A control method and device for decrypting disk data

Abstract

The present application discloses a control method and device for decrypting disk data, the method comprising: obtaining a first private key of a user when the disk data is inaccessible; using the first private key to decrypt pre-saved target information to obtain first information; wherein the target information is information obtained by encrypting the first information using a first public key corresponding to the first private key, and the first information at least represents an operating environment of an electronic device when the disk key can be obtained; replacing the first information with information stored at a target location so that the information stored at the target location is consistent with second information, the second information is pre-saved information, and the second information at least represents an operating environment of the electronic device when the disk key can be obtained; wherein, when the information stored at the target location is consistent with the second information, the disk key can be obtained, and the disk key is used to decrypt the disk data so that the disk data can be accessed.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a control method and device for decrypting disk data. Background Art

[0002] In order to protect the data stored in the computer, more and more computers are configured with encryption systems when they leave the factory. When the computer is started for the first time, the user starts the encryption system by logging in with an account. The encryption system uses the full-disk encryption key to encrypt the computer's entire disk, and uses the disk master key to encrypt and protect the full-disk encryption key.

[0003] Based on this, in order to protect the disk master key, two methods are currently used. One is to use the public key to encrypt the disk master key, and store the platform measurement information under the current running environment during encryption. In this way, when the computer needs to be decrypted again, the private key can be used to decrypt the disk master key if the current platform measurement information is consistent with the platform measurement information when the disk master key was encrypted, thereby decrypting the full disk encryption key and achieving full disk decryption. Another method is to use the recovery key to encrypt the disk master key, and then store the recovery key on the website of the supplier who provides the encryption system. In this way, when the computer needs to be decrypted again, if the current platform measurement information is inconsistent with the platform measurement information when the disk master key was encrypted, the disk master key can be decrypted by accessing the recovery key on the supplier's website, thereby decrypting the full disk encryption key and achieving full disk decryption.

[0004] However, due to different regions or network connection factors, there may be a situation where the current platform measurement information is inconsistent with the platform measurement information when the disk master key was encrypted, and the recovery key on the vendor's website cannot be accessed. In this case, the computer cannot be started and the data on the disk may be lost. Summary of the invention

[0005] In view of this, the present application provides a control method and device for decrypting disk data, as follows:

[0006] A control method for decrypting disk data, comprising:

[0007] In the case where the disk data is inaccessible, obtaining a first private key of the user;

[0008] Using the first private key, decrypting the pre-saved target information to obtain first information; wherein the target information is information obtained by encrypting the first information using the first public key corresponding to the first private key, and the first information at least represents the operating environment of the electronic device when the disk key can be obtained;

[0009] Replacing the information stored at the target location with the first information so that the information stored at the target location is consistent with second information, where the second information is pre-saved information and the second information at least represents an operating environment of the electronic device when the disk key can be obtained;

[0010] Wherein, when the information stored at the target location is consistent with the second information, the disk key can be obtained, and the disk key is used to decrypt the disk data so that the disk data can be accessed.

[0011] In the above method, preferably, the target location is a register in the electronic device;

[0012] The replacing the information stored at the target location with the first information includes:

[0013] The first information is written into the register so that the information stored in the register is consistent with the second information.

[0014] Preferably, the above method further comprises, before writing the first information into the register:

[0015] Keep the register empty.

[0016] The above method is preferably wherein:

[0017] The first information is first measurement information obtained in the process of obtaining the disk key, and the first measurement information is information obtained by measuring parameters of the operating environment of the electronic device, and the measurement information is encrypted by the first public key to obtain the target information;

[0018] The second information is pre-saved second measurement information, the second measurement information is obtained in the process of obtaining the disk key, and the second measurement information is information obtained by performing parameter measurement on the operating environment of the electronic device.

[0019] The above method, preferably, obtaining the disk key includes:

[0020] Reading a second private key stored in the electronic device;

[0021] The disk key encrypted by the second public key corresponding to the second private key is decrypted using the second private key to obtain a decrypted disk key.

[0022] The above method, preferably, decrypting the disk data includes:

[0023] Decrypting the encrypted full disk encryption key using the disk key to obtain a decrypted full disk encryption key;

[0024] The encrypted disk data is decrypted using the decrypted full disk encryption key to obtain the decrypted disk data.

[0025] In the above method, preferably, before using the first private key to decrypt the pre-stored target information to obtain the first information, the method further includes:

[0026] Verifying the first private key to obtain a verification result; the verification result indicates whether the first private key matches the first public key stored in the electronic device;

[0027] In the case where the verification result indicates that the first private key matches the first public key stored in the electronic device, performing the steps of: using the first private key to decrypt the pre-stored target information to obtain the first information;

[0028] When at least the verification result indicates that the first private key does not match the first public key stored in the electronic device, the current process is terminated.

