Key protection method for encrypted hard disk, use method, and key management system

Abstract

The application provides a key protection method of an encrypted hard disk, a use method and a key management system, and belongs to the field of computer security.The key protection method of the encrypted hard disk comprises the following steps: generating a key encryption key through a user USBKey generation factor;encrypting a data encryption key of the encrypted hard disk through the key encryption key, and storing the corresponding ciphertext in the encrypted hard disk; and encrypting the user USBKey generation factor, and storing the corresponding ciphertext in the user USBKey.The application can realize that even if the ciphertext is cracked, only the USBKey generation factor UKGF can be obtained, and the related keys cannot be directly obtained, and the security is higher through the mode that the data encryption key DEK or the key encryption key KEK is not directly stored, and the encrypted USBKey generation factor UKGF is stored.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security, and in particular to a key protection method, a decryption method, and a key management system for an encrypted hard disk. Background Art

[0002] With the development of information technology, the security of data storage has become an important issue that cannot be ignored in the field of information security. Hard disks are currently the main way to store information. If they are stolen or illegally accessed, the stored data will be leaked. Using encrypted hard disks as storage media can better provide security protection for stored data and reduce the possibility of information loss due to loss or theft of storage devices. Encrypted hard disks encrypt data before storing it on the hard disk. The encryption and decryption of data are completely transparent and invisible to the outside world.

[0003] For encrypted hard drives, the security of the hard drive encryption key is fundamental to the overall security of the hard drive data. Current encrypted hard drives typically store the encryption key on the hard drive itself, or load it into computer memory during execution. Attackers can obtain the encryption and decryption keys by directly reading the hard drive or performing a cold boot attack on the memory, posing a risk of data leakage. Using a USB key as a carrier for the hard drive encryption key can better address this issue, physically isolating the encryption and decryption keys from the hard drive and ensuring key security. However, if the USB key is lost, the data on the drive cannot be decrypted, resulting in serious data loss. Therefore, protecting the encryption key is a key component of encrypted hard drive security.

[0004] When a USB key storing a hard drive encryption key is lost, existing key recovery technology often requires the involvement of a key management center, which uses a backup key to restore the original data. However, the involvement of a third party increases management and usage costs. Applications for key recovery often require submitting to the supervisor's superior, or even to a higher level of superiors, making them inflexible and inconvenient. Furthermore, if an attacker cracks the USB key and obtains the key, the data on the encrypted hard drive remains at risk of being leaked. Summary of the Invention

[0005] An object of an embodiment of the present invention is to provide a key protection method for an encrypted hard disk, which can improve the security of the encrypted hard disk.

[0006] In order to achieve the above-mentioned purpose, an embodiment of the present invention provides a key protection method for an encrypted hard disk, which includes: generating a key encryption key through a user USBKey generation factor; encrypting the data encryption key of the encrypted hard disk through the key encryption key, and storing the corresponding ciphertext in the encrypted hard disk; and encrypting the user USBKey generation factor, and storing the corresponding ciphertext in the user USBKey.

[0007] Optionally, the key protection method of the encrypted hard disk also includes: generating an administrator recovery key through the administrator USBKey generation factor; encrypting the user USBKey generation factor through the administrator recovery key, and storing the corresponding backup ciphertext in the key backup area of ​​the encrypted hard disk; and storing the administrator USBKey generation factor in the administrator USBKey.

[0008] An embodiment of the present invention also provides a method for using an encrypted hard disk, and the decryption method of the encrypted hard disk includes: the encrypted hard disk obtains the ciphertext corresponding to the encrypted user USBKey generation factor, and decrypts it to obtain the user USBKey generation factor; generates a key encryption key through the user USBKey generation factor; and decrypts the ciphertext corresponding to the encrypted data encryption key through the key encryption key to obtain a temporary data encryption key to decrypt the data of the encrypted hard disk.

