storage method, device and storage medium. Background Art

[0002] With the vigorous development of Internet technology, the files that need to be stored in terminal devices are also growing, especially some important files need to be properly preserved. The storage method of files in the prior art is generally: obtain the file to be stored, generate a key, use the key to encrypt the file to be stored, obtain the encrypted file, and write the encrypted file into the memory. Using this method to store files, the security of the files is low, so the stored files are easy to be tampered with.

[0003] In order to further improve the security of stored files, especially the security of some sensitive files (such as fingerprint information, keys, etc.), these sensitive files are currently stored in secure partitions in non-volatile storage media, such as the replay protected memory block (RPMB) partition of an embedded multi media card (EMMC) or the RPMB partition of universal flash storage (UFS).

[0004] However, the size of the secure partition in the non-volatile storage medium is limited and cannot support secure storage of large files. Therefore, the security of the stored files is still relatively low. Summary of the invention

[0005] Embodiments of the present application provide a file storage method, device, and storage medium for improving the security of stored files.

[0006] In a first aspect, an embodiment of the present application provides a file storage method, the method comprising: in a trusted execution environment TEE, encrypting a first file to obtain a second file, and performing a hash operation on the second file to obtain the first hash value; writing the first hash value to a secure partition in a memory, and writing the second file to a normal partition in the memory; the secure partition is used to prevent the file from being tampered with and / or prevent the file from being rolled back; the first hash value is used to verify whether the second file is legal when the second file is decrypted to obtain the first file.

[0007] In the embodiment of the present application, the encryption of the first file and the hash operation of the second file are both performed in the TEE, so the security of the encryption process and the hash operation process can be improved. Moreover, the first hash value corresponding to the second file is written into the security partition in the memory, and the security partition is used to prevent the file from being tampered with and / or prevent the file from being rolled back. Therefore, the first hash value of the security partition can prevent tampering and / or rolling back, and the first hash value is smaller than the data volume of the second file, and the memory occupied is also smaller. In this way, the first hash value that occupies a smaller memory can prevent the second file from being tampered with and / or rolling back.

[0008] In a possible implementation, in order to implement a partial update of a first file, the first file includes M data blocks; the second file includes M encrypted data blocks; wherein M is an integer greater than or equal to 2; the encrypting of the first file to obtain the second file includes: performing encryption operations on the M data blocks respectively to obtain the M encrypted data blocks; the performing hash operations on the second file to obtain the first hash value includes: performing hash operations on the M encrypted data blocks respectively to obtain M second hash values; and performing hash operations on the M second hash values ​​to obtain the first hash value, wherein the M encrypted data blocks correspond to the M second hash values ​​one by one. By encrypting the M data blocks respectively to obtain M encrypted data, and performing hash operations on the M encrypted data respectively, on the one hand, the amount of data for each encryption and hash operation can be reduced, thereby improving the efficiency of encryption and hash operations; on the other hand, the first hash value is obtained by encrypting the M second hash values, so that the efficiency of calculating the first hash value can be further improved.

[0009] In one possible implementation, in order to ensure the integrity of the data written to the secure partition and the legitimacy of the terminal device that writes data to the secure partition, the M second hash values ​​are hashed to obtain the first hash value, including performing a hash message authentication code HMAC operation on the M second hash values ​​to obtain the first hash value.

[0010] In a possible implementation, the M second hash values ​​may be written into a common partition, and the first hash value may be written into a secure partition. Thus, the first hash value has a smaller data volume, and the first hash value with a smaller data volume may be used to prevent the second file with a larger data volume from being tampered with and / or rolled back. Alternatively, the M second hash values ​​and the first hash value may be written into a secure partition. Thus, on the one hand, by storing the M encrypted data blocks and the M second hash values ​​separately, the security of the second file may be improved; on the other hand, the second hash value may be used to prevent each encrypted data block from being tampered with and / or rolled back, that is, the second file may be prevented from being tampered with and / or rolled back through a more efficient operation.

[0011] In one possible implementation, the processor reads data in the memory block by block. In order to improve the efficiency of the processor in accessing data, the M second hash values ​​can be written into the ordinary partition with hash blocks as storage units; or the M second hash values ​​can be written into the secure partition with hash blocks as storage units; wherein a hash block includes at least one of the second hash values; and the size of the hash block can be determined based on the granularity of the processor accessing data and the size of the second hash value.

[0012] Optionally, the size of the hash block is related to the granularity of the processor accessing data. Writing the hash value into the memory according to the hash block as the storage unit can achieve memory alignment. When the processor reads the data subsequently, it can also read it according to the hash block, reducing the number of processor accesses, thereby improving the efficiency of the processor in reading and writing data.

[0013] In one possible implementation, the security partition includes a playback protected memory block RPMB partition.

[0014] In a possible implementation, an update request is received; the update request includes a data block identifier and data to be updated, the data block identifier is used to indicate the encrypted data block to be updated in the common partition; according to the data block identifier, the encrypted data block to be updated is obtained from the common partition; the second hash value corresponding to the encrypted data block to be updated is obtained; if the encrypted data block to be updated is determined to be legal according to the second hash value corresponding to the encrypted data block to be updated, the encrypted data block to be updated is updated according to the data to be updated; and the second hash value corresponding to the encrypted data block to be updated is updated. In this way, when it is necessary to update part of the data of the second file, the encrypted data block can be partially updated, thereby improving the update efficiency of the updated encrypted data block.

[0015] In a possible implementation, according to the data to be updated, updating the encrypted data block to be updated can be: decrypting the encrypted data block to be updated to obtain the data block to be updated; updating the data block to be updated with the data to be updated to obtain the updated data block; encrypting the updated data block to obtain the updated encrypted data block; updating the second hash value corresponding to the encrypted data block to be updated, including: performing a hash operation on the updated encrypted data block to obtain a third hash value; updating the second hash value corresponding to the encrypted data block to be updated to the third hash value. In this way, there is no need to decrypt and encrypt the entire second file and then calculate the hash value of the updated entire second file, which reduces the overhead caused by the overall encryption, decryption, and hash operation.

