Data encryption and decryption method and device based on hardware encryption card, medium and equipment

Abstract

The embodiment of the application provides a data encryption and decryption method and device based on a hardware encryption card, a medium and equipment, relates to the technical field of data encryption, and the method comprises the following steps: creating a boot partition and a root partition in an installation disk in the operating system installation process of an electronic device; the data of the boot partition and the root partition are encrypted through a hardware encryption card, wherein the data of the boot partition and the root partition are ciphertext data after the operating system installation is completed; in the operating system startup process, a bootloader program is queried and loaded through firmware, and the bootloader program is used to call the hardware encryption card to read and decrypt the operating system kernel image and the temporary root file system image from the boot partition; the operating system kernel image is loaded into a memory and is run, so that the operating system kernel is run in the memory; after the operating system kernel is run, the ciphertext data of the boot partition and the root partition are decrypted through the hardware encryption card. Through the application, the security of computer system protection can be effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of data encryption technology, and more specifically, to a data encryption and decryption method, apparatus, medium and device based on a hardware encryption card. Background Technology

[0002] With the deepening of digitalization, informatization, and intelligentization across all sectors of society, data security has become an increasingly important issue. Data may contain sensitive business information and personal data, and its leakage could lead to the loss of trade secrets and financial assets. Therefore, ensuring the security of computer systems such as personal computers and government and enterprise servers, and preventing data from being illegally tampered with or accessed, is an important area of ​​research and practice.

[0003] Computer system security typically includes two aspects: boot protection and data protection. Boot protection focuses on verifying whether the system has been tampered with and whether it is the default system during the system startup process. Data protection involves encrypting and protecting data during system operation to prevent unauthorized access or alteration during storage and processing.

[0004] In existing technologies, "chains of trust" and "roots of trust" are commonly used to protect computer systems during startup. This involves verifying the integrity of each system component step by step, starting from the root of trust, and storing the verification results in a secure location, such as centralized hardware or the cloud. However, this approach primarily focuses on verifying the integrity of components during system startup, while data generated or processed during system operation remains in plaintext. In other words, it only verifies the trustworthiness of the startup process without protecting the data generated and executed during startup and operation.

[0005] There is currently no good solution to the above problems. Summary of the Invention

[0006] This invention provides a data encryption and decryption method, apparatus, medium, and device based on a hardware encryption card to improve the security of computer system protection.

[0007] According to an embodiment of the present invention, a data encryption and decryption method based on a hardware encryption card is provided, applied to an electronic device, the electronic device including an installation disk and a memory, wherein firmware is stored in the memory, and the method includes:

[0008] During the operating system installation process of the electronic device, a boot partition and a root partition are created on the installation disk;

[0009] The data in the boot partition and the root partition are encrypted using a hardware encryption card. After the operating system is installed, the data in the boot partition and the root partition is encrypted data.

[0010] During the operating system startup process, the firmware queries and loads the bootloader program, and the bootloader program calls the hardware encryption card to read and decrypt the operating system kernel image and temporary root file system image from the boot partition.

[0011] The operating system kernel image is loaded into the memory and run to run the operating system kernel in the memory;

[0012] After the operating system kernel runs, the encrypted data in the boot partition and the root partition is decrypted using the hardware encryption card.

[0013] In an exemplary embodiment, encrypting the data in the boot partition and the root partition using a hardware encryption card includes:

[0014] A second driver and a dm-crypt kernel module are installed in the operating system, wherein the dm-crypt kernel module is used to call the hardware encryption card to encrypt the data in the boot partition and the root partition;

[0015] Create a root partition encrypted volume device in the root partition, and create a boot partition encrypted volume device in the boot partition;

[0016] The root partition encrypted volume device is formatted to obtain the root partition file system, and the boot partition encrypted volume device is formatted to obtain the boot partition file system;

[0017] The second driver invokes the hardware encryption card to encrypt data written from the boot partition to the boot partition file system, and also encrypts data written from the root partition to the root partition file system.

[0018] In an exemplary embodiment, the step of encrypting data written from the boot partition to the boot partition file system by invoking the hardware encryption card through the second driver, and encrypting data written from the root partition to the root partition file system, includes:

[0019] All file directories of the root partition are written to the root partition file system, and all file directories of the boot partition are written to the boot partition file system. During the process of writing all file directories of the root partition to the root partition file system, all file directories of the root partition pass through the root partition encrypted volume device. During the process of writing all file directories of the boot partition to the boot partition file system, all file directories of the boot partition pass through the boot partition encrypted volume device.

[0020] When all file directories of the root partition pass through the root partition encryption volume device, the second driver calls the hardware encryption card to encrypt all file directories of the root partition;

[0021] When all file directories of the boot partition pass through the boot partition encryption volume device, the second driver calls the hardware encryption card to encrypt all file directories of the boot partition.

[0022] In an exemplary embodiment, obtaining the operating system kernel image and the temporary root file system image through the bootloader program includes:

[0023] The bootloader program loads the first driver and queries the boot partition;

[0024] The bootloader program mounts the boot partition as a boot partition file system and reads the encrypted data of the operating system kernel image and the encrypted data of the temporary root file system image from the boot partition file system.