[0009] Optionally, before the encrypted hard disk obtains the ciphertext corresponding to the encrypted user USBKey generation factor, the method for using the encrypted hard disk further includes: the encrypted hard disk and the user USBKey perform two-way authentication.

[0010] Optionally, after obtaining the temporary data encryption key, the method for using the encrypted hard disk further includes: storing the temporary data encryption key in an unreadable register of the encrypted hard disk, which is lost upon power failure.

[0011] Optionally, the encrypted hard disk decryption method further includes: after the encrypted hard disk decryption is completed, clearing the key encryption key.

[0012] Optionally, the method for using the encrypted hard disk also includes: the encrypted hard disk obtains an administrator USBKey generation factor; generates an administrator recovery key through the administrator USBKey generation factor; decrypts the backup ciphertext corresponding to the encrypted user USBKey generation factor through the administrator recovery key to obtain the backed-up user USBKey generation factor; generates the key encryption key through the backed-up user USBKey generation factor; decrypts the ciphertext corresponding to the encrypted data encryption key through the key encryption key to obtain a temporary data encryption key to decrypt the data of the encrypted hard disk.

[0013] An embodiment of the present invention further provides a key management system comprising: an encrypted hard disk and a user USBKey. The encrypted hard disk is configured to: generate a key encryption key using a user USBKey generation factor; encrypt the encrypted hard disk's data encryption key using the key encryption key and store the corresponding ciphertext; and encrypt the user USBKey generation factor. The user USBKey is configured to store the ciphertext corresponding to the encrypted user USBKey generation factor.

[0014] Optionally, the encrypted hard disk is also used to: obtain the ciphertext corresponding to the encrypted user USBKey generation factor, and decrypt it to obtain the user USBKey generation factor; generate a key encryption key through the user USBKey generation factor; decrypt the ciphertext corresponding to the encrypted data encryption key through the key encryption key to obtain a temporary data encryption key to decrypt the data on the encrypted hard disk.

[0015] Optionally, before obtaining the ciphertext corresponding to the encrypted user USBKey generation factor, the encrypted hard disk is further used to: perform two-way authentication with the user USBKey.

[0016] Optionally, the key management system further includes an administrator USBKey for storing an administrator USBKey generation factor. The encrypted hard disk is further configured to generate an administrator recovery key using the administrator USBKey generation factor; encrypt the user USBKey generation factor using the administrator recovery key, and store the corresponding backup ciphertext in the key backup area of ​​the encrypted hard disk.

[0017] Optionally, the encrypted hard disk is also used to: obtain the administrator USBKey generation factor; generate an administrator recovery key through the administrator USBKey generation factor; decrypt the backup ciphertext corresponding to the encrypted user USBKey generation factor through the administrator recovery key to obtain the backed up user USBKey generation factor; generate the key encryption key through the backed up user USBKey generation factor; decrypt the ciphertext corresponding to the encrypted data encryption key through the key encryption key to obtain a temporary data encryption key to decrypt the data of the encrypted hard disk.

[0018] Through the above technical solution, the embodiment of the present invention does not directly store the data encryption key DEK or the key encryption key KEK, but stores the encrypted USBKey generation factor UKGF. Even if the ciphertext is cracked, only the USBKey generation factor UKGF will be obtained, and the relevant key cannot be directly obtained, which has higher security.

[0019] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following detailed description, they are used to explain the embodiments of the present invention, but do not constitute a limitation of the embodiments of the present invention. In the accompanying drawings:

[0021] Figure 1 1 is a flow chart of a key protection method for an encrypted hard disk provided by an embodiment of the present invention;

[0022] Figure 2 1 is a flow chart of a key protection method for an encrypted hard disk according to an embodiment of the present invention;

[0023] Figure 3 is a flowchart of a method for using an encrypted hard disk provided by an embodiment of the present invention;

[0024] Figure 4 This is a flowchart of a preferred method for using an encrypted hard disk according to an embodiment of the present invention;

[0025] Figure 5 It is a key management system provided by an embodiment of the present invention;

[0026] Figure 6 This is a schematic diagram of an example structure of a key management system provided by an embodiment of the present invention.