[0016] In a second aspect, an embodiment of the present application provides a file storage device, comprising: a processor and a memory; the processor is used to encrypt a first file to obtain a second file under a trusted execution environment TEE, and perform a hash operation on the second file to obtain a first hash value; the processor is also used to write the first hash value to a secure partition in the memory, and to write the second file to a normal partition in the memory; the secure partition is used to prevent files from being tampered with and / or prevent file rollback; the first hash value is used to verify whether the second file is legal when the second file is decrypted to obtain the first file.

[0017] In one possible implementation, the first file includes M data blocks, and the second file includes M encrypted data blocks; wherein M is an integer greater than or equal to 2; the processor is specifically used to: perform encryption operations on the M data blocks respectively to obtain the M encrypted data blocks; perform hash operations on the M encrypted data blocks respectively to obtain M second hash values; perform hash operations on the M second hash values ​​to obtain the first hash value, wherein the M encrypted data blocks correspond one-to-one to the M second hash values.

[0018] In a possible implementation, the processor is specifically configured to: perform a hash message authentication code HMAC operation on the M second hash values ​​to obtain the first hash value.

[0019] In a possible implementation, the processor is further configured to: write the M second hash values ​​into the normal partition; or write the M second hash values ​​into the secure partition.

[0020] In one possible implementation, the processor is specifically used to: write the M second hash values ​​into the normal partition using hash blocks as storage units; or write the M second hash values ​​into the secure partition using hash blocks as storage units; wherein a hash block includes at least one of the second hash values; and the size of the hash block is determined based on the processor's read and write data granularity and the size of the second hash value.

[0021] In one possible implementation, the security partition includes a playback protected memory block RPMB partition.

[0022] In one possible implementation, the device also includes an interface; the interface is used to: receive an update request; the update request includes a data block identifier and data to be updated, and the data block identifier is used to indicate the encrypted data block to be updated in the ordinary partition; the processor is also used to: obtain the encrypted data block to be updated from the ordinary partition according to the data block identifier; obtain a second hash value corresponding to the encrypted data block to be updated; if the encrypted data block to be updated is determined to be legal according to the second hash value corresponding to the encrypted data block to be updated, then update the encrypted data block to be updated according to the data to be updated; and update the second hash value corresponding to the encrypted data block to be updated.

[0023] In one possible implementation, the processor is specifically used to: decrypt the encrypted data block to be updated to obtain the data block to be updated; update the data block to be updated with the data to be updated to obtain an updated data block; encrypt the updated data block to obtain an updated encrypted data block; perform a hash operation on the updated encrypted data block to obtain a third hash value; and update the second hash value corresponding to the encrypted data block to be updated to the third hash value.

[0024] In a third aspect, an embodiment of the present application provides a file storage device comprising: an encryption unit, a processing unit, a secure partition and a normal partition; the encryption unit is used to encrypt a first file to obtain a second file in a trusted execution environment, and perform a hash operation on the second file to obtain a first hash value; the processing unit is used to write the first hash value to the secure partition in the memory, and write the second file to the normal partition in the memory; the secure partition is used to prevent files from being tampered with and / or prevent files from being rolled back; the first hash value is used to verify whether the second file is legal when obtaining the second file from the storage area other than the secure partition.

[0025] In one possible design, the first file includes M data blocks, and the second file includes M encrypted data blocks; wherein M is an integer greater than or equal to 2; the encryption unit is specifically used to: perform encryption operations on the M data blocks respectively to obtain the M encrypted data blocks; perform hash operations on the M encrypted data blocks respectively to obtain M second hash values; perform hash operations on the M second hash values ​​to obtain the first hash value, wherein the M encrypted data blocks correspond one-to-one to the M second hash values.

[0026] In one possible design, the encryption unit is specifically used to perform a hash message authentication code HMAC operation on the M second hash values ​​to obtain the first hash value.

[0027] In one possible design, the processing unit is further used to: write the M second hash values ​​into a normal partition; or, write the M second hash values ​​into a secure partition.

[0028] In one possible design, the processing unit is specifically used to: write the M second hash values ​​into a normal partition using a hash block as a processing unit; or write the M second hash values ​​into the secure partition using a hash block as a storage unit; wherein a hash block includes a hash value of at least one encrypted data block; and the size of the hash block is determined based on the processor access data granularity and the size of the second hash value.

[0029] In one possible design, the secure partition includes a playback protected memory block RPMB partition.

[0030] In one possible design, the device also includes a transceiver unit; the transceiver unit is used to: receive an update request; the update request includes a data block identifier and data to be updated, and the data block identifier is used to indicate the encrypted data block to be updated in the ordinary partition; the processing unit is also used to: obtain the encrypted data block to be updated from the ordinary partition according to the data block identifier; obtain a second hash value corresponding to the encrypted data block to be updated; if the encrypted data block to be updated is determined to be legal according to the second hash value corresponding to the encrypted data block to be updated, then update the encrypted data block to be updated according to the data to be updated; and update the second hash value corresponding to the encrypted data block to be updated.

[0031] In one possible design, the processing unit is specifically used to: decrypt the encrypted data block to be updated to obtain the data block to be updated; update the data block to be updated with the data to be updated to obtain an updated data block; encrypt the updated data block to obtain an updated encrypted data block; perform a hash operation on the updated encrypted data block to obtain a third hash value; and update the second hash value corresponding to the encrypted data block to be updated to the third hash value.

[0032] In a fourth aspect, an embodiment of the present application provides a computer storage medium, in which instructions are stored, and when the computer storage medium is run on a computer, the computer executes the method in the first aspect or any possible implementation of the first aspect.

