Encrypted partition access control method, system and computing device based on domain management platform

Abstract

The present invention discloses an encrypted partition access control method, system and computing device based on a domain management platform. The method is executed in a file manager of a computing device, and includes the following steps: receiving an access request from a file management client to a disk partition; obtaining a configuration file, and determining whether the disk partition is an encrypted partition based on the encrypted partition information in the configuration file; if it is an encrypted partition, authenticating the user of the file management client, and obtaining an access token from the domain management platform after successful authentication; and sending the access token to a daemon process, so that the daemon process can obtain a secret key corresponding to the encrypted partition from the domain management platform based on the access token, decrypt the encrypted partition based on the secret key to obtain a decrypted partition, so as to mount the decrypted partition and access it. According to the technical solution of the present invention, unified control and management of access rights to encrypted partitions of multiple computing devices based on a domain management platform is achieved.

Description

[0001] This application is a divisional application of invention patent application 2022102357658 filed on March 11, 2022. Technical Field

[0002] The present invention relates to the field of computer technology, and in particular to an encrypted partition access control method based on a domain management platform, an encrypted partition access control system and a computing device. Background Art

[0003] The domain management platform is used to centrally manage the operating system and is suitable for large-scale terminal usage scenarios. Its functions include unified management of system policies, configurations, and application installations, which greatly reduces management costs while improving system security. Although the functions of the domain management platform cover a wide range, no domain management platform can currently achieve unified management of encrypted partitions.

[0004] In the conventional method of creating an encrypted partition in the prior art, the user manually selects a partition as an encrypted partition during the installation of the system image, and completes the creation of the encrypted partition through the tools provided by the installer, and manually enters the secret key during the creation process. After entering the operating system, the encrypted partition can be accessed through the file manager. If the partition is in an encrypted state at this time, a dialog box will pop up to require the user to manually enter the key for decryption.

[0005] It should be pointed out that the user needs to be able to access all resources on the client after logging in to the domain management platform through an account. According to the existing technical solution, the creation of the encrypted partition has been completed when the system is installed, and the partition's secret key is entered and managed by the user himself. In this case, the encrypted partition cannot be accessed only through the domain management account, and can only be opened by the user holding the secret key. In addition, the encryption key is saved by the user himself, and there is a lack of unified management of the secret key in the domain management environment, which also violates the principle of unified configuration and management of all resources under the domain management platform. Moreover, according to the existing technical solution, account authentication is not performed before accessing the encrypted partition. In this way, all users holding the secret key can access it, and there is a lack of access rights restrictions on visitors to the encrypted partition.

[0006] Therefore, an encrypted partition access control method based on a domain management platform is needed to solve the problems existing in the prior art. Summary of the invention

[0007] To this end, the present invention provides an encrypted partition access control method, an encrypted partition access control system and a computing device based on a domain management platform to solve or at least alleviate the above problems.

[0008] According to one aspect of the present invention, there is provided an encrypted partition access control method based on a domain management platform, which is executed in a file manager of a computing device, the computing device is communicatively connected to the domain management platform, a daemon of the file manager is running in an operating system of the computing device, and a file management client is arranged on the operating system, the method comprising the steps of: receiving an access request for a disk partition from the file management client; obtaining a configuration file, and determining whether the disk partition is an encrypted partition based on the encrypted partition information in the configuration file; if it is an encrypted partition, authenticating the user of the file management client, and obtaining an access token from the domain management platform after successful authentication; and sending the access token to the daemon, so that the daemon can obtain a secret key corresponding to the encrypted partition from the domain management platform based on the access token, decrypt the encrypted partition based on the secret key to obtain a decrypted partition, so as to mount the decrypted partition and access it.

[0009] Optionally, in the encrypted partition access control method based on the domain management platform according to the present invention, the domain management platform stores fixed user information corresponding to each document management client, and before sending the access token to the daemon process, it includes the steps of: obtaining the fixed user information corresponding to the document management client from the domain management platform, comparing the current user information with the fixed user information, and if they are the same, sending the access token to the daemon process.

[0010] Optionally, in the encrypted partition access control method based on the domain management platform according to the present invention, the step of authenticating the user of the document management client includes: obtaining an authentication address from the domain management platform through the document management client, obtaining an authentication page from the domain management platform based on the authentication address request, and displaying the authentication page on the document management client; obtaining user information entered by the user on the authentication page, and authenticating the user of the document management client based on the user information.

[0011] Optionally, in the encrypted partition access control method based on the domain management platform according to the present invention, the step of obtaining an access token from the domain management platform includes: obtaining an authorization code from the front end of the domain management platform through the document management client request; and obtaining an access token from the back end of the domain management platform based on the authorization code request.

[0012] Optionally, in the encrypted partition access control method based on the domain management platform according to the present invention, the encrypted partition information includes a predetermined tag name, and the step of determining whether the disk partition is an encrypted partition based on the encrypted partition information in the configuration file includes: obtaining the tag name of the disk partition, and determining whether the tag name is the same as the predetermined tag name in the encrypted partition information; if they are the same, determining that the disk partition is an encrypted partition.