[0027] Description of Reference Numerals

[0028] 10 encrypted hard disks 20 user USBKeys

[0029] 30Admin USBKey DETAILED DESCRIPTION

[0030] The following describes the specific implementation of the embodiment of the present invention in detail with reference to the accompanying drawings. It should be understood that the specific implementation described herein is only used to illustrate and explain the embodiment of the present invention and is not used to limit the embodiment of the present invention.

[0031] Before describing the embodiments of the present invention in detail, the abbreviations used are defined first.

[0032] Among them, the user USBKey generation factor is represented by UKGF; the key encryption key is represented by KEK; the data encryption key is represented by DEK; the administrator USBKey generation factor is represented by AKGF; the administrator recovery key is represented by ARK; Enc ARK (UKGF) indicates that UKGF is encrypted by ARK.

[0033] Figure 1 This is a flowchart of a key protection method for an encrypted hard disk provided by an embodiment of the present invention. Please refer to Figure 1 The key protection method for an encrypted hard disk may include the following steps:

[0034] Step S110: Generate a key encryption key KEK through the user USBKey generation factor UKGF.

[0035] The encrypted hard disk can be a data hard disk configured in a computer or other device, or a storage device such as a mobile hard disk.

[0036] The user USBKey generation factor UKGF may be a parameter, variable, etc. for determining the key encryption key KEK, and different KEKs may be determined by controlling the values ​​of the parameters and variables.

[0037] Step S120: Encrypt the data encryption key DEK of the encrypted hard disk by using the key encryption key KEK, and store the corresponding DEK ciphertext in the encrypted hard disk.

[0038] The data encryption key DEK is used to encrypt data on the encrypted hard disk.

[0039] After encrypting the data on the encryption hard disk, the embodiment of the present invention does not directly store the DEK on the encryption hard disk. Instead, the DEK is encrypted by the KEK and then the corresponding DEK ciphertext is stored on the encryption hard disk.

[0040] Step S130: Encrypt the user USBKey generation factor UKGF and store the corresponding UKGF ciphertext into the user USBKey.

[0041] Among them, the user USBKey can be a U disk key, a smart password key, etc.

[0042] Figure 2 This is a flowchart of a key protection method for an encrypted hard disk according to an embodiment of the present invention. Figure 2 , the key protection method for an encrypted hard disk may further include the following steps:

[0043] Step S210: Generate an administrator recovery key ARK through the administrator USBKey generation factor AKGF.

[0044] The administrator USBKey can be the administrator's smart password key, which is used to back up the key data related to the encrypted hard disk to prevent the user's USBKey from being lost.

[0045] ARK is generated through AKGF. Similar to UKGF, AKGF can be used to determine the parameters and variables of ARK, and different ARKs can be determined by controlling the values ​​of parameters and variables.

[0046] Step S220: Encrypt the user USBKey generation factor UKGF through the administrator recovery key ARK, and ARK The (UKGF) backup ciphertext is stored in the key backup area of ​​the encrypted hard disk.

[0047] Encrypt UKGF through ARK and convert the corresponding Enc ARK The (UKGF) ciphertext is stored in the key backup area of ​​the encrypted hard disk. This step is similar to step S210 and will not be repeated here.

[0048] Step S230: storing the administrator USBKey generation factor AKGF into the administrator USBKey.

[0049] Save AKGF to the administrator's USBKey to prevent the user's USBKey from being lost.

[0050] Figure 3 This is a flowchart of the method for using the encrypted hard disk provided by the embodiment of the present invention. Please refer to Figure 3 The method for using the encrypted hard disk may include the following steps:

[0051] Step S310: The encrypted hard disk obtains the UKGF ciphertext corresponding to the encrypted user USBKey generation factor UKGF, and decrypts it to obtain the user USBKey generation factor UKGF.