[0029] The above method, preferably, obtains the user's first private key, including:

[0030] The first private key of the user is read in a target device connected to the electronic device.

[0031] The above method, preferably, obtains the user's first private key, including:

[0032] A private key input interface is output on the electronic device, and after receiving an input operation of the user on the private key input interface, a first private key of the user is obtained according to the input operation.

[0033] A control device for decrypting disk data, comprising:

[0034] A private key obtaining unit, used for obtaining a first private key of a user when the disk data cannot be accessed;

[0035] an information decryption unit, configured to use the first private key to decrypt the pre-stored target information to obtain first information; wherein the target information is information obtained by encrypting the first information using the first public key corresponding to the first private key, and the first information at least represents an operating environment of the electronic device when the disk key can be obtained;

[0036] an information replacement unit, configured to replace the information stored at the target location with the first information, so that the information stored at the target location is consistent with second information, wherein the second information is pre-saved information and the second information at least represents an operating environment of the electronic device when the disk key can be obtained;

[0037] Wherein, when the information stored at the target location is consistent with the second information, the disk key can be obtained, and the disk key is used to decrypt the disk data so that the disk data can be accessed.

[0038] It can be seen from the above technical scheme that a control method and device for decrypting disk data disclosed in the present application can obtain the user's first private key when the disk data is inaccessible, and then use the first private key to decrypt the pre-saved target information to obtain the first information. The first information here represents the operating environment of the electronic device when the disk key can be obtained. Therefore, the first information replaces the information stored at the target location so that the information stored at the target location is consistent with the second information. The second information here is the pre-saved information representing the operating environment of the electronic device when the disk key can be obtained. When the information stored at the target location is consistent with the second information, the disk key of the disk data can be obtained. Based on this, the disk data is decrypted using the obtained disk key so that the disk data can be accessed. It can be seen that in the present application, the first information corresponding to the operating environment of the electronic device when the disk key can be obtained is encrypted and saved, and then the first private key of the user is used to decrypt the first information when the disk data cannot be accessed. After replacing the information stored at the target location with the first information, the information stored at the target location can be made consistent with the second information, so that the disk key for decrypting the disk data can be obtained, avoiding the situation where the disk data cannot be accessed when the information stored at the target location is inconsistent with the second information. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0040] Figure 1 A flowchart of a control method for decrypting disk data provided in Embodiment 1 of the present application;

[0041] Figure 2-Figure 4 They are respectively example diagrams of obtaining the first private key in the embodiments of the present application;

[0042] Figure 5 Another flow chart of a control method for decrypting disk data provided in Embodiment 1 of the present application;

[0043] Figure 6 A schematic diagram of the structure of a control device for decrypting disk data provided in Embodiment 2 of the present application;

[0044] Figure 7 Another structural schematic diagram of a control device for decrypting disk data provided in Embodiment 2 of the present application;

[0045] Figure 8 A schematic diagram of the structure of an electronic device provided in Embodiment 3 of the present application;

[0046] Figure 9-11 They are respectively example diagrams of using a computer to decrypt a hard disk in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0048] refer to Figure 1 , is a flow chart of a control method for decrypting disk data provided in the first embodiment of the present application, which can be applied to electronic devices with disks and disk data encrypted and protected by disk keys, such as computers or servers. The technical solution in this embodiment is used to achieve secure decryption of disk data.

[0049] Specifically, the method in this embodiment may include the following steps:

[0050] Step 101: When the disk data is inaccessible, obtain the user's first private key.

[0051] Among them, the situations where disk data cannot be accessed include the following:

[0052] In one case, the recovery key that can decrypt the disk key of the disk data is lost. The disk key here is the disk master key, such as VMK (Volume MasterKey). After the disk data is encrypted with the full disk encryption key, the disk key encrypts the full disk encryption key for protection. Then, the recovery key is used to encrypt the disk key for protection. For example, a 256-bit key is calculated using the recovery key and salt (in metadata block), and then the VMK is encrypted with this key. Based on this, if the recovery key cannot be obtained from the vendor website where the recovery key is stored, then the disk key cannot be obtained, and the disk data cannot be decrypted, resulting in inaccessible disk data;

[0053] In another case, the operating environment of the electronic device changes, that is, the current operating environment of the electronic device has changed relative to the operating environment of the electronic device when the disk data can be obtained. The operating environment of the electronic device here includes the software and hardware operating environment of the electronic device. Among them, after the disk data is encrypted by the full disk encryption key, the disk key encrypts and protects the full disk encryption key, and then uses a public key to encrypt the disk key, and obtains the second information representing the operating environment of the electronic device during the encryption process and stores the second information in a specific location. Based on this, in the process of decrypting the disk data, if the information representing the current operating environment of the electronic device, that is, the information stored at the target location, is consistent with the second information, then the disk key can be obtained, and then the disk key can be used to decrypt the disk data. However, if the information stored at the target location is inconsistent with the second information, then the disk key cannot be obtained, and the disk data cannot be decrypted, resulting in the inaccessibility of the disk data.