[0013] Optionally, in the encrypted partition access control method based on the domain management platform according to the present invention, the file manager is suitable for communicating with the daemon process through the D-Bus bus, and sending the access token to the daemon process includes: calling the bus interface provided by the daemon process to send the access token to the daemon process.

[0014] Optionally, in the encrypted partition access control method based on the domain management platform according to the present invention, the daemon process is suitable for: when receiving a call request from a process to the bus interface, obtaining the process identifier of the process, and obtaining the corresponding process path based on the process identifier; judging whether the process path is the path of the file manager, and if so, responding to the call request.

[0015] Optionally, in the encrypted partition access control method based on the domain management platform according to the present invention, the step of sending the access token to the daemon process includes: encrypting the access token to generate an encrypted access token, and sending the encrypted access token to the daemon process via the D-Bus bus, so that the daemon process obtains the access token after decrypting the encrypted access token.

[0016] Optionally, in the encrypted partition access control method based on the domain management platform according to the present invention, encrypting the access token includes: encrypting the access token using a DH key exchange algorithm.

[0017] Optionally, in the encrypted partition access control method based on the domain management platform according to the present invention, the operating system is suitable for partitioning the disk to form one or more disk partitions during installation on the computing device, and the one or more disk partitions include an encrypted partition.

[0018] According to one aspect of the present invention, there is provided an encrypted partition access control system, comprising: one or more computing devices, wherein a file manager and a daemon of the file manager are running in the operating system of the computing devices, and a file management client is arranged on the operating system, and the file manager is suitable for executing the method as described above; and a domain management platform, which is communicatively connected to the one or more computing devices and is suitable for controlling access rights to encrypted partitions in the computing devices via the file manager.

[0019] According to one aspect of the present invention, there is provided a computing device, comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be suitable for execution by the at least one processor, and the program instructions include instructions for executing the encrypted partition access control method based on the domain management platform as described above.

[0020] According to one aspect of the present invention, a readable storage medium storing program instructions is provided. When the program instructions are read and executed by a computing device, the computing device executes the encrypted partition access control method based on the domain management platform as described above.

[0021] According to the technical solution of the present invention, there is provided an encrypted partition access control method based on a domain management platform, which realizes the unified management of multiple terminal users' access to encrypted partitions in a domain management environment. Among them, the domain management platform stores the secret keys corresponding to the encrypted partitions of each computing device. The file manager of each computing device interacts with the file management client user and the domain management platform, and authenticates the user based on the authentication page provided by the domain management platform, and obtains an access token after the authentication is passed. Then, the daemon process carries the access token to obtain the secret key stored in the domain management platform, and decrypts the encrypted partition based on the secret key to access the decrypted partition. In this way, the present invention realizes the unified control and management of the access rights of encrypted partitions of multiple computing devices based on the domain management platform.

[0022] Furthermore, each file management client is associated with a unique fixed user information and uniformly stored in the domain management platform. The file manager obtains the fixed user information of the client from the domain management platform and compares it with the current user information to limit the access rights to the encrypted partition to the fixed user uniquely corresponding to the file management client, thereby allowing only the fixed user of the local machine to log in and access the encrypted partition, and further restricting the access rights to the encrypted partition of each computing device.

[0023] In addition, according to the technical solution of the present invention, the file manager communicates with the daemon process through D-Bus. By limiting the process accessing the bus interface to the file manager process, or encrypting the access token based on the bus transmission, the security of data interaction between the file manager process and the daemon process can be improved, which is beneficial to enhancing the security of the encrypted partition access process.

[0024] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] To achieve the above and related purposes, certain illustrative aspects are described herein in conjunction with the following description and accompanying drawings, which indicate various ways in which the principles disclosed herein can be practiced, and all aspects and their equivalents are intended to fall within the scope of the claimed subject matter. The above and other purposes, features and advantages of the present disclosure will become more apparent by reading the following detailed description in conjunction with the accompanying drawings. Throughout the present disclosure, the same reference numerals generally refer to the same parts or elements.

[0026] Figure 1 A schematic diagram of an encrypted partition access control system 100 according to an embodiment of the present invention is shown;

[0027] Figure 2 A schematic diagram of a computing device 200 according to an embodiment of the present invention is shown;

[0028] Figure 3 A flowchart of an encrypted partition access control method 300 based on a domain management platform according to an embodiment of the present invention is shown; and

[0029] Figure 4 The interface effect diagram of the document management client 110 according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0030] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0031] Figure 1 FIG. 1 is a schematic diagram of an encrypted partition access control system 100 according to an embodiment of the present invention.

[0032] like Figure 1 As shown, the encrypted partition access control system 100 includes a domain management platform 150 and one or more computing devices 200 that are communicatively connected to the domain management platform 150. The domain management platform 150 can be used to centrally manage the operating systems 220 of multiple computing devices 200. Specifically, the domain management platform 150 can be used to centrally manage the system policies, configurations, application installations, etc. of multiple operating systems. It should be noted that the present invention is not limited to the communication connection method between each computing device 200 and the domain management platform 150. For example, one or more computing devices 200 can be connected to the domain management platform 150 network in a wired or wireless manner.