[0052] Preferably, before step S310, the method for using the encrypted hard disk further includes: performing bidirectional authentication between the encrypted hard disk and the user USBKey.

[0053] When the two-way identity authentication is passed, the encrypted hard disk obtains the UKGF ciphertext sent by the user's USBKey and obtains the UKGF after decryption.

[0054] Step S320: Generate a key encryption key KEK through the user USBKey generation factor UKGF.

[0055] This step is similar to the process of step S110. Taking UKGF as an example of a parameter for determining KEK, the KEK can be determined by the value of this parameter.

[0056] Step S330: decrypting the DEK ciphertext corresponding to the encrypted data encryption key DEK using the key encryption key KEK to obtain a temporary data encryption key DEK to decrypt the data on the encrypted hard disk.

[0057] For example, the DEK ciphertext is decrypted by the generated KEK to obtain a temporary DEK, and the data on the encrypted hard disk is decrypted by the temporary DEK to obtain the data on the encrypted hard disk.

[0058] Preferably, after obtaining the temporary data encryption key DEK, the method for using the encrypted hard disk further includes: storing the temporary data encryption key DEK in an unreadable register of the encrypted hard disk, which is lost upon power failure.

[0059] For example, when an encrypted hard drive is connected to a computer device and is being decrypted, if the computer device loses power, the temporary DEK will be lost, the encrypted hard drive will remain encrypted, and the data will be unreadable.

[0060] Preferably, the method for using the encrypted hard disk further includes: clearing the key encryption key KEK after decryption of the encrypted hard disk is completed.

[0061] For example, the KEK can be regarded as an intermediate parameter in the decryption process of the encrypted hard disk. Therefore, after the encrypted hard disk is decrypted, the KEK is cleared.

[0062] Figure 4 This is a flowchart of a preferred method of using an encrypted hard disk according to an embodiment of the present invention. Figure 4 The method for using the encrypted hard disk may further include the following steps:

[0063] Step S410: The encrypted hard disk obtains the administrator USBKey generation factor AKGF.

[0064] For example, when the user USBKey is unavailable, for example, the user USBKey is lost or damaged, resulting in the hard disk data being unavailable, the encrypted hard disk obtains the AKGF sent by the administrator USBKey.

[0065] Step S420: Generate an administrator recovery key ARK through the administrator USBKey generation factor AKGF.

[0066] ARK is generated by AKGF. The generation process is similar to step S210 and will not be repeated here.

[0067] Step S430: The administrator recovers the key ARK and generates the Enc corresponding to the encrypted user USBKey generation factor UKGF. ARK (UKGF) Decrypt the backup ciphertext to obtain the backed-up user USBKey generation factor UKGF.

[0068] Through ARK to Enc ARK (UKGF) ciphertext can be decrypted to obtain the backup UKGF.

[0069] Step S440: Generate the key encryption key KEK through the backed-up user USBKey generation factor UKGF.

[0070] The KEK is generated by using the backed-up UKGF. This process is similar to step S320 and will not be repeated here.

[0071] Step S450: decrypting the DEK ciphertext corresponding to the encrypted data encryption key DEK using the key encryption key KEK to obtain a temporary data encryption key DEK to decrypt the data on the encrypted hard disk.

[0072] The DEK ciphertext is decrypted by the KEK to obtain a temporary DEK, and the data on the encrypted hard disk is decrypted by the temporary DEK to obtain the data on the encrypted hard disk.

[0073] Figure 5 This is a key management system provided by an embodiment of the present invention. Figure 6 yes Figure 5 For a sample structural diagram, please refer to Figure 5 and Figure 6The key management system may include an encrypted hard disk 10 and a user USBKey 20. The encrypted hard disk 10 is configured to: generate a key encryption key KEK using a user USBKey generation factor UKGF; encrypt the encrypted hard disk's data encryption key DEK using the key encryption key KEK and store the corresponding DEK ciphertext; and encrypt the user USBKey generation factor UKGF. The user USBKey 20 is configured to store the UKGF ciphertext corresponding to the encrypted user USBKey generation factor UKGF.