[0033] In a fifth aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method in the first aspect or any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1A schematic diagram of a software framework of a trusted environment of a terminal device provided in an embodiment of the present application;

[0035] Figure 2 A schematic diagram of the software and hardware architecture of a terminal device provided in an embodiment of the present application;

[0036] Figure 3 A schematic diagram of a file storage method flow provided in an embodiment of the present application;

[0037] Figure 4 A schematic diagram of another file storage method provided in an embodiment of the present application;

[0038] Figure 4a A schematic diagram of an architecture for storing a first file provided in an embodiment of the present application;

[0039] Figure 5 A flowchart of a method for reading data from an RPMB partition of a UFS provided in an embodiment of the present application;

[0040] Figure 6 A flowchart of a method for writing data to an RPMB partition of a UFS provided in an embodiment of the present application;

[0041] Figure 7 A schematic diagram of the structure of data of an RPMB partition provided in an embodiment of the present application;

[0042] Figure 8 A schematic diagram of the structure of a file storage device provided in an embodiment of the present application;

[0043] Fig. 9 A schematic diagram of the structure of a file storage device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] The terms "first", "second", etc. in the specification embodiments and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or precedence. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, including a series of steps or units. The method, system, product or device is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0045] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0046] The realization of various functions of the terminal device needs to rely on the trusted environment within the terminal device. The trusted environment of the terminal device physically isolates two coexisting execution environments by mixing hardware and software, namely: an ordinary non-confidential execution environment and a secure confidential environment. Among them, the ordinary non-confidential execution environment can be called a rich execution environment (REE), and the secure confidential environment is called a trusted execution environment (TEE). The embodiment of the present application takes TEE as an example of the concept proposed by the global platform (GP), a standard organization for the security of smart cards and terminal devices. The terminal device can be a smart phone, a smart TV, a tablet computer, a set-top box, and an online video player. Figure 1 The following is a schematic diagram of a software framework of a trusted environment of a terminal device provided by an embodiment of the present application. Figure 1 As shown, the software framework of the trusted environment of the terminal device includes REE software architecture and TEE software architecture.

[0047] REE is usually the operating environment of terminal device operating systems such as Android or Apple's mobile operating system (iPhone operating system, iOS). REE software architecture includes client applications, TEE function application programming interface (API), TEE client API and ordinary operating system. Client applications can be provided to users for use. They can be client applications of operators or third-party client applications, such as WeChat or Alipay. Client applications may have files that need to be stored securely. TEE function API can provide client applications with a set of interfaces to access TEE security services (such as storage and encryption algorithms). TEE client API can provide client applications running in REE environment to access trusted applications (TA) in TEE environment and exchange data with TA. The ordinary operating system includes public device driver module and REE communication agent module. The public device driver module can provide an interface between hardware devices and ordinary operating systems, which is used to notify the ordinary operating system of the functions of the hardware device and convert the instructions of the ordinary operating system into commands that the hardware device can recognize. REE communication agent can be used for message transmission between client applications and TA.

[0048] TEE provides a relatively secure closed execution environment, which can ensure that various sensitive files are stored and protected in a trusted environment. TEE software architecture includes TA, TEE internal API and trusted operating system. TA runs in TEE, and TA can provide security services (such as secure storage and encryption) to its users. TA can communicate with TA through TEE internal API. TEE internal API can define a set of APIs for TA running in TEE. This set of APIs defines the development interface of TA running in TEE. Specifically, it can provide scheduling, communication and memory management interfaces, as well as APIs interfaces such as secure storage, cryptographic services and encryption. Trusted operating system includes TEE communication agent module, trusted core framework module and trusted function module. TEE communication agent and REE communication agent can be combined to realize the secure transmission of messages between client applications and TA. Trusted core framework provides trusted operating system functions to TA. Trusted function module can provide auxiliary facilities support to application developers.

[0049] Figure 2 The following is a schematic diagram showing the software and hardware architecture of a terminal device provided in an embodiment of the present application. Figure 2 As shown, the terminal device includes the software and hardware architecture of REE and the software and hardware architecture of TEE.

[0050] The software and hardware architecture of REE includes REE hardware, REE hardware driver module, common operating system, TEE client API and client application. REE hardware includes input / output interface, memory and central processing unit (CPU) and other devices. REE hardware driver can provide common execution environment hardware device driver under common operating system, such as driver of hardware devices such as EMMC. When common operating system needs to use hardware device, such as writing files to EMMC, common operating system will first send corresponding instructions to EMMC driver. After receiving the instructions, EMMC driver will translate the instructions into electronic signal commands that EMMC can recognize, so as to write files to EMMC. Common operating system includes REE communication agent and REE application under common operating system, such as client application in REE that accesses TA in TEE. TEE client API can provide client application with interface to access TA, and GP client standard interface can be adopted.

[0051] The software and hardware architecture of TEE includes secure hardware, secure hardware driver, trusted operating system, TEE internal core API and TA, etc. Secure hardware includes secure input / output interface, secure processor, secure memory and trusted device, etc. In one possible implementation, the secure input / output interface in the secure hardware can be a secure mode of the input / output interface of REE, or an input / output interface isolated from the input / output interface of REE; the secure processor can be a secure mode of the CPU in REE, or a processor isolated from the CPU; the secure memory can be a partition of the memory in REE, or a secure mode of the memory of REE. The secure hardware driver can provide drivers for secure hardware devices, such as fingerprint device drivers, which are used to read fingerprint information of fingerprint acquisition devices (trusted devices), and the fingerprint information is files to be stored; EMMC drivers, which can be used to read files in EMMC or write files to EMMC, etc. The trusted operating system can provide trusted operating system functions, such as core security function modules such as storage, encryption (such as hash operations, encryption operations) and TEE communication agent. The processing module can provide unified secure data storage services and APIs in the TEE environment. The encryption module can provide security services such as encryption and decryption, private key signing and hashing in the TEE environment.

[0052] Based on the above, Figure 3 The schematic diagram of a file storage method provided by the embodiment of the present application is exemplified. The file storage method is in the above Figure 1 or Figure 2 Executing the file storage method in TEE can improve the security of the storage process. Figure 3 As shown, the method includes:

[0053] Step S301: encrypt a first file to obtain a second file, and perform a hash operation on the second file to obtain a first hash value.

[0054] In a possible implementation, the first file is a file to be stored, which may be in the form of text or pictures, etc. The encryption method for the first file may be symmetric key encryption, asymmetric key encryption, or hardware encryption; symmetric key encryption has a higher encryption rate. Optionally, encrypting the first file and performing a hash operation on the second file may be the above Figure 2 The cryptographic module in the trusted operating system in the TEE is executed.

[0055] Step S302, writing the first hash value into the secure partition in the memory, and writing the second file into the common partition in the memory;

[0056] The security partition is used to prevent files from being tampered with and / or to prevent files from being rolled back; the first hash value is used to verify whether the second file is legal when the second file is decrypted to obtain the first file.

[0057] In one possible implementation, the ordinary partition of the memory may be a storage area other than the secure partition. The second file is obtained from the ordinary partition in the memory, and the same hash operation is performed on the obtained second file to obtain a hash value. If it is determined that the calculated hash value is the same as the first hash value obtained from the secure partition, it means that the obtained second file is legal.