[0033] Among them, an operating system 220 is running in each computing device 200, and each computing device 200 includes one or more disk partitions. Here, one or more disk partitions can be formed by partitioning the disk when the operating system is installed in the computing device. A file manager 125 for file management is running in the operating system 220 of each computing device 200, and a daemon process 123 of the file manager is running. Here, the daemon process 123 is Daemon. The process of the file manager 125 can communicate with the daemon process 123, for example, data interaction is performed via the D-Bus bus. In addition, a client (file management client 110) of the file manager is arranged on each operating system 220. The file management client 110 serves as an entry for users to access each disk partition. Users can interact with the file manager 125 in the operating system via the file management client 110 so as to access the data in each disk partition via the file manager 125.

[0034] In one embodiment of the present invention, before the operating system is installed in the computing device 200, a partition configuration file can be added to the OEM (a method of modifying and adding functions using text configuration) directory of the system image, and the size and label name of the encrypted partition can be configured in the partition configuration file, for example, the size of the encrypted partition is configured to a predetermined size, and the label name of the encrypted partition is configured to a predetermined label name. Based on this, in the process of installing the operating system based on the system image, a partition of a predetermined size can be automatically reserved as an encrypted partition, and the label name of the encrypted partition is a predetermined label name. In this way, after the partition operation is completed, one or more disk partitions formed by the partition operation of the disk include the reserved encrypted partition. In one implementation, one or more disk partitions in the computing device can also include a system disk, a data disk, etc. It should be noted that when the operating system is installed and the operating system is entered for the first time, the initial format of the reserved encrypted partition is a common ext4 format, which does not have an encryption function. Therefore, it needs to be encrypted before an encrypted partition with an encrypted format and an encryption function can be created.

[0035] By obtaining the partition information corresponding to the partition with the predetermined tag name (i.e., the encrypted partition) from all the partition information, the encrypted partition information including the predetermined tag name is obtained, and then the encrypted partition information is written into the configuration file in the predetermined directory. In this way, after entering the operating system, the configuration file can be obtained in the predetermined directory, so that the file manager can determine the encrypted partition based on the configuration file. In one implementation, the predetermined tag name is, for example, "_reserve_part".

[0036] It can be understood that based on the configuration of the encrypted partition in the system image, after the partition operation is performed during the installation of the operating system based on the system image in multiple computing devices, the size and label name of the encrypted partition in each computing device are the same, thereby achieving the unification of the encrypted partition size and label name in multiple computing devices in a domain management environment.

[0037] According to the technical solution of the present invention, it is avoided that the user creates an encrypted partition by himself and inputs a secret key for decryption when accessing the encrypted partition.

[0038] In an embodiment of the present invention, the domain management platform 150 can also be used to uniformly control and manage the access rights of the encrypted partitions in one or more computing devices 200. Specifically, the domain management platform 150 is respectively connected to the file managers 125 in the multiple computing devices 200, and can control and manage the access rights of the encrypted partitions through the file managers 125 in each computing device 200. In addition, the domain management platform 150 stores the secret key corresponding to each encrypted partition to globally manage the secret keys of all encrypted partitions.

[0039] Figure 4 FIG. 1 shows an interface effect diagram of the document management client 110 according to an embodiment of the present invention. Figure 4 As shown, after entering the operating system, the user can view one or more disk partition icons, including a system disk icon, a data disk icon, and an encrypted partition icon, on the interface of the file management client 110. After the file management client 110 sends a request to access a disk partition to the file manager 125, the user can send a request to access the disk partition to the file manager 125 by, for example, operating any disk partition icon (e.g., double-clicking).

[0040] In an embodiment of the present invention, the file manager 125 controls and manages the access rights of encrypted partitions by executing the encrypted partition access control method 300 based on a domain management platform of the present invention. The encrypted partition access control method 300 based on a domain management platform will be described in detail below.

[0041] According to the encrypted partition access control system 100 of the present invention, the file manager 125 in each computing device 200 that is communicatively connected to the domain management platform 150 is suitable for executing the encrypted partition access control method 300 based on the domain management platform according to the present invention, so as to realize unified access permission management for the encrypted partitions in each computing device.

[0042] Figure 2 A schematic diagram of a computing device 200 according to one embodiment of the present invention is shown.

[0043] like Figure 2As shown, in a basic configuration 202, computing device 200 typically includes a system memory 206 and one or more processors 204. A memory bus 208 may be used for communication between processor 204 and system memory 206.

[0044] Depending on the desired configuration, the processor 204 can be any type of processing, including but not limited to: a microprocessor (UP), a microcontroller (UC), a digital information processor (DSP), or any combination thereof. The processor 204 can include one or more levels of cache such as a primary cache 210 and a secondary cache 212, a processor core 214, and registers 216. An example processor core 214 can include an arithmetic logic unit (ALU), a floating point unit (FPU), a digital signal processing core (DSP core), or any combination thereof. An example memory controller 218 can be used with the processor 204, or in some implementations, the memory controller 218 can be an internal part of the processor 204.

[0045] Depending on the desired configuration, the system memory 206 can be any type of memory, including but not limited to: volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.), or any combination thereof. The system memory 206 may include an operating system 220, one or more applications 222, and program data 224. The application 222 is actually a plurality of program instructions, which are used to instruct the processor 204 to perform corresponding operations. In some embodiments, the application 222 can be arranged to cause the processor 204 to operate using the program data 224 on the operating system.