[0074] The encrypted hard disk 10 can be a data hard disk configured in a computer or other device, or a storage device such as a mobile hard disk. The user USBKey 20 can be a USB flash drive key, a smart password key, etc. The detailed implementation process of the encrypted hard disk 10 and the user USBKey 20 is described in steps S110-S130 and will not be repeated here.

[0075] Preferably, the encrypted hard disk 10 is further configured to: obtain the UKGF ciphertext corresponding to the encrypted user USBKey generation factor UKGF, decrypt it to obtain the user USBKey generation factor UKGF; generate a key encryption key KEK using the user USBKey generation factor UKGF; and decrypt the DEK ciphertext corresponding to the encrypted data encryption key DEK using the key encryption key KEK to obtain a temporary data encryption key DEK, thereby decrypting the data on the encrypted hard disk. For details, please refer to steps S310-S330, which will not be repeated here.

[0076] Preferably, before obtaining the UKGF ciphertext corresponding to the encrypted user USBKey generation factor UKGF, the encrypted hard disk 10 is further used to perform two-way authentication with the user USBKey 20.

[0077] Preferably, the key management system further includes: an administrator USBKey 30, which is used to store the administrator USBKey generation factor AKGF. The encrypted hard disk 10 is also used to: generate an administrator recovery key ARK through the administrator USBKey generation factor AKGF; encrypt the user USBKey generation factor UKGF through the administrator recovery key ARK, and convert the corresponding Enc ARK The (UKGF) backup ciphertext is stored in the key backup area of ​​the encrypted hard disk 10. The administrator USBKey can help users restore hard disk data. For details, please refer to steps S210-S230, which will not be repeated here.

[0078] Further preferably, the encrypted hard disk 10 is further used to: obtain the administrator USBKey generation factor AKGF; generate the administrator recovery key ARK through the administrator USBKey generation factor AKGF; and recover the encrypted user USBKey generation factor UKGF corresponding to the Enc ARK The backup ciphertext (UKGF) is decrypted to obtain the backup user USBKey generation factor UKGF; the key encryption key KEK is generated using the backup user USBKey generation factor UKGF; the DEK ciphertext corresponding to the encrypted data encryption key DEK is decrypted using the key encryption key KEK to obtain a temporary data encryption key DEK, thereby decrypting the data on the encrypted hard drive. Please refer to steps S410-S450 for details, which will not be repeated here.

[0079] Accordingly, the embodiment of the present invention does not directly store the data encryption key DEK or the key encryption key KEK, but instead stores the encrypted USBKey generation factor UKGF. Even if the ciphertext is cracked, only the USBKey generation factor UKGF is obtained, and the related keys cannot be directly obtained, which provides higher security. The embodiment of the present invention does not directly back up the data encryption key DEK or the key encryption key KEK, but instead uses the administrator recovery key ARK to encrypt and back up the generation factor UKGF, thereby improving key security. At the same time, it no longer requires the administrator USBKey, such as the key management center, to participate in key recovery, which is more efficient and flexible.

[0080] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0081] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0082] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0083] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0084] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0085] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0086] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0087] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0088] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A key protection method for an encrypted hard disk, characterized in that: The key protection method for the encrypted hard disk includes: Generate a key encryption key through the user's USBKey generation factor; Encrypting the data encryption key of the encrypted hard disk by using the key encryption key, and storing the corresponding ciphertext in the encrypted hard disk; and Encrypt the user USBKey generation factor and store the corresponding ciphertext in the user USBKey, Wherein, before the encrypted hard disk obtains the ciphertext corresponding to the encrypted user USBKey generation factor, the key protection method of the encrypted hard disk further includes: the encrypted hard disk and the user USBKey perform two-way authentication.