[0054] Based on this, when the disk data cannot be accessed, the technical solution of the present application is executed to achieve secure access to the disk data. Specifically, when the disk data cannot be accessed, the first private key of the user is first obtained in this embodiment.

[0055] Among them, the user's first private key is a private key that belongs only to a legitimate user. The first private key corresponds to a first public key. The first public key is used to encrypt the first information to obtain the target information. The first information is information that represents the operating information of the electronic device when the disk data can be obtained, and the target information is information pre-stored in the electronic device.

[0056] Specifically, in this embodiment, when obtaining the first private key of the user, it can be achieved in the following ways:

[0057] In one implementation, in this embodiment, the user's first private key can be read in a target device connected to the electronic device, where the target device is a legitimate device pre-bound to the electronic device, such as a ukey device, etc. Figure 2 As shown in , the first private key of the user is securely stored in the target device. Based on this, the first private key of the user can be read in the target device in this embodiment;

[0058] It should be noted that in this embodiment, when it is monitored that the disk data is inaccessible, such as the recovery key is lost or the information stored at the target location is inconsistent with the second information, a private key acquisition instruction can be generated. The private key acquisition instruction is used to detect whether the electronic device is connected to a pre-bound target device. If a target device is connected to the electronic device, then in this embodiment, the user's first private key can be directly read from the target device.

[0059] In another implementation, in this embodiment, a private key input interface can be output on the electronic device, and the user performs input operations in the private key input interface, such as inputting a string of the first private key, etc. Based on this, after receiving the user's input operation on the private key input interface, the first private key of the user can be obtained according to the input operation. Figure 3 As shown in the figure, a private key input box is output in the private key input interface. The user can enter the first private key in the private key input box and click the "OK" control to confirm the input of the private key. Based on this, after receiving the input operation, the first private key entered by the user in the input operation is parsed to obtain the first private key.

[0060] It should be noted that, in this embodiment, when it is monitored that the disk data cannot be accessed, such as the recovery key is lost or the information stored at the target location is inconsistent with the second information, a private key acquisition instruction can be generated. The private key acquisition instruction is used to prompt the user whether to enter a private key. After the user presses a specific button on the electronic device, the present embodiment detects the user's pressing operation on the specific button and then controls the electronic device to enter a secure decryption mode, that is, the user hotkey starts a special recovery mode. In the special recovery mode, the electronic device outputs a private key input interface to prompt the user to enter a private key. After the user enters the first private key and confirms it, the present embodiment receives the input operation and parses the first private key entered by the user in the input operation, thereby achieving the acquisition of the first private key.

[0061] In another implementation, in this embodiment, the user's first private key can be read from a specific location in the hard disk of the electronic device, such as Figure 4 As shown in , the user's first private key is securely stored in the hard disk. Based on this, the user's first private key can be read from the hard disk in this embodiment;

[0062] It should be noted that in this embodiment, when it is monitored that the disk data is inaccessible, such as the recovery key is lost or the information stored at the target location is inconsistent with the second information, a private key acquisition instruction can be generated. The private key acquisition instruction is used to find and read the user's first private key at a specific location in the hard disk of the electronic device.

[0063] Specifically, the user's first private key may be a character string consisting of one or more characters.

[0064] Step 102: Use the first private key to decrypt the pre-saved target information to obtain the first information.

[0065] The target information is information obtained by encrypting the first information using the first public key corresponding to the first private key, and the first information at least represents the operating environment of the electronic device when the disk key can be obtained.

[0066] Specifically, the first information specifically represents the software and hardware operating environment of the electronic device when the disk key can be obtained.

[0067] For example, the first information is the first measurement information obtained in the process of obtaining the disk key, the first measurement information is the information obtained by performing parameter measurement on the operating environment of the electronic device, and the information obtained after the first measurement information is encrypted by the first public key is the target information.

[0068] It should be noted that the first measurement information here can be information obtained by measuring and calculating one or more software and hardware operating parameters in the software and hardware operating environment of the electronic device. Based on this, the target information can be obtained after the first measurement information is encrypted using the first public key, and then the target information is saved to a certain characteristic position. In order to distinguish, the location where the target information is saved can be recorded as the first position. In this embodiment, after saving the target information, the user can be further prompted to save the first private key, for example, prompting the user to upload the first private key to the target device connected to the electronic device, or prompting the user to record it in a special location, or prompting the user to save the first private key to the hard disk in the electronic device, so as to obtain the user's first private key when the disk data cannot be accessed.