[0046] Computing device 200 also includes storage device 232 , which includes removable storage 236 and non-removable storage 238 .

[0047] The computing device 200 may also include a storage interface bus 234. The storage interface bus 234 enables communication from storage devices 232 (e.g., removable storage 236 and non-removable storage 238) to the basic configuration 202 via the bus / interface controller 230. At least a portion of the operating system 220, the application 222, and the data 224 may be stored on the removable storage 236 and / or the non-removable storage 238, and when the computing device 200 is powered on or the application 222 is to be executed, it is loaded into the system memory 206 via the storage interface bus 234 and executed by the one or more processors 204.

[0048] The computing device 200 may also include an interface bus 240 that facilitates communication from various interface devices (e.g., output devices 242, peripheral interfaces 244, and communication devices 246) to the basic configuration 202 via the bus / interface controller 230. Example output devices 242 include an image processing unit 248 and an audio processing unit 250. They can be configured to facilitate communication with various external devices such as a display or speakers via one or more A / V ports 252. Example peripheral interfaces 244 may include a serial interface controller 254 and a parallel interface controller 256, which may be configured to facilitate communication with external devices such as input devices (e.g., keyboards, mice, pens, voice input devices, touch input devices) or other peripherals (e.g., printers, scanners, etc.) via one or more I / O ports 258. Example communication devices 246 may include a network controller 260, which may be arranged to facilitate communication with one or more other computing devices 262 via a network communication link via one or more communication ports 264.

[0049] A network communication link can be an example of a communication medium. Communication media can generally be embodied as computer-readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transmission mechanism, and can include any information delivery medium. A "modulated data signal" can be a signal in which one or more of its data sets or its changes can be performed in the signal in a manner that encodes information. As non-limiting examples, communication media can include wired media such as a wired network or a dedicated line network, and various wireless media such as sound, radio frequency (RF), microwave, infrared (IR) or other wireless media. The term computer-readable medium used herein can include both storage media and communication media.

[0050] In an embodiment according to the present invention, the computing device 200 is configured to execute the encrypted partition access control method 300 based on the domain management platform according to the present invention. The operating system of the computing device 200 contains a plurality of program instructions for executing the encrypted partition access control method 300 based on the domain management platform according to the present invention, and these program instructions can instruct the processor to execute the encrypted partition access control method 300 based on the domain management platform according to the present invention, so that the computing device can realize comprehensive control and management of the access rights of the encrypted partitions of multiple computing devices based on the domain management platform by executing the encrypted partition access control method 300 based on the domain management platform according to the present invention.

[0051] According to an embodiment of the present invention, the operating system of the computing device 200 includes a file manager 125 and runs a daemon process 123 of the file manager. The process of the file manager 125 can communicate with the daemon process 123. A file management client 110 is also arranged on the operating system. The file management client 110 serves as an entry for users to access various disk partitions. Users can communicate with the file manager 125 in the operating system via the file management client 110, so as to access data in various disk partitions via the file manager 125.

[0052] According to the encrypted partition access control system 100 described above, the domain management platform 150 is respectively connected to one or more computing devices 200 for communication. The operating system is suitable for performing a partition operation on the disk to form one or more disk partitions during installation on the computing device 200, wherein the one or more disk partitions include a reserved encrypted partition of a predetermined size. The domain management platform 150 can control and manage the access rights of the encrypted partitions in the computing devices via the file manager 125 in each computing device 200.

[0053] In an embodiment of the present invention, the file manager 125 includes multiple program instructions for executing the encrypted partition access control method 300 based on the domain management platform of the present invention, so that the file manager 125 can execute the encrypted partition access control method 300 based on the domain management platform of the present invention.

[0054] In one embodiment, the process of the file manager can communicate with the daemon process via a D-Bus bus to implement message interaction between the file manager process and the daemon process.

[0055] Figure 3 The flowchart of a method 300 for controlling access to encrypted partitions based on a domain management platform according to an embodiment of the present invention is shown. The method 300 is suitable for being executed in a file manager 125 of an operating system.

[0056] like Figure 3 As shown, the method 300 starts at step S310 .

[0057] In step S310, a request for accessing a disk partition from the file management client 110 is received.

[0058] It should be noted that after entering the operating system, the user can view one or more disk partition icons (i.e., access entries to disk partitions) on the interface of the document management client 110, including the encryption partition icon. The user can send an access request to the disk partition to the file manager 125 by operating (e.g., double-clicking) any disk partition icon on the document management client 110. For example, a request to access the disk partition is sent to the file manager 125 by double-clicking the disk partition icon. The file manager 125 needs to determine whether the disk partition is an encryption partition.

[0059] Then, in step S320, a configuration file is obtained from a predetermined directory, and the configuration file includes encrypted partition information. Next, based on the encrypted partition information in the configuration file, it is determined whether the disk partition to be accessed by the user is an encrypted partition. Here, it is determined whether the partition information of the disk partition is the same as the encrypted partition information in the configuration file. If they are the same, it can be determined that the disk partition is an encrypted partition.