[0058] In the embodiment of the present application, it can be seen from the above steps S301 and S302 that the encryption of the first file and the hash operation of the second file are both performed in the TEE, so the security of the encryption process and the hash operation process can be improved. Moreover, the tampering of the second file can only be achieved after both the second file and the first hash value are tampered with. However, the embodiment of the present application writes the second file to the ordinary partition in the memory and writes the first hash value to the secure partition, that is, the second file and the corresponding first hash value of the second file are stored separately. Separate storage can increase the difficulty of tampering with the second file and help improve the security of the second file.

[0059] Furthermore, the corresponding first hash value of the second file is written into the secure partition in the memory, and the secure partition is used to prevent the file from being tampered with and / or rolled back. Therefore, the first hash value of the secure partition can prevent tampering with and / or rolling back. Moreover, the first hash value has a smaller data volume than the second file and occupies less memory. In this way, the second file can be prevented from being tampered with and / or rolled back by using the first hash value that occupies less memory.

[0060] In the above step S301, in order to improve the updating efficiency of the second file, a possible implementation method is to update the part of the second file that needs to be updated. Figure 4 A schematic diagram of another file storage method provided in an embodiment of the present application is shown as an example. Figure 4 The file storage method shown can realize partial update of stored files, thereby improving the update efficiency of files. Figure 4 As shown, the file storage method includes:

[0061] Step S401: divide the first file into M data blocks; wherein M is an integer greater than or equal to 2.

[0062] In a possible implementation, the size of the data block can be determined according to the granularity of the processor accessing data. The processor treats the memory as blocks, and the size of the block can be 2, 4, 8 or 16 bytes. Therefore, when the processor reads the memory, it reads it block by block. The size of the block is called the processor storage data granularity. Exemplarily, in a 32-bit processor, the processor accesses the memory in accordance with 32 bits, that is, 4 bytes are read or written at a time. For example, the 16-byte memory of the memory address 0x0~0xF is not regarded as 16 single bytes for the processor, but as 4 blocks, each of which is 4 bytes. That is, in this case, the processor accesses the data granularity of 4 bytes, and the size of the data block can be determined as a positive integer multiple of 4 bytes. When the data block is encrypted and stored, memory alignment can be achieved. In this way, when the processor needs to read data, it can read one data block at a time, which can reduce the number of processor accesses and thus improve the efficiency of the processor in reading data. Optionally, after the first file is divided into a plurality of data blocks, if the remaining data of the first file is not large enough to be divided into a data block, such as being less than a positive integer multiple of 4 bytes, the remaining data of the first file may be padded with 0s to form a complete data block. Correspondingly, when decrypting the data block padded with 0s, the padded 0s are removed.

[0063] Step S402, performing encryption operations on the M data blocks respectively to obtain M encrypted data blocks; the second file includes the M encrypted data blocks.

[0064] In an optional implementation, the M data blocks may be encrypted by a symmetric key, an asymmetric key, or a hardware encryption method. Optionally, the keys used to encrypt the M data blocks may be the same key or different keys. Using the same key to encrypt the M data blocks respectively may increase the efficiency of encryption, and the need to store a key may reduce the number of keys to be stored. Different keys may also be used to encrypt different data blocks, thereby enhancing the security of the first file storage. Optionally, the encrypted keys may all be stored in a secure partition of the memory to improve the security of the keys.

[0065] Step S403: Perform hash operations on the M encrypted data blocks respectively to obtain M second hash values, and perform hash operations on the M second hash values ​​to obtain the first hash value.

[0066] The M encrypted data blocks correspond to the M second hash values ​​one by one. By performing hash operations on the M encrypted data blocks respectively, M second hash values ​​are obtained. On the one hand, the input of the hash operation is an encrypted data block, and the data volume of the encrypted data block is smaller than that of the entire second file, so the calculation efficiency of the second hash value can be improved; on the other hand, after obtaining the M second hash values, the M second hash values ​​are used as inputs for hash operations to obtain the first hash value of the second file. The M second hash values ​​are smaller than the data volume of the M encrypted data blocks, so the calculation efficiency of the first hash value can be further improved.

[0067] In a possible implementation, performing a hash operation on the M second hash values ​​to obtain the first hash value may be performing a hash message authentication code (HMAC) operation on the M second hash values ​​to obtain the first hash value. The HMAC operation is a key-based hash algorithm, and its implementation principle is: using a hash function, a key and a message to generate a fixed-length value as an authentication identifier, and using this identifier to identify the integrity of the message. Specifically, using a key shared with the receiving end and a message as inputs to the HMAC operation, a message digest (i.e., a fixed-length value) is generated as output, and the message digest and the message are transmitted to the receiving end together, and the receiving end uses the key shared with the sending end to identify the legitimacy of the receiving end and the integrity of the message, wherein the shared key is pre-agreed by both parties. Hash functions include, but are not limited to, message digest algorithm version 5 (MD5), secure hash algorithm (SHA), such as SHA-1 and SHA-2 (SHA-256, SHA-384 and SHA-512).

[0068] Combination Figure 2 , the above steps S402 and S403 can be executed in the encryption module of the trusted operating system of the TEE. In the embodiment of the present application, the shared key can be stored in a secure partition of the memory, isolated from the REE, and the shared key cannot be obtained by the REE, thus improving the security of the shared key.

[0069] Step S404, write the second file and the M second hash values ​​into the common partition, and write the first hash value into the secure partition. That is, only the first hash value is written into the secure partition. The first hash value has a small amount of data, and the first hash value with a small amount of data is stored in the secure partition, which can prevent the second file from being tampered with and / or rolled back by the first hash value with a small amount of data. Moreover, the second file is stored in the common partition of the memory, which can realize the storage of the second file with a large amount of data, and the first hash value with a small amount of data in the secure partition can be used to prevent the entire second file from being tampered with and / or rolled back.

[0070] Step S405, write the second file into the common partition, and write the M second hash values ​​and the first hash value into the secure partition. By writing the M second hash values ​​into the secure partition, the M encrypted data blocks and the M second hash values ​​are stored separately, thereby improving the security of the M encrypted data blocks. Furthermore, each of the M second hash values ​​in the secure partition can be used to prevent each encrypted data block from being tampered with and / or rolled back.