2. The key protection method for an encrypted hard disk according to claim 1, wherein: The key protection method for the encrypted hard disk further includes: Generate the administrator recovery key by generating factors through the administrator USBKey; The administrator recovers the key, encrypts the user USBKey generation factor, and stores the corresponding backup ciphertext in the key backup area of ​​the encrypted hard disk; and The administrator USBKey generation factor is stored in the administrator USBKey.

3. A method for using an encrypted hard disk, characterized in that: The method for using the encrypted hard disk includes: The encrypted hard disk obtains the ciphertext corresponding to the encrypted user USBKey generation factor, and decrypts it to obtain the user USBKey generation factor; Generate a key encryption key using the user USBKey generation factor; The ciphertext corresponding to the encrypted data encryption key is decrypted by the key encryption key to obtain a temporary data encryption key to decrypt the data of the encrypted hard disk. Wherein, before the encrypted hard disk obtains the ciphertext corresponding to the encrypted user USBKey generation factor, the method for using the encrypted hard disk further includes: the encrypted hard disk and the user USBKey perform two-way authentication.

4. The method for using an encrypted hard disk according to claim 3, wherein: After obtaining the temporary data encryption key, the method for using the encrypted hard disk further includes: The temporary data encryption key is stored in an unreadable register of the encryption hard disk and is lost when power is off.

5. The method for using an encrypted hard disk according to claim 3, wherein: The decryption method of the encrypted hard disk further includes: After the decryption of the encrypted hard disk is completed, the key encryption key is cleared.

6. The method for using an encrypted hard disk according to claim 3, wherein: The method for using the encrypted hard disk further includes: The encrypted hard disk obtains the administrator's USBKey generation factor; Generate an administrator recovery key using the administrator USBKey generation factor; Decrypt the encrypted backup ciphertext corresponding to the user USBKey generation factor through the administrator recovery key to obtain the backed-up user USBKey generation factor; Generate the key encryption key by generating the factor of the backed-up user USBKey; The ciphertext corresponding to the encrypted data encryption key is decrypted by using the key encryption key to obtain a temporary data encryption key to decrypt the data of the encrypted hard disk.

7. A key management system, characterized in that: The key management system includes: Encrypted hard drive for: Generate a key encryption key through the user's USBKey generation factor; Encrypting the data encryption key of the encrypted hard disk using the key encryption key and storing the corresponding ciphertext; and Encrypting the user USBKey generation factor; User USBKey is used to store the encrypted ciphertext corresponding to the user USBKey generation factor. Before obtaining the ciphertext corresponding to the encrypted user USBKey generation factor, the encrypted hard disk is further used to: perform two-way authentication with the user USBKey.

8. The key management system according to claim 7, characterized in that: The encrypted hard disk is also used for: Obtain the encrypted ciphertext corresponding to the user USBKey generation factor and decrypt it to obtain the user USBKey generation factor; Generate a key encryption key using the user USBKey generation factor; The ciphertext corresponding to the encrypted data encryption key is decrypted by using the key encryption key to obtain a temporary data encryption key to decrypt the data of the encrypted hard disk.

9. The key management system according to claim 8, characterized in that: The key management system further includes: Administrator USBKey, used to store the administrator USBKey generation factor; The encrypted hard disk is also used for: Generate an administrator recovery key using the administrator USBKey generation factor; The administrator recovers the key, encrypts the user USBKey generation factor, and stores the corresponding backup ciphertext in the key backup area of ​​the encrypted hard disk.

10. The key management system according to claim 9, characterized in that: The encrypted hard disk is also used for: Obtain the administrator USBKey generation factor; Generate an administrator recovery key using the administrator USBKey generation factor; Decrypt the encrypted backup ciphertext corresponding to the user USBKey generation factor through the administrator recovery key to obtain the backed-up user USBKey generation factor; Generate the key encryption key by generating the factor of the backed-up user USBKey; The ciphertext corresponding to the encrypted data encryption key is decrypted by using the key encryption key to obtain a temporary data encryption key to decrypt the data of the encrypted hard disk.

Images