[0060] In one embodiment, the encrypted partition information obtained from the configuration file includes a predetermined label name. By obtaining the label name of the disk partition to be accessed by the user, it is determined whether the label name is the same as the predetermined label name in the encrypted partition information. If the label names are the same, it can be determined that the disk partition is an encrypted partition.

[0061] In step S330, if it is determined that the disk partition is an encrypted partition, the user of the document management client is authenticated, and after the authentication is successful, an access token is obtained from the domain management platform to access resources in the domain manager based on the access token.

[0062] Here, the user of the document management client is authenticated by obtaining the current user information of the document management client. The user information includes account information.

[0063] In one embodiment, when the file manager 125 authenticates the user of the file management client, it needs to obtain the authentication interface from the domain management platform 150. The authentication interface can be implemented as a web page. It should be noted that in order to better embed the web page into the file manager, the web page can be encapsulated in a dialog box. Since the authentication page may be connected to the user's own authentication system in some scenarios, the authentication address corresponding to the authentication page is not fixed, so the authentication address needs to be obtained from the domain management platform.

[0064] Specifically, the document management client 110 obtains the authentication address corresponding to the authentication page from the domain management platform 150. Then, based on the authentication address, the authentication page is requested to be obtained from the domain management platform 150. After obtaining the authentication page returned by the domain management platform 150, the authentication page is displayed on the document management client 110, prompting the user to enter user information on the authentication page for identity authentication.

[0065] After the user enters user information on the authentication page, the file manager 125 can obtain the user information entered by the user on the authentication page, including account information, and then authenticate the user of the file management client based on the user information. If the identity authentication is successful, the file manager 125 can obtain an access token from the domain management platform 150 to access the resources of the domain management platform 150 based on the access token.

[0066] According to an embodiment of the present invention, the domain management platform 150 stores fixed user information corresponding to each document management client 110. Here, each document management client 110 is associated with a unique fixed user information, so as to limit the access rights to the encrypted partition to the fixed user uniquely corresponding to the document management client, and only allow the fixed user to log in to the document management client through the fixed account information in the fixed user information to access the encrypted partition.

[0067] According to an embodiment of the present invention, after the user is authenticated, the file manager 125 can obtain an access token from the domain management platform 150. After obtaining the access token, it is further verified whether the current user who requests to access the encrypted partition on the file management client 110 is a fixed user of the file management client, so as to ensure that only the fixed user corresponding to the file management client 110 can access the encrypted partition based on the fixed user information.

[0068] Specifically, by obtaining the fixed user information corresponding to the document management client 110 from the domain management platform 150, the current user information is compared with the fixed user information. If the current user information is the same as the fixed user information, it can be determined that the current user is the fixed user corresponding to the document management client, and then step S340 can be executed to send the access token to the daemon process. Here, the user information includes a user name. In one implementation, the user name can be obtained from the user information, and the user name in the current user information is compared with the user name in the fixed user information. If the user names are the same, it can be determined that the current user is the fixed user corresponding to the document management client and can access the encrypted partition. Otherwise, if the user name in the current user information is different from the user name in the fixed user information, it is regarded as an abnormal login, and the current user is denied access to the encrypted partition on the document management client 110.

[0069] If the current user information is the same as the fixed user information, continue to execute step S340.

[0070] In step S340, the access token is sent to the daemon process 123, so that the daemon process can obtain the secret key corresponding to the encrypted partition from the domain management platform 150 based on the access token, and decrypt the encrypted partition based on the secret key to obtain the decrypted partition, so that the decrypted partition can be mounted and the files therein can be accessed. Here, the daemon process is Daemon.

[0071] It should be noted that accessing files in the decrypted partition is just like accessing ordinary unencrypted disk partitions. Each partition corresponds to a mounted directory (file system). By mounting the decrypted partition to the corresponding directory, all files in the directory corresponding to the decrypted partition can be accessed, thereby realizing access to files stored in the decrypted partition.

[0072] In one implementation, a symmetric key-based encryption method may be used to encrypt and decrypt a partition based on the same key. The encrypted partition is pre-encrypted based on the key. Therefore, before accessing the encrypted partition, the encrypted partition must first be decrypted based on the key.

[0073] In one embodiment, the domain management platform 150 stores keys corresponding to the encrypted partitions in each computing device 200 .

[0074] It should be noted that the permissions of the file manager are ordinary user permissions, but the encrypted partition requires root permissions. Therefore, the file manager 125 sends an access token to the file manager's daemon 123, and uses the daemon with root permissions to obtain the secret key corresponding to the encrypted partition from the domain management platform 150, and performs decryption or encryption operations on the encrypted partition based on the secret key.

[0075] In addition, it should be noted that when the operating system is entered for the first time, the encrypted partition is in the ordinary ext4 format and does not have encryption function. Based on this, after the daemon obtains the secret key corresponding to the encrypted partition, it is first necessary to determine the format of the current encrypted partition, and determine whether the encrypted partition can be directly decrypted according to the format of the encrypted partition. Specifically, the file system mounted on the encrypted partition is determined according to the configuration file. If the file system is in the ext4 format, it is determined that it is the first time to enter the operating system, and the current encrypted partition has not been encrypted. It needs to be encrypted based on the secret key to create an encrypted partition in the LUKS format (encrypted format), and then the encrypted partition in the encrypted format can be decrypted based on the secret key. If the file system mounted on the encrypted partition determined according to the configuration file is in the LUKS format, it indicates that the current encrypted partition has been encrypted, and the current encrypted partition can be directly decrypted based on the secret key.