[0069] In addition, the process of obtaining the disk key in this embodiment refers to: encrypting the disk key after encrypting the disk data to obtain the encrypted disk key. For example, in this embodiment, in the process of encrypting and saving the disk key for the first time after encrypting the disk data for the first time, the operating environment of the electronic device at this time is measured by parameters to obtain first measurement information, which can characterize the operating environment of the electronic device when the disk key is encrypted for the first time, that is, when the disk data can be accessed but has been encrypted. Based on this, the obtained first measurement information is encrypted using the first public key, and then the obtained target information is saved in the first position.

[0070] Based on this, in this embodiment, after obtaining the first private key of the user, the first private key is used to decrypt the target information stored in the first location and encrypted by the first public key, thereby obtaining the first information.

[0071] Step 103: Replace the information stored at the target location with the first information, so that the information stored at the target location is consistent with the second information.

[0072] Among them, the second information is pre-saved information, for example, the second information is information pre-saved in a specific location. For the purpose of distinction, the location where the second information is saved can be recorded as the second location, and the second information at least represents the operating environment of the electronic device when the disk key can be obtained.

[0073] Specifically, the second information specifically represents the software and hardware operating environment of the electronic device when the disk key can be obtained.

[0074] For example, the second information is second measurement information pre-stored at a second location, and the second measurement information is obtained in the process of obtaining the disk key, and the second measurement information is information obtained by performing parameter measurement on the operating environment of the electronic device.

[0075] It should be noted that the second measurement information here can be information obtained by measuring and calculating one or more software and hardware operating parameters in the software and hardware operating environment of the electronic device. In addition, the process of obtaining the disk key in this embodiment refers to: the process of encrypting the disk key after encrypting the disk data to obtain the encrypted disk key. For example, in this embodiment, in the process of encrypting and saving the disk key for the first time after encrypting the disk data for the first time, the operating environment of the electronic device at this time is measured by parameters to obtain the second measurement information. The second measurement information can characterize the operating environment of the electronic device when the disk key is encrypted for the first time, that is, when the disk data can be accessed but has been encrypted. Based on this, the obtained first measurement information is saved in the second location.

[0076] Based on this, after replacing the information stored at the target location with the first information, the information stored at the target location is information that characterizes the operating environment of the electronic device when the disk key can be obtained, and the second information is also information about the operating environment of the electronic device when the disk key can be obtained. Therefore, the information stored at the target location is consistent with the second information, and the disk key can be obtained when the information stored at the target location is consistent with the second information. That is to say, when the information stored at the target location is consistent with the second information, the disk data can be decrypted in the manner of obtaining the disk key by comparing the measurement information in the previous text, that is, when the information stored at the target location is consistent with the second information, the disk key is allowed to be obtained, and after obtaining the disk key, the disk data can be decrypted so that the disk data can be accessed.

[0077] As can be seen from the above scheme, a control method for decrypting disk data in the first embodiment of the present application obtains the user's first private key when the disk data cannot be accessed, and then the first private key can be used to decrypt the pre-saved target information to obtain the first information, and the first information here represents the operating environment of the electronic device when the disk key can be obtained, thereby replacing the first information stored at the target location with the information stored at the target location so that the information stored at the target location is consistent with the second information, and the second information here is the pre-saved information representing the operating environment of the electronic device when the disk key can be obtained, and the disk key of the disk data can be obtained when the information stored at the target location is consistent with the second information, based on this, the disk data is decrypted using the obtained disk key so that the disk data can be accessed. It can be seen that in this embodiment, the first information corresponding to the operating environment of the electronic device when the disk key can be obtained is encrypted and saved, and then the first private key of the user is used to decrypt the first information when the disk data cannot be accessed, so that after replacing the information stored at the target location with the first information, the information stored at the target location is consistent with the second information, so that the disk key for decrypting the disk data can be obtained, avoiding the situation where the disk data cannot be accessed when the information stored at the target location is inconsistent with the second information.

[0078] In a specific implementation, the target location is a register in an electronic device, such as a register PCR (Platform Configuration Register), etc., and a specific location in the PCR is used to write measurement information obtained by performing parameter measurement on the operating environment of the electronic device.

[0079] Based on this, in this embodiment, when the first information replaces the information stored in the target position in step 103, the first information is specifically written into the register so that the information stored in the register can be consistent with the second information.

[0080] Based on the above implementation, before writing the first information into the register in step 103, in this embodiment, the register may be kept empty, and measurement information other than the first information is not allowed to be written.

[0081] For example, when the disk data is inaccessible, in the process of obtaining the user's first private key, such as when the user starts the electronic device to enter a special recovery mode by hotkey, the electronic device will also re-measure the parameters of its own operating environment to obtain measurement information. At this time, these measurement information are not written to the specific position of the PCR, and the specific position of the PCR is kept empty. For example, after the measurement of the secure boot state is completed, it is not extended to the flag position 7 of the PCR, so that the first information is written to the flag position 7 of the PCR in step 103, so that the information on the flag position 7 of the PCR can be consistent with the second information at the second position, so that the disk key can be obtained, and the disk data can be decrypted.