[0071] In a possible implementation, M second hash values ​​are written into a common partition with a hash block as a storage unit; or, M second hash values ​​are written into a secure partition with a hash block as a storage unit. Wherein, one hash block includes at least one second hash value; the size of the hash block is determined according to the processor access data granularity and the size of the second hash value. For example, if the processor access data granularity is 4 bytes, the size of the hash block can be determined as a positive integer multiple of 4 bytes. If the size of the hash block is determined to be 4 bytes, and the hash value of the encrypted data block is calculated by SHA-256, and the size of the second hash value obtained is 256 bits, then one hash block includes 128 second hash values. If the size of the hash block is determined to be 4 bytes, and the hash value of the encrypted data block is calculated by SHA-512, and the size of the second hash value obtained is 512 bits, then one hash block includes 64 second hash values. In this way, by writing M second hash values ​​into a secure partition of a memory or a common partition of a memory with a hash block as a storage unit, the efficiency of the processor accessing data can be improved.

[0072] There is no order between step S404 and step S405, and step S404 or step S405 is performed after step S403. That is, if step S404 is performed after step S403, step S405 is not performed, and if step S405 is performed, step S404 is not performed.

[0073] In order to facilitate the understanding of the solution, this application is illustrated with the following examples. Figure 4a The schematic diagram of an architecture for storing a first file provided by an embodiment of the present application is exemplarily shown. Figure 4a As shown, the first file includes M data blocks; the size of each data block can be determined according to the granularity of the processor accessing data. The embodiment of the present application takes a 32-bit processor as an example, assuming that the size of each data block is determined to be 4 bytes. The M data blocks are encrypted separately to obtain M encrypted data blocks, and the M encrypted data blocks constitute the second file. The M encrypted data blocks are hashed separately to obtain M second hash values, and the M second hash values ​​are HMAC operated to obtain the first hash value; wherein, if the hash operation adopts SHA-256, the size of the second hash value is 256 bits, and the size of 128 second hash values ​​is 4K, therefore, one hash block includes 128 second hash values, the size of the hash block is 4 bytes, and the M second hash values ​​are written to the secure partition according to the hash block as the storage unit, or, written to the ordinary partition.

[0074] In an embodiment of the present application, in order to further facilitate the storage of the M second hash values ​​using a hash block as a storage unit, the M data blocks can be grouped according to the hash operation when calculating the second hash value and the granularity of the processor accessing the data. For example, if SHA-256 is used for the hash operation to calculate the second hash value, the size of the second hash value is 256 bits, and if the granularity of the processor accessing the data is 4 bytes, 128 second hash values ​​are required to form a hash block, and one second hash value corresponds to one encrypted data block. Therefore, the 128 data blocks can be divided into a data group. In other words, one data group corresponds to 128 second hash values, forming a hash block, and the hash block is used as a storage unit to store the M second hash values.

[0075] The embodiment of the present application provides an optional implementation method for updating part of the files in the first file after the first file is stored according to the storage method of the above steps S401 to S402. The optional implementation method is: receiving an update request; the update request includes a data block identifier and data to be updated, and the data block identifier is used to indicate the encrypted data block to be updated in the common partition; according to the data block identifier, obtaining the encrypted data block to be updated from the common partition; obtaining the second hash value corresponding to the encrypted data block to be updated; if the encrypted data block to be updated is determined to be legal according to the second hash value corresponding to the encrypted data block to be updated, then updating the encrypted data block to be updated according to the data to be updated; updating the second hash value corresponding to the encrypted data block to be updated.

[0076] In one possible implementation, after obtaining the encrypted data block to be updated and the second hash value corresponding to the encrypted data block to be updated, the obtained encrypted data block to be updated is hashed using the same hash operation; if the calculated hash value is the same as the second hash value corresponding to the obtained encrypted data block to be updated, it is determined that the encrypted data block to be updated is legal.

[0077] In a possible implementation, after verifying that the encrypted data block to be updated is legal, the encrypted data block to be updated is decrypted to obtain the data block to be updated; the data to be updated is updated with the data to be updated to obtain the updated data block; the updated data block is encrypted to obtain the updated encrypted data block; the updated encrypted data block is hashed to obtain the third hash value; the second hash value corresponding to the encrypted data block to be updated is updated to the third hash value. In this way, there is no need to decrypt and encrypt the entire second file and then calculate the hash value of the updated entire second file, which reduces the overhead caused by the overall encryption, decryption, and hashing operation.

[0078] In one possible implementation, after the second hash value corresponding to the encrypted data block to be updated is updated with the third hash value, a hash operation is performed on (M-1) second hash values ​​and the third hash value to obtain a new hash value corresponding to the second file, and the first hash value is updated with the new hash value.

[0079] In an embodiment of the present application, the security partition includes an RPMB partition; or, other security partitions based on the RPMB partition technology. Among them, the RPMB partition can be a partition with security features in the EMMC, or it can be a partition with security features in the universal flash storage (UFS). The RPMB partition or other security partitions based on the RPMB partition technology have the characteristics of preventing the files written to the security partition from being illegally tampered with and / or rolled back. Therefore, in practical applications, some important files are usually written in the security partition, such as fingerprint files, key files, serial numbers, and digital rights management files.

[0080] The embodiment of the present application provides an optional implementation method of writing the first hash value to the RPMB partition of UFS. In this implementation, when the terminal device writes data to the RPMB partition of UFS, UFS verifies the legitimacy of the terminal device, and only specific terminal devices can write. Moreover, when the terminal device reads data from the RPMB partition of UFS, a verification mechanism is also provided to ensure that the data read by the terminal device is data on the RPMB partition, not data forged by an attacker. Figure 5 The following is a flow chart of a method for reading data from a RPMB partition of a UFS provided in an embodiment of the present application. This implementation is described by taking reading the count value in the RPMB partition of the UFS as an example. Figure 5 As shown, the method includes:

[0081] Step S501: The terminal device sends a request to the UFS to read the count value in the RPMB partition.

[0082] The request to read the count value in the RPMB partition also includes a first random number, which is randomly generated by the terminal device.

[0083] Step S502: UFS reads a first count value from the RPMB partition according to a request to read the count value in the RPMB partition, where the first count value is the current count value in the RPMB partition.