[0076] In one implementation, in step S330, OAuth 2.0 authorization code can be used for identity authentication, which can achieve front-end and back-end separation and has high security. Specifically, the steps for the file manager 125 to obtain an access token from the domain management platform 150 are as follows.

[0077] First, the document management client 110 requests the front end of the domain management platform 150 to obtain an authorization code, and obtains the authorization code returned by the front end of the domain management platform 150 .

[0078] Next, within a predetermined time after obtaining the authorization code, the file manager 125 obtains an access token from the backend of the domain management platform 150 based on the authorization code request, and obtains the access token returned by the backend of the domain management platform 150. After that, all communications with the domain management platform 150 are completed at the backend of the domain management platform 150.

[0079] In one implementation, before requesting to obtain the authentication address corresponding to the authentication page from the domain management platform 150 in step S330, it is first necessary to pass the network test. Specifically, the file manager 125 can test the address of the domain management platform through the Ping command, and determine whether the domain management platform is accessible based on the address. If it is not accessible (failed the network test), the subsequent process is skipped and the user is informed through a pop-up window. If the network test is passed, it can be requested to obtain the authentication address corresponding to the authentication page from the domain management platform 150, and the authentication address can be displayed in the authentication dialog box of the file management client 110, so as to request to obtain the authentication page from the domain management platform 150 based on the authentication address. The user performs identity authentication by entering account information on the authentication page.

[0080] After the identity authentication is passed, the authentication page will jump to the redirection address, and an authorization code will be returned during the jump: https: / / xx.com / callback?code=AUTHORIZATION_CODE. Here, the code parameter is the authorization code. Subsequently, the file manager 125 can obtain an access token from the backend of the domain management platform 150 based on the authorization code request.

[0081] In one implementation, the file manager 125 can obtain an access token through the "access_token" field, and then send the access token to the daemon process, which obtains data (secret key) from the domain management platform. The data format of the access token is as follows:

[0082] {

[0083] "access_token":"ACCESS_TOKEN",

[0084] "token_type":"xx",

[0085] "expires_in":xx,

[0086] "refresh_token":"xx",

[0087] "scope":"xx",

[0088] "uid":xx,

[0089] "info":{...}

[0090] }.

[0091] According to one embodiment of the present invention, the file manager process can communicate with the daemon process via the D-Bus bus, so that the access token can be sent to the daemon process via the D-Bus bus. Specifically, the daemon process 123 is provided with a bus interface, and the file manager can call the bus interface provided by the daemon process to send the access token to the daemon process. The process communication is performed based on the D-Bus bus, and the delay of the communication process is low and the overhead is small.

[0092] Since the parameters of the traditional D-Bus are transmitted in plain text, there are certain security risks. Moreover, the bus interface provided by the daemon process 123 can be called by all processes by default. Based on this, in one embodiment, the present invention limits the process that calls the bus interface to the file manager process by limiting the caller, thereby improving the security of the file manager and the daemon process communicating through the D-Bus bus.

[0093] Specifically, when the daemon process 123 receives a call request for the bus interface provided by any process, it obtains the process ID of the process and obtains the corresponding process path based on the process ID. Then, the daemon process 123 determines whether the process path is the path of the file manager. If it is the path of the file manager, it can be determined that the calling process is the file manager process, and then responds to the call request of the process for the bus interface. In this way, it can be ensured that only the process of the file manager can call the bus interface of the daemon process 123, and based on the bus interface, it can exchange messages with the daemon process 123 and send access tokens to the daemon process 123. By limiting the process accessing the bus interface to the file manager process, the security of communication between the file manager process and the daemon process can be improved, which is conducive to enhancing the security of the encrypted partition access process.

[0094] In one implementation, the daemon process 123 can obtain the process ID of the calling process by calling the servicePid function. The process path corresponding to the process ID can be obtained by executing the ps-aux|grep-v grep|grep PID command to determine whether the process path is the path of the file manager. It should also be noted that since the applications in the domain management environment are all signed, the present invention uses the path of the calling process as the basis for determining whether it is a file manager process, which is conducive to further enhancing the security of inter-process communication.

[0095] In yet another embodiment, the present invention encrypts the transmitted data (access token) to avoid plain text transmission, thereby improving the security of communication between the file manager process and the daemon process based on the D-Bus bus.

[0096] Specifically, the process of the file manager 125 may send the access token to the daemon process 123 in the following manner:

[0097] The file manager 125 encrypts the access token to generate an encrypted access token, and then sends the encrypted access token to the daemon process 123 via the D-Bus bus. After obtaining the encrypted access token, the daemon process 123 needs to decrypt the encrypted access token to obtain the decrypted access token in plain text.

[0098] In one implementation, the DH key exchange algorithm can be used to encrypt the transmission data (access token). The principle of the DH key exchange algorithm is that the two parties in data communication negotiate a number and use the number to encrypt the data to be sent to ensure the security of data transmission.