[0082] In one implementation, obtaining the disk key in this embodiment can be specifically implemented in the following manner:

[0083] First, read the second private key stored in the electronic device. For example, in this embodiment, the second private key can be read at the third position of the electronic device, and the third position here is to distinguish from the first position and the second position in the above text. It should be noted that the second private key corresponds to the second public key, and this second public key is the public key used when the disk key is encrypted.

[0084] Based on this, in this embodiment, the second private key is used to decrypt the disk key encrypted by the second public key corresponding to the second private key to obtain the decrypted disk key.

[0085] For example, in this embodiment, the second private key is used to adopt a decryption algorithm corresponding to the second public key to decrypt the disk key to obtain a decrypted disk key.

[0086] After the disk key is decrypted, the process of using the disk key to decrypt the disk data can be as follows:

[0087] First, the encrypted full disk encryption key is decrypted using the disk key to obtain a decrypted full disk encryption key.

[0088] For example, VMK is used to decrypt the full volume encryption key FVEK (Full Volume Encryption Key), which is the key involved in encrypting disk data.

[0089] Based on this, after the full disk encryption key is decrypted, the encrypted disk data is decrypted using the decrypted full disk encryption key to obtain the decrypted disk data.

[0090] For example, the disk data is decrypted using the FVEK and a corresponding decryption algorithm such as the Advanced Encryption Standard (AES), thereby obtaining accessible disk data.

[0091] In a specific implementation, the process of decrypting the disk key and decrypting the disk data in this embodiment can be implemented by a bitlocker driver.

[0092] In one implementation, in order to further ensure security, in this embodiment, before using the first private key in step 102 to decrypt the pre-stored target information to obtain the first information, the following steps may also be performed, such as Figure 5 As shown in:

[0093] Step 104: Verify the first private key to obtain a verification result.

[0094] The verification result of the first private key indicates whether the first private key matches the first public key stored in the electronic device.

[0095] Specifically, in this embodiment, the first private key and the first public key are compared or verified to obtain a verification result of whether the first private key matches the first public key.

[0096] Based on this, when the verification result indicates that the first private key matches the first public key stored in the electronic device, step 102 is executed to use the first private key to decrypt the pre-saved target information to obtain the first information, and when at least the verification result indicates that the first private key does not match the first public key stored in the electronic device, the current process is terminated.

[0097] That is to say, in this embodiment, when the first private key does not match the first public key, that is, the first private key is wrong, the decryption process of the disk key and the decryption process of the disk data are no longer executed to ensure the security of the disk data.

[0098] Furthermore, in order to ensure reliability, in this embodiment, the current process can be terminated when the verification result indicates that the first private key does not match the first public key stored in the electronic device and there are more than a threshold number of consecutive mismatching verification results.

[0099] That is to say, this embodiment can attempt to decrypt the disk key and the disk data a threshold number of times. However, if the accurate first private key cannot be obtained after trying the threshold number of times, the decryption process of the disk key and the decryption process of the disk data will no longer be executed to ensure the security of the disk data.

[0100] refer to Figure 6 , is a schematic diagram of the structure of a control device for decrypting disk data provided in the second embodiment of the present application, which can be configured in an electronic device having a disk and the disk data is encrypted and protected by a disk key, such as a computer or a server. The technical solution in this embodiment is used to achieve secure decryption of disk data.

[0101] Specifically, the device in this embodiment may include the following units:

[0102] A private key obtaining unit 601 is used to obtain a first private key of a user when the disk data cannot be accessed;

[0103] The information decryption unit 602 is used to use the first private key to decrypt the pre-stored target information to obtain first information; wherein the target information is information obtained by encrypting the first information using the first public key corresponding to the first private key, and the first information at least represents the operating environment of the electronic device when the disk key can be obtained;

[0104] An information replacement unit 603 is used to replace the information stored at the target location with the first information so that the information stored at the target location is consistent with second information, where the second information is pre-saved information and the second information at least represents an operating environment of the electronic device when the disk key can be obtained;

[0105] The key obtaining unit 604 is used to obtain the disk key when the information stored at the target location is consistent with the second information, and the disk key is used to decrypt the disk data so that the disk data can be accessed.