[0084] In a possible implementation, UFS maintains a count value, the initialization value of the count value is zero, each time data is successfully written to the RPMB partition, the count value is increased by one, and the count value cannot be restored.

[0085] In step S503, the UFS uses the shared key, the first random number and the first count value as inputs of an HMAC operation to generate a first message authentication code (MAC).

[0086] Optionally, the shared key is pre-agreed between the legitimate terminal device and the UFS, and is burned into the RPMB partition of the UFS when the UFS leaves the factory. Among them, the MAC is essentially a hash value. One feature of the hash operation is that even if only one bit of the original data is changed, the hash values ​​of the two are completely different. If a malicious attacker tampers with the data during data transmission, the message authentication code generated by the UFS based on the received data and the shared key is different from the received message authentication code. If the authentication fails, the data will not be written to the UFS.

[0087] Step S504: The UFS sends the first MAC, the received first random number, and the read first count value to the terminal device.

[0088] Step S505, after the terminal device receives the first MAC, the first random number and the first count value sent by the UFS, it determines whether the received first random number is consistent with the first random number included in the request to read the count value in the RPMB partition in step S501; if they are consistent, execute step S506; if they are inconsistent, execute step S509.

[0089] Step S506: The terminal device uses the locally stored shared key, the first random number, and the received first count value as inputs of an HMAC operation to generate a second MAC.

[0090] Step S507, the terminal device determines whether the second MAC is the same as the first MAC; if they are the same, execute step S508; if they are not the same, execute step S509.

[0091] Step S508: The terminal device determines that the read first count value is the first count value in the RPMB partition of the UFS.

[0092] Step S509: the terminal device discards the read data.

[0093] Through the above steps S501 to S509, the terminal device reads the first count value in the RPMB partition of UFS, which needs to be authenticated. UFS will calculate the first message authentication code, and then the terminal device authenticates the data according to the received first message authentication code and the generated second message authentication code. In this way, it is possible to prevent malicious attackers from replacing the first count value with malicious data during the data transmission process (from UFS to the terminal device). In this way, it is possible to ensure that the first count value read by the terminal device is the first count value in the RPMB partition of UFS, not data forged by the attacker. In the embodiment of the present application, the process of reading other data from the RPMB partition of UFS is the same as the process of reading the first count value described above, which will not be repeated here.

[0094] Before writing data to the RPMB partition, the terminal device needs to obtain the current count value in the RPMB partition. Figure 5 The first count value in the RPMB partition of the UFS read, Figure 6 The following is a flow chart of a method for writing data to the RPMB partition of a UFS provided in an embodiment of the present application. In this embodiment, the data to be stored is the first hash value as an example. Figure 6 As shown, the method includes:

[0095] Step S601: The terminal device uses the shared key, the read first count value and the first hash value as inputs of an HMAC operation to generate a third MAC.

[0096] In an optional implementation manner, the shared key is the same as the shared key in the above step S503.

[0097] Step S602: The terminal device sends the first hash value, the first count value, and the third MAC to the UFS.

[0098] Step S603, after receiving the first hash value, the first count value and the third MAC sent by the terminal device, the UFS determines whether the received first count value is consistent with the current count value in the RPMB partition of the UFS; if they are consistent, execute step S604; if they are inconsistent, execute step S607;

[0099] Step S604, the UFS uses the received first hash value, the first count value, and the shared key as inputs of an HMAC operation to generate a fourth MAC;

[0100] Step S605, UFS determines whether the fourth MAC is the same as the received third MAC; if they are the same, execute step S606; if they are not the same, execute step S607;

[0101] Step S606: UFS writes the first hash value into the RPMB partition.

[0102] Combined with the above Figure 1 and Figure 2There are two ways to implement writing the first hash value into the RPMB partition. The first way to implement is to use the TEE client API to write the first hash value into the RPMB partition of the REE through shared memory. Specifically, the encryption module can call the TEE client API, write the first hash value into the shared memory, and notify the ordinary execution environment hardware driver module (RPMB driver) in the ordinary execution environment to write the data in the shared memory into the RPMB partition. Another way to implement is through the TEE communication agent and the REE communication agent, which can be specifically as follows: the TEE communication agent sends the first hash value to the REE communication agent, and after the REE communication agent receives the first hash value, it sends an instruction to the RPMB driver to write the first hash value into the RPMB partition, and the RPMB driver writes the first hash value into the RPMB partition.

[0103] Step S607: UFS rejects writing of the first hash value.

[0104] After the above step S606, the first count value in the RPMB partition is incremented. In this way, even if a malicious attacker steals the first hash value, the first count value, and the third MAC in step S602, the third MAC is generated by calculating the first count value and the first hash value. After the first hash value is successfully written to the RPMB partition, the first count value in the RPMB partition is incremented by one, and the thief cannot generate a MAC after the first count value is incremented by one, so it is impossible to repeatedly write the first hash value to the RPMB partition of the UFS. In this way, the data written to the RPMB partition can be prevented from being rolled back (also called replay).

[0105] Optionally, a process of writing the M second hash values ​​into the secure partition is the same as a process of writing the first hash value into the secure partition, which is not repeated here.

[0106] In a possible implementation, when writing the data to be stored into the RPMB partition, the data to be stored needs to be encapsulated into a data structure of the RPMB partition. Figure 7 The following is a schematic diagram showing the structure of data of an RPMB partition provided by an embodiment of the present application. Figure 7As shown, the data of the RPMB partition includes a start field, a stuffbytes field, a MAC field, a data field, a nonce field, a write counter field, a data address field, a block count field, an operation result field, a request / response field, a cyclic redundancy check (CRC) field, and an end field. The cyclic redundancy check field is used to detect errors in the data transmission function, perform multiple calculations on the data, and attach the calculated results to the back of the data. The receiving device also performs a similar algorithm to ensure the correctness and integrity of the data transmission. The length is 2 bytes. The request / response field defines the request type / response type, with a length of 2 bytes. When writing data to the RPMB partition, this field is the request type; when reading data from the RPMB partition, this field indicates the response type. The count value field is used to indicate the number of times the data is successfully written, with a length of 4 bytes. The MAC field depends on the request type / response type and has a length of 32 bytes. The operation result field contains status information about the write calculation value (valid, expired), and has a length of 2 bytes. The data address field is used to indicate the logical address for reading or writing data to the RPMB partition, and has a length of 2 bytes. It can be a serial number of a series of accessed half sectors, and the first address is 0x0000. The random number is a random number generated by the terminal device when sending a request to the memory, and has a length of 16 bytes. The data represents the data to be written or the data read out. The data to be written can be the first hash value and / or M second hash values. The data read out can be a count value, and the length of the data is 256 bytes. The block count value field is used to indicate the number of specified read logical blocks (half sector, 256 bytes), or the number of specified write logical blocks, and has a length of 2 bytes. The fill word can be used for memory alignment. When the M second hash values ​​are stored in the RPMB partition as hash blocks, the second hash values ​​that do not satisfy one hash block can be filled with 0 bytes to form a hash block, and the length is 196 bits.