[0099] Assume that there is a prime number q, then for positive integers a, x, y, we can get:

[0100] (a x mod p) y mod p=a (x·y) mod p

[0101] After expanding the formula, we can get:

[0102] (a x mod p) y mod p=(a y mod p) x mod p

[0103] According to the formula, it is only necessary to share the prime number p between the two processes and create their own private variables x and y, that is, a number can be agreed upon for both parties without passing the secret key. In this way, the file manager 125 can use the agreed number as the secret key of the encryption algorithm for encrypting the transmission data, and encrypt the data to be sent based on the secret key. After receiving the encrypted data (encrypted access token), the daemon process 123 can use the agreed number as the secret key to decrypt the encrypted data (encrypted access token), so that the plaintext data can be obtained. In one implementation, the present invention uses the AES encryption algorithm to encrypt the transmission data.

[0104] To further enhance the security of data interaction between two processes based on D-Bus, according to an embodiment of the present invention, by adding a timestamp (with millisecond precision) to the encrypted transmission data, the time point when the file manager 125 sends the encrypted transmission data (encrypted access token) is recorded as the start time S, and the time point when the daemon process 123 receives the encrypted transmission data (encrypted access token) is recorded as the end time E. When the value of EF is greater than a predetermined threshold, the message of this transmission data is invalidated.

[0105] In addition, in order to prevent data transmitted based on D-Bus from being tampered with, in one embodiment of the present invention, a first hash value obtained by hashing the transmission data (access token) and the timestamp is further added at the end of the encrypted transmission data to obtain encrypted hash transmission data, and the encrypted hash transmission data is sent to the daemon process 123 by calling the bus interface to ensure the integrity of the transmission data.

[0106] Next, when the daemon process 123 receives the encrypted hash transmission data and decrypts the encrypted hash transmission data, the transmission data (access token), timestamp and first hash value can be obtained. The first hash value can be used as a basis for integrity verification of the transmission data. Furthermore, the daemon process 123 performs a hash operation on the decrypted transmission data (access token) and timestamp to obtain a second hash value. Subsequently, the integrity of the received encrypted hash transmission data is verified by comparing the second hash value with the first hash value, wherein if the second hash value is equal to the first hash value, it is determined that the received encrypted hash transmission data is complete. On the contrary, if the second hash value is not equal to the first hash value, it means that the transmission data may have been tampered with, and the current transmission data is invalidated.

[0107] In this way, the security of data interaction between the file manager and the daemon process via the bus can be ensured, and the integrity of the transmitted data can also be ensured.

[0108] According to the encrypted partition access control method 300 based on the domain management platform of the present invention, unified management of multiple terminal users' access to encrypted partitions in a domain management environment is implemented. Among them, the domain management platform stores the secret keys corresponding to the encrypted partitions of each computing device. The file manager of each computing device interacts with the file management client user and the domain management platform, and authenticates the user based on the authentication page provided by the domain management platform, and obtains an access token after the authentication is passed. Then, the daemon process carries the access token to obtain the secret key stored in the domain management platform, and decrypts the encrypted partition based on the secret key to access the decrypted partition. In this way, the present invention implements unified control and management of access rights to encrypted partitions of multiple computing devices based on the domain management platform.

[0109] Furthermore, each file management client is associated with a unique fixed user information and uniformly stored in the domain management platform. The file manager obtains the fixed user information of the client from the domain management platform and compares it with the current user information to limit the access rights to the encrypted partition to the fixed user uniquely corresponding to the file management client, thereby allowing only the fixed user of the local machine to log in and access the encrypted partition, and further restricting the access rights to the encrypted partition of each computing device.

[0110] In addition, according to the technical solution of the present invention, the file manager communicates with the daemon process through D-Bus. By limiting the process accessing the bus interface to the file manager process, or encrypting the access token based on the bus transmission, the security of data interaction between the file manager process and the daemon process can be improved, which is beneficial to enhancing the security of the encrypted partition access process.

[0111] The various techniques described herein may be implemented in combination with hardware or software, or a combination thereof. Thus, the method and apparatus of the present invention, or some aspects or parts of the method and apparatus of the present invention may be in the form of program codes (i.e., instructions) embedded in a tangible medium, such as a removable hard disk, a USB flash drive, a floppy disk, a CD-ROM, or any other machine-readable storage medium, wherein when the program is loaded into a machine such as a computer and executed by the machine, the machine becomes a device for practicing the present invention.

[0112] In the case where the program code is executed on a programmable computer, the mobile terminal generally includes a processor, a storage medium readable by the processor (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. The memory is configured to store the program code; the processor is configured to execute the encrypted partition access control method based on the domain management platform of the present invention according to the instructions in the program code stored in the memory.

[0113] By way of example and not limitation, readable media include readable storage media and communication media. Readable storage media stores information such as computer readable instructions, data structures, program modules or other data. Communication media generally embody computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and include any information transfer medium. Any combination of the above is also included within the scope of readable media.

[0114] In the description provided herein, algorithms and displays are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the examples of the present invention. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to implement the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0115] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0116] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, the various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0117] Those skilled in the art will appreciate that the modules or units or components of the devices in the examples disclosed herein may be arranged in the devices described in the embodiment, or alternatively may be located in one or more devices different from the devices in the examples. The modules in the foregoing examples may be combined into one module or may be divided into multiple submodules.