[0106] It can be seen from the above technical scheme that a control device for decrypting disk data provided in Example 2 of the present application can obtain a user's first private key when the disk data is inaccessible, and then use the first private key to decrypt pre-saved target information to obtain first information. The first information here represents the operating environment of the electronic device when the disk key can be obtained. Thus, the first information replaces the information stored at the target location so that the information stored at the target location is consistent with the second information. The second information here is pre-saved information representing the operating environment of the electronic device when the disk key can be obtained. When the information stored at the target location is consistent with the second information, the disk key of the disk data can be obtained. Based on this, the disk data is decrypted using the obtained disk key so that the disk data can be accessed. It can be seen that in the present application, the first information corresponding to the operating environment of the electronic device when the disk key can be obtained is encrypted and saved, and then the first private key of the user is used to decrypt the first information when the disk data cannot be accessed. After replacing the information stored at the target location with the first information, the information stored at the target location can be made consistent with the second information, so that the disk key for decrypting the disk data can be obtained, avoiding the situation where the disk data cannot be accessed when the information stored at the target location is inconsistent with the second information.

[0107] In one implementation, the target location is a register in the electronic device;

[0108] The information replacement unit 603 is specifically used to write the first information into the register so that the information stored in the register can be consistent with the second information.

[0109] In one implementation, the device further comprises the following units: Figure 7 As shown in:

[0110] The register control unit 605 is used to keep the register empty before the information replacement unit 603 writes the first information into the register.

[0111] In one implementation, the first information is first measurement information obtained in the process of obtaining the disk key, and the first measurement information is information obtained by performing parameter measurement on the operating environment of the electronic device, and the measurement information is encrypted by the first public key to obtain the target information;

[0112] The second information is pre-saved second measurement information, the second measurement information is obtained in the process of obtaining the disk key, and the second measurement information is information obtained by performing parameter measurement on the operating environment of the electronic device.

[0113] In one implementation, when the key obtaining unit 604 obtains the disk key, it is specifically used to: read the second private key stored in the electronic device; use the second private key to decrypt the disk key encrypted by the second public key corresponding to the second private key to obtain the decrypted disk key.

[0114] Furthermore, the key obtaining unit 604 is also used to decrypt the disk data, specifically to: use the disk key to decrypt the encrypted full-disk encryption key to obtain a decrypted full-disk encryption key; use the decrypted full-disk encryption key to decrypt the encrypted disk data to obtain decrypted disk data.

[0115] In one implementation, before using the first private key to decrypt the pre-stored target information to obtain the first information, the private key obtaining unit 601 is further configured to:

[0116] The first private key is verified to obtain a verification result; the verification result indicates whether the first private key matches the first public key stored in the electronic device; if the verification result indicates that the first private key matches the first public key stored in the electronic device, the steps are performed: using the first private key, the pre-saved target information is decrypted to obtain the first information; if at least the verification result indicates that the first private key does not match the first public key stored in the electronic device, the current process is terminated.

[0117] In one implementation, the private key obtaining unit 601 is specifically configured to read the first private key of the user in a target device connected to the electronic device.

[0118] In one implementation, the private key obtaining unit 601 is specifically used to: output a private key input interface on the electronic device, and after receiving an input operation of the user on the private key input interface, obtain the user's first private key according to the input operation.

[0119] It should be noted that the specific implementation of each unit in this embodiment can refer to the corresponding content in the previous text and will not be described in detail here.

[0120] refer to Figure 8 , is a schematic diagram of the structure of an electronic device provided in Embodiment 3 of the present application, the electronic device may be an electronic device having a disk and the disk data is encrypted and protected by a disk key, such as a computer or a server, etc. The technical solution in this embodiment is used to achieve secure decryption of disk data.

[0121] Specifically, the electronic device in this embodiment may include the following structure:

[0122] Disk 801, used for storing disk data;

[0123] BIOS802 is used to obtain a first private key of a user when the disk data cannot be accessed; use the first private key to decrypt pre-saved target information to obtain first information; wherein the target information is information obtained by encrypting the first information using a first public key corresponding to the first private key, and the first information at least represents an operating environment of the electronic device when the disk key can be obtained; replace the information stored at the target location with the first information so that the information stored at the target location is consistent with second information, the second information is pre-saved information, and the second information at least represents an operating environment of the electronic device when the disk key can be obtained;

[0124] Wherein, when the information stored at the target location is consistent with the second information, the disk key can be obtained, and the disk key is used to decrypt the disk data so that the disk data can be accessed.

[0125] From the above technical scheme, it can be seen that the electronic device provided in the third embodiment of the present application obtains the first private key of the user when the disk data cannot be accessed, and then the first private key can be used to decrypt the pre-stored target information to obtain the first information, and the first information here represents the operating environment of the electronic device when the disk key can be obtained, thereby replacing the first information stored at the target location with the information stored at the target location so that the information stored at the target location is consistent with the second information, and the second information here is the pre-stored information representing the operating environment of the electronic device when the disk key can be obtained, and the disk key of the disk data can be obtained when the information stored at the target location is consistent with the second information, based on this, the disk data is decrypted using the obtained disk key so that the disk data can be accessed. It can be seen that in the present application, the first information corresponding to the operating environment of the electronic device when the disk key can be obtained is encrypted and saved, and then the first private key of the user is used to decrypt the first information when the disk data cannot be accessed, so that after replacing the information stored at the target location with the first information, the information stored at the target location is consistent with the second information, so that the disk key for decrypting the disk data can be obtained, avoiding the situation where the disk data cannot be accessed when the information stored at the target location is inconsistent with the second information.