[0107] Based on the above content and the same concept, the present application provides a file storage device 800 for executing the above method. Figure 8 The schematic diagram of the structure of a file storage device provided by the present application is shown as an example. Figure 8 As shown, the file storage device 800 includes a processor 801 , a memory 802 and a bus 803 ; wherein the processor 801 and the memory 802 may be interconnected via the bus 803 .

[0108] Processor 801 is used to encrypt a first file to obtain a second file in a trusted execution environment TEE, and perform a hash operation on the second file to obtain the first hash value; write the first hash value to a secure partition in a memory 802, and write the second file to a normal partition in the memory 802; the secure partition is used to prevent the file from being tampered with and / or rolled back; the first hash value is used to verify whether the second file is legal when the second file is decrypted to obtain the first file.

[0109] The processor 801 may be a central processing unit 801 (CPU), a network processor 801 (NP) or a combination of a CPU and a NP. The processor 801 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0110] The memory 802 is used to store software instructions. The processor 801 calls the stored program instructions to execute one or more steps in the embodiments shown in the above scheme, or optional implementation methods thereof.

[0111] The memory 802 may include a non-volatile memory 802 (non-volatile memory), such as UFS, EMMC, flash memory 802 (flash memory), a hard disk drive (HDD) or a solid-state drive (SSD); the memory 802 may also include a combination of the above-mentioned types of memory 802.

[0112] The bus 803 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0113] In a possible design, the memory 802 may also be integrated with the processor 801 .

[0114] In an optional implementation, the first file includes M data blocks, and the second file includes M encrypted data blocks; wherein M is an integer greater than or equal to 2; the processor 801 is specifically used to: perform encryption operations on the M data blocks respectively to obtain the M encrypted data blocks; perform hash operations on the M encrypted data blocks respectively to obtain M second hash values; perform hash operations on the M second hash values ​​to obtain the first hash value, wherein the M encrypted data blocks correspond one-to-one to the M second hash values.

[0115] In a possible implementation, the processor 801 is specifically configured to: perform a hash message authentication code HMAC operation on the M second hash values ​​to obtain the first hash value.

[0116] In an optional implementation, the processor 801 is further configured to: write the M second hash values ​​into the common partition; or write the M second hash values ​​into the secure partition.

[0117] In an optional implementation, the processor 801 is specifically used to: write the M second hash values ​​into the normal partition using hash blocks as storage units; or write the M second hash values ​​into the secure partition using hash blocks as storage units; wherein a hash block includes at least one of the second hash values; and the size of the hash block is determined based on the processor read and write data granularity and the size of the second hash value.

[0118] In an optional implementation, the security partition includes a playback protected memory block RPMB partition.

[0119] In an optional implementation, the device also includes an interface; the interface is used to: receive an update request; the update request includes a data block identifier and data to be updated, and the data block identifier is used to indicate the encrypted data block to be updated in the ordinary partition; the processor is also used to: obtain the encrypted data block to be updated from the ordinary partition according to the data block identifier; obtain a second hash value corresponding to the encrypted data block to be updated; if the encrypted data block to be updated is determined to be legal according to the second hash value corresponding to the encrypted data block to be updated, then update the encrypted data block to be updated according to the data to be updated; and update the second hash value corresponding to the encrypted data block to be updated.

[0120] In an optional implementation, the processor 801 is specifically used to: decrypt the encrypted data block to be updated to obtain the data block to be updated; update the data block to be updated with the data to be updated to obtain an updated data block; encrypt the updated data block to obtain an updated encrypted data block; perform a hash operation on the updated encrypted data block to obtain a third hash value; and update the second hash value corresponding to the encrypted data block to be updated to the third hash value.

[0121] Based on the above content and the same concept, the present application provides a file storage device 900 for executing the above method. Fig. 9 The schematic diagram of the structure of a file storage device provided by the present application is shown as an example. Fig. 9 As shown, the file storage device 900 includes an encryption unit 901 , a processing unit 902 , a secure partition 903 and a common partition 904 .

[0122] The encryption unit 901 is used to: encrypt a first file to obtain a second file in a trusted execution environment, and perform a hash operation on the second file to obtain a first hash value;

[0123] The processing unit 902 is used to: write the first hash value into the secure partition in the memory, and write the second file into the ordinary partition in the memory; the secure partition is used to prevent the file from being tampered with and / or prevent the file from being rolled back; the first hash value is used to verify whether the second file is legal when the second file is decrypted to obtain the first file.

[0124] It should be understood that the division of the above-mentioned units of the file storage device is only a division of logical functions, and in actual implementation, all or part of them can be integrated into one physical entity, or they can be physically separated. Fig. 9 The encryption unit 901 and the processing unit 902 involved can be Figure 8That is, the encryption unit 901 and the processing unit 902 in the embodiment of the present application can execute the above Figure 8 The solution executed by the processor 801, the rest of the content can refer to the above content, and will not be repeated here.

[0125] In the above embodiments, it can be implemented in whole or in part by software, hardware or a combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The instructions can be stored in a computer storage medium, or transmitted from one computer storage medium to another computer storage medium. For example, the instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, twisted pair) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer storage medium can be any medium that a computer can access or a data storage device such as a server or data center that includes one or more media integrations. The medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape, a magneto-optical disk (MO), etc.), an optical medium (e.g., an optical disk), or a semiconductor medium (e.g., a ROM, EPROM, EEPROM, a solid state disk (SSD)), etc.

[0126] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by instructions. These instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0127] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1A function specified in one or more boxes.