[0118] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0119] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0120] In addition, some of the embodiments are described herein as methods or combinations of method elements that can be implemented by a processor of a computer system or by other devices that perform the functions. Therefore, a processor with necessary instructions for implementing the method or method elements forms a device for implementing the method or method elements. In addition, the elements described herein of the device embodiments are examples of devices for implementing the functions performed by the elements for the purpose of implementing the invention.

[0121] As used herein, unless otherwise specified, the use of ordinal numbers "first," "second," "third," etc. to describe common objects merely indicates that different instances of similar objects are involved, and is not intended to imply that the objects so described must have a given order in time, space, order, or in any other manner.

[0122] Although the present invention has been described according to a limited number of embodiments, it will be apparent to those skilled in the art, with the benefit of the above description, that other embodiments may be envisioned within the scope of the invention thus described. In addition, it should be noted that the language used in this specification is selected primarily for readability and teaching purposes, rather than for explaining or defining the subject matter of the present invention. Therefore, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is illustrative and not restrictive with respect to the scope of the present invention, and the scope of the present invention is defined by the appended claims.

Claims

1. A method for controlling access to encrypted partitions based on a domain management platform, which is executed in a file manager of a computing device, the computing device is communicatively connected to the domain management platform, a daemon process of the file manager is running in the operating system of the computing device, and a file management client is arranged on the operating system, characterized in that: The method comprises the steps of: receiving a request for accessing a disk partition sent by a document management client by operating a disk partition icon; Obtain a configuration file, and determine whether the disk partition is an encrypted partition based on the encrypted partition information in the configuration file; If it is an encrypted partition, authenticate the user of the document management client, and obtain an access token from the domain management platform after successful authentication; as well as The access token is sent to the daemon process so that the daemon process can obtain the secret key corresponding to the encrypted partition from the domain management platform based on the access token, decrypt the encrypted partition based on the secret key to obtain a decrypted partition, and mount the decrypted partition for access.

2. The method according to claim 1, characterized in that The domain management platform stores fixed user information corresponding to each document management client, and before sending the access token to the daemon process, includes the following steps: Obtain fixed user information corresponding to the document management client from the domain management platform, compare the current user information with the fixed user information, and if they are the same, send the access token to the daemon process.

3. The method according to claim 1, characterized in that The steps for authenticating the user of the document management client include: Obtaining an authentication address from the domain management platform through the document management client, obtaining an authentication page from the domain management platform based on the authentication address request, and displaying the authentication page on the document management client; The user information input by the user on the authentication page is obtained, and the identity of the user of the document management client is authenticated based on the user information.

4. The method according to any one of claims 1 to 3, characterized in that The steps of obtaining an access token from the domain management platform include: Obtaining an authorization code from the front end of the domain management platform through the document management client; An access token is obtained from the backend of the domain management platform based on the authorization code request.

5. The method according to any one of claims 1 to 3, characterized in that The encrypted partition information includes a predetermined label name, and the step of determining whether the disk partition is an encrypted partition based on the encrypted partition information in the configuration file includes: Obtaining a label name of the disk partition, and determining whether the label name is the same as a predetermined label name in the encrypted partition information; If they are the same, it is determined that the disk partition is an encrypted partition.

6. The method according to any one of claims 1 to 3, characterized in that The file manager is adapted to communicate with the daemon process via a D-Bus bus, and sending the access token to the daemon process comprises: The bus interface provided by the daemon process is called to send the access token to the daemon process.

7. The method according to claim 6, characterized in that The daemon is suitable for: When receiving a call request from a process to the bus interface, obtaining a process identifier of the process, and obtaining a corresponding process path based on the process identifier; Determine whether the process path is a path of the file manager, and if so, respond to the call request.

8. The method according to claim 6, characterized in that The steps of sending the access token to the daemon process include: The access token is encrypted to generate an encrypted access token, and the encrypted access token is sent to the daemon process through a D-Bus bus, so that the daemon process obtains the access token after decrypting the encrypted access token.

9. The method according to claim 8, characterized in that Encrypting the access token includes: The access token is encrypted using the DH key exchange algorithm.

10. The method according to any one of claims 1 to 3, characterized in that The operating system is suitable for performing a partition operation on a disk to form one or more disk partitions during installation on a computing device, wherein the one or more disk partitions include an encrypted partition.

11. An encrypted partition access control system, characterized in that: include: One or more computing devices, wherein a file manager and a daemon process of the file manager are running in an operating system of the computing device, and a file management client is arranged on the operating system, and the file manager is suitable for executing the method according to any one of claims 1 to 10; as well as The domain management platform is communicatively connected to the one or more computing devices and is suitable for controlling access rights to the encrypted partitions in the computing devices via a file manager.

12. A computing device, characterized in that: include: at least one processor; as well as A memory storing program instructions, wherein the program instructions are configured to be executed by the at least one processor, and the program instructions include instructions for executing the method according to any one of claims 1 to 10.

13. A readable storage medium storing program instructions, characterized in that: When the program instructions are read and executed by a computing device, the computing device is caused to execute the method as claimed in any one of claims 1 to 10.

Images