[0126] Taking a personal computer as an example of an electronic device, the inventor of the present application discovered in the process of using a personal computer that commonly used computers usually meet the device encryption conditions configured by the operating system supplier when shipped. After the user uses the account on the operating system, the operating system OS (operation system) will automatically activate Bitlocker for full disk encryption and save the recovery key to the website of the operating system supplier.

[0127] However, due to various reasons, such as the website for recovering the key being inaccessible across countries, or the recovery key not being found on the supplier's website, etc., users are often unable to retrieve the recovery key, which can cause the loss of disk data stored on the disk, causing adverse effects on users and companies.

[0128] In view of the above problems, the inventor of the present application has proposed a technical solution for Bitlocker to securely unlock the disk after further research, which includes the following key contents:

[0129] First, when Bitlocker is activated, the Basic Input Output System (BIOS) generates an asymmetric key (or symmetric key) and guides the user to save the private key (or password);

[0130] Secondly, the BIOS encrypts the PCR (Platform Configuration Register) value of the microcontroller TPM (Trusted Platfrom Module) generated by normal boot measurement (i.e., the first information in the above text) with an asymmetric key and backs it up;

[0131] Based on the above implementation, when the user cannot retrieve the Bitlocker recovery key, they can boot into a special recovery mode, use the private key (or password) saved by the verified user to decrypt the saved TPM PCR (i.e. the target information mentioned above), and use it to replace the real-time measurement information. At this time, the TPM can normally decrypt the Bitlocker VMK, i.e. the disk key, and thus unlock the Bitlocker disk data.

[0132] Therefore, after adopting the technical solution proposed in this application, a safe unlocking method can still be provided when the Bitlocker recovery key is lost.

[0133] First, combine Fig. 9 The central processing unit (CPU), BIOS, OS boot manager, PCR and OS boot loader shown in the figure illustrate the process of Bitlocker encryption and Bitlocker unlocking:

[0134] 1. Bitlocker uses AES to encrypt the hard disk. The encryption key used is: Full Volume Encryption Key (FVEK);

[0135] 2. Encrypt and protect FVEK through disk key VMK (Volume Master Key);

[0136] 3. Protect VMK through key protector. There are two types of key protectors used to protect VMK in this application: TPM and recovery key (Numerical Password), as follows:

[0137] TPM: TPM uses the SRK public key to encrypt VMK. During the encryption operation, the measured platform measurement value is written to the storage locations of flag bit 7 and flag bit 11 of PCR. The platform measurement value can be obtained through hash calculation.

[0138] Recovery key: A 256-bit AES-CCMkey is calculated from the recovery key and salt (in metadata block) to encrypt the VMK, and the encrypted VMK is saved as another backup;

[0139] After the CPU is securely booted, the BIOS writes the current platform measurement value into the PCR. When the current platform measurement PCR result is consistent with the PCR result when the VMK is sealed, the OS boot manager calls the TPM, turns it on and uses the SRK private key to decrypt the VMK; then uses the VMK to decrypt the FVEK; finally, uses the FVEK to decrypt the hard disk, thereby being able to access the data in the hard disk.

[0140] However, if the PCR result measured by the current platform is inconsistent with the PCR result when sealing the VMK, that is, the measurement information has changed, such as the TPM is reset or the firmware is updated, and the VMK cannot be opened and decrypted at this time, then the operating system enters the BitLocker recovery mode recovery mode, and the user is required to enter the recovery key to decrypt the VMK.

[0141] However, if the user forgets the recovery key or cannot read the recovery key on the website, the VMK cannot be successfully decrypted, and the FVEK cannot be decrypted, and the hard disk cannot be decrypted, and the hard disk data cannot be accessed.

[0142] Based on this, in the technical solution proposed in this application, when both the TPM and the recovery key keyprotectors fail and the hard disk cannot be unlocked, a special recovery mode is created to deal with this situation, as follows:

[0143] First, the establishment phase, such as Fig.10 As shown in:

[0144] 1. When automatic device decryption activation is detected, the BIOS generates public and private keys through the encryption engine.

[0145] 2. Guide the user to save the private key. There are many ways to do this, such as uploading it to a certain location, storing it to an external device such as a Universal Serial Bus (USB) device, outputting it on the screen to prompt the user to record it, etc.

[0146] 3. The public key encrypts the PCR and saves it, just like the target information saved in the previous article.