[0128] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0129] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A file storage method, characterized in that: include: In a trusted execution environment TEE, encrypt the first file to obtain a second file, and perform a hash operation on the second file to obtain a first hash value; The first hash value is written into a secure partition in a memory, and the second file is written into a normal partition in the memory; the secure partition is used to prevent files from being tampered with and / or rolled back; the first hash value is used to verify whether the second file is legal when the second file is decrypted to obtain the first file.

2. The method according to claim 1, characterized in that The first file includes M data blocks, and the second file includes M encrypted data blocks; wherein M is an integer greater than or equal to 2; The step of encrypting the first file to obtain the second file includes: Perform encryption operations on the M data blocks respectively to obtain the M encrypted data blocks; The performing a hash operation on the second file to obtain the first hash value includes: Performing hash operations on the M encrypted data blocks respectively to obtain M second hash values; A hash operation is performed on the M second hash values ​​to obtain the first hash value, wherein the M encrypted data blocks correspond one-to-one to the M second hash values.

3. The method according to claim 2, characterized in that The performing a hash operation on the M second hash values ​​to obtain the first hash value includes: Perform a hash message authentication code HMAC operation on the M second hash values ​​to obtain the first hash value.

4. The method according to claim 2, characterized in that The method further comprises: Write the M second hash values ​​into the normal partition; or write the M second hash values ​​into the secure partition.

5. The method according to claim 4, characterized in that Writing the M second hash values ​​into the common partition includes: Writing the M second hash values ​​into the common partition using hash blocks as storage units; Writing the M second hash values ​​into the secure partition includes: Writing the M second hash values ​​into the secure partition using hash blocks as storage units; Among them, a hash block includes at least one of the second hash values; the size of the hash block is determined according to the granularity of processor reading and writing data and the size of the second hash value.

6. The method according to any one of claims 1 to 5, characterized in that: The security partition includes a playback protected memory block RPMB partition.

7. The method according to any one of claims 2 to 5, characterized in that The method further comprises: receiving an update request; the update request comprising a data block identifier and data to be updated, the data block identifier being used to indicate an encrypted data block to be updated in the common partition; According to the data block identifier, obtaining the encrypted data block to be updated from the common partition; Obtaining a second hash value corresponding to the encrypted data block to be updated; If it is determined that the encrypted data block to be updated is legal according to the second hash value corresponding to the encrypted data block to be updated, then updating the encrypted data block to be updated according to the data to be updated; Update the second hash value corresponding to the encrypted data block to be updated.

8. The method according to claim 7, characterized in that The updating of the encrypted data block to be updated according to the data to be updated includes: Decrypting the encrypted data block to be updated to obtain the data block to be updated; Updating the data block to be updated with the data to be updated to obtain an updated data block; Encrypting the updated data block to obtain an updated encrypted data block; Updating the second hash value corresponding to the encrypted data block to be updated includes: Performing a hash operation on the updated encrypted data block to obtain a third hash value; The second hash value corresponding to the encrypted data block to be updated is updated to the third hash value.

9. A file storage device, characterized in that: include: Processor and memory; The processor is used to encrypt the first file to obtain the second file in the trusted execution environment TEE, and perform a hash operation on the second file to obtain a first hash value; The processor is further used to write the first hash value into a secure partition in the memory, and to write the second file into a normal partition in the memory; the secure partition is used to prevent files from being tampered with and / or rolled back; the first hash value is used to verify whether the second file is legal when the second file is decrypted to obtain the first file.

10. The device according to claim 9, characterized in that The first file includes M data blocks, and the second file includes M encrypted data blocks; wherein M is an integer greater than or equal to 2; The processor is specifically used for: Perform encryption operations on the M data blocks respectively to obtain the M encrypted data blocks; perform hash operations on the M encrypted data blocks respectively to obtain M second hash values; perform hash operations on the M second hash values ​​to obtain the first hash value, wherein the M encrypted data blocks correspond one-to-one to the M second hash values.

11. The device according to claim 10, characterized in that The processor is specifically used for: Perform a hash message authentication code HMAC operation on the M second hash values ​​to obtain the first hash value.

12. The device according to claim 10, characterized in that The processor is further configured to: Write the M second hash values ​​into the normal partition; or write the M second hash values ​​into the secure partition.

13. The device according to claim 12, characterized in that The processor is specifically used for: Writing the M second hash values ​​into the common partition using hash blocks as storage units; or writing the M second hash values ​​into the secure partition using hash blocks as storage units; Among them, a hash block includes at least one of the second hash values; the size of the hash block is determined according to the granularity of processor reading and writing data and the size of the second hash value.

14. The device according to any one of claims 9 to 13, characterized in that The security partition includes a playback protected memory block RPMB partition.

15. The device according to any one of claims 10 to 13, characterized in that The device also includes an interface; The interface is used to: receiving an update request; the update request comprising a data block identifier and data to be updated, the data block identifier being used to indicate an encrypted data block to be updated in the common partition; The processor is further configured to: According to the data block identifier, obtaining the encrypted data block to be updated from the common partition; obtaining a second hash value corresponding to the encrypted data block to be updated; If it is determined that the encrypted data block to be updated is legal according to the second hash value corresponding to the encrypted data block to be updated, then updating the encrypted data block to be updated according to the data to be updated; Update the second hash value corresponding to the encrypted data block to be updated.

16. The device according to claim 15, characterized in that The processor is specifically used for: Decrypting the encrypted data block to be updated to obtain the data block to be updated; updating the data block to be updated with the data to be updated to obtain an updated data block; Encrypting the updated data block to obtain an updated encrypted data block; Performing a hash operation on the updated encrypted data block to obtain a third hash value; The second hash value corresponding to the encrypted data block to be updated is updated to the third hash value.

17. A file storage device, characterized in that: include: Encryption unit, processing unit, secure partition and normal partition; The encryption unit is used to encrypt the first file to obtain the second file in the trusted execution environment, and perform a hash operation on the second file to obtain a first hash value; The processing unit is used to write the first hash value into the secure partition in the memory, and to write the second file into the ordinary partition in the memory; the secure partition is used to prevent the file from being tampered with and / or rolled back; the first hash value is used to verify whether the second file is legal when the second file is decrypted to obtain the first file.

18. A computer-readable storage medium, characterized in that: The readable storage medium stores a software program, and when the software program is read and executed by one or more processors, the software program implements the file storage method according to any one of claims 1 to 8.

Images