[0147] Secondly, the startup phase, such as Fig.11 As shown in:

[0148] 1. When both the TPM and the recovery key keyprotectors are invalid, the user can trigger the operating system to enter a special recovery mode by using a hotkey. In this mode, after the secure boot state is measured, it is not extended to TPMPCR 7, that is, the current measured information is not written to PCR 7 to keep PCR 7 empty.

[0149] 2. BIOS prompts the user to provide a private key. After the user provides the private key, the private key is verified.

[0150] 3. After the BIOS obtains the correct private key, it decrypts the saved PCR and rewrites the decrypted PCR into TPM PCR 7.

[0151] 4. Boot OS BootManager to execute. Since the value of TPM PCR 7 is consistent with the value of PCR 7 when VMK was sealed, VMK will be successfully unsealed and FVEK will be decrypted later, thus successfully retrieving user data.

[0152] Finally, the removal mechanism:

[0153] In this application, an appropriate deletion mechanism is established to prevent abuse or attack. For example, when Bitlocker cannot decrypt and the private key input is incorrect for more than a certain number of times, the current processing flow is stopped and the hard disk is no longer allowed to be decrypted.

[0154] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0155] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0156] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0157] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A control method for decrypting disk data, comprising: In the case where the disk data is inaccessible, obtaining a first private key of the user; Using the first private key, decrypting the pre-saved target information to obtain first information; wherein the target information is information obtained by encrypting the first information using the first public key corresponding to the first private key, and the first information at least represents the operating environment of the electronic device when the disk key can be obtained; Replacing the information stored at the target location with the first information so that the information stored at the target location is consistent with second information, where the second information is pre-saved information and the second information at least represents an operating environment of the electronic device when the disk key can be obtained; Wherein, when the information stored at the target location is consistent with the second information, the disk key can be obtained, and the disk key is used to decrypt the disk data so that the disk data can be accessed; Wherein, obtaining the disk key includes: Reading a second private key stored in the electronic device; The disk key encrypted by the second public key corresponding to the second private key is decrypted using the second private key to obtain a decrypted disk key.

2. The method according to claim 1, wherein the target location is a register in the electronic device; in, The replacing the information stored at the target location with the first information includes: The first information is written into the register so that the information stored in the register is consistent with the second information.

3. The method according to claim 2, before writing the first information into the register, the method further comprises: Keep the register empty.

4. The method according to claim 1 or 2, wherein: The first information is first measurement information obtained in the process of obtaining the disk key, and the first measurement information is information obtained by performing parameter measurement on the operating environment of the electronic device, and the first measurement information is encrypted by the first public key to obtain the target information; The second information is pre-saved second measurement information, the second measurement information is obtained in the process of obtaining the disk key, and the second measurement information is information obtained by performing parameter measurement on the operating environment of the electronic device.

5. The method according to claim 1, decrypting the disk data, comprising: Decrypting the encrypted full disk encryption key using the disk key to obtain a decrypted full disk encryption key; The encrypted disk data is decrypted using the decrypted full disk encryption key to obtain the decrypted disk data.

6. The method according to claim 1, before using the first private key to decrypt the pre-stored target information to obtain the first information, the method further comprises: Verifying the first private key to obtain a verification result; The verification result indicates whether the first private key matches the first public key stored in the electronic device; In the case where the verification result indicates that the first private key matches the first public key stored in the electronic device, the steps of: using the first private key to decrypt the pre-stored target information to obtain the first information; When at least the verification result indicates that the first private key does not match the first public key stored in the electronic device, the current process is terminated.

7. The method according to claim 1, obtaining the first private key of the user, comprising: A first private key of a user is read in a target device connected to the electronic device.

8. The method according to claim 1, obtaining the first private key of the user, comprising: A private key input interface is output on the electronic device, and after receiving an input operation of the user on the private key input interface, a first private key of the user is obtained according to the input operation.

9. A control device for decrypting disk data, comprising: A private key obtaining unit, used for obtaining a first private key of a user when the disk data cannot be accessed; an information decryption unit, configured to use the first private key to decrypt the pre-stored target information to obtain first information; wherein the target information is information obtained by encrypting the first information using the first public key corresponding to the first private key, and the first information at least represents an operating environment of the electronic device when the disk key can be obtained; an information replacement unit, configured to replace the information stored at the target location with the first information, so that the information stored at the target location is consistent with second information, wherein the second information is pre-saved information and the second information at least represents an operating environment of the electronic device when the disk key can be obtained; Wherein, when the information stored at the target location is consistent with the second information, the disk key can be obtained, and the disk key is used to decrypt the disk data so that the disk data can be accessed; Wherein, obtaining the disk key includes: Reading a second private key stored in the electronic device; The disk key encrypted by the second public key corresponding to the second private key is decrypted using the second private key to obtain a decrypted disk key.

Images