[0025] The first driver is invoked to decrypt the encrypted data of the operating system kernel image to obtain the operating system kernel image, and the encrypted data of the temporary root file system image is decrypted to obtain the temporary root file system image.

[0026] In one exemplary embodiment, after obtaining the operating system kernel image and the temporary root file system image through the bootloader program, the method further includes:

[0027] The temporary root file system image is loaded into the storage and mounted as a memory file system type, so that the operating system can access and use the systemd program in the temporary root file system image to start programs and / or components in the operating system through the memory file system type.

[0028] In an exemplary embodiment, the step of decrypting the encrypted data of the boot partition and the root partition using the hardware encryption card includes:

[0029] A second driver and a dm-crypt kernel module are installed in the operating system, wherein the dm-crypt kernel module is used to call the hardware encryption card to decrypt the ciphertext data of the boot partition and the root partition;

[0030] Create a root partition encrypted volume device in the root partition, and create a boot partition encrypted volume device in the boot partition;

[0031] The root partition encrypted volume device is mounted as the root partition file system, so that the operating system can access and use the systemd program in the root partition file system to start programs and / or components in the operating system;

[0032] Read the encrypted data of the root partition, and decrypt the encrypted data of the root partition by calling the second driver through the root partition encrypted volume device;

[0033] The boot partition encrypted volume device is mounted as a boot partition file system, and the encrypted data of the boot partition is read. The second driver is then called through the boot partition encrypted volume device to decrypt the encrypted data of the boot partition.

[0034] In one exemplary embodiment, the bootloader program includes an encryption / decryption module, which drives the hardware encryption card to encrypt and decrypt data in the boot partition.

[0035] According to another embodiment of the present invention, a data encryption / decryption device based on a hardware encryption card is provided, comprising:

[0036] An encryption module is used to create a boot partition and a root partition on the installation disk during the operating system installation process of the electronic device, and to encrypt the data in the boot partition and the root partition using a hardware encryption card. After the operating system installation is completed, the data in the boot partition and the root partition is encrypted data.

[0037] The operating system kernel execution module is used to query and load the bootloader program through the firmware during the boot process of the operating system, obtain the operating system kernel image and the temporary root file system image through the bootloader program, load the operating system kernel image into the memory and run it, so as to run the operating system kernel in the memory;

[0038] The decryption module is used to decrypt the encrypted data of the boot partition and the root partition through the hardware encryption card after the operating system kernel is running.

[0039] According to yet another embodiment of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

[0040] According to yet another embodiment of the present invention, an electronic device is also provided, comprising:

[0041] The aforementioned data encryption and decryption device based on a hardware encryption card;

[0042] The memory is configured to store instructions; and

[0043] The processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the aforementioned data encryption / decryption method based on a hardware encryption card.

[0044] According to the above technical solution, by encrypting the boot partition and root partition in the installation disk, it can be effectively ensured that all data of the entire operating system is stored in encrypted form, effectively preventing unauthorized access and data leakage. During the operating system startup process, the firmware loads the bootloader program, and the bootloader program obtains the operating system kernel image. The operating system kernel image is then loaded into the memory for execution. After the operating system kernel is running, the encrypted data is decrypted by a hardware encryption card, which can effectively protect the security of the data and prevent the data from being illegally accessed or tampered with during the operating system startup or operation phases, effectively ensuring the data security of the operating system from startup to operation. Attached Figure Description

[0045] Figure 1 This is a hardware structure block diagram of a mobile terminal according to an embodiment of the present invention;

[0046] Figure 2 This is a schematic diagram of the overall structure of a data encryption and decryption method based on a hardware encryption card according to an embodiment of the present invention;

[0047] Figure 3 This is a flowchart of a data encryption and decryption method for a hardware encryption card according to an embodiment of the present invention;

[0048] Figure 4 This is a schematic diagram of the bootloader stage according to an embodiment of the present invention;

[0049] Figure 5This is a schematic diagram of the initrd stage according to an embodiment of the present invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0051] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0052] The methods and embodiments provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal based on a data encryption / decryption method using a hardware encryption card, according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0053] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to a data encryption / decryption method based on a hardware encryption card in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the aforementioned method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0054] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0055] Example 1:

[0056] The data encryption and decryption method based on a hardware encryption card provided in this application will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0057] For a better understanding of this technical solution, please refer to [link / reference]. Figure 2 , Figure 2 A schematic diagram of the overall structure of a data encryption and decryption method based on a hardware encryption card is shown.

[0058] Firmware refers to the program written into a programmable read-only memory (ROM), primarily used to locate and load the bootloader program during system startup. It typically includes two types: legacy BIOS and UEFI. In this embodiment, the bootloader is a heavily modified version of GRUB2, mainly used to identify the boot partition, initialize hardware encryption card driver 1, locate and load the operating system kernel image and the temporary root file system image initrd.img, and encrypt and decrypt data in the boot partition through hardware encryption card driver 1. Driver 1 refers to a program developed based on the bootloader software framework to drive the hardware encryption card. It is not part of the operating system and is mainly used to call the hardware encryption card during the operating system boot process to encrypt and decrypt data accessing the boot partition.

[0059] In this embodiment, the operating system is Linux, mainly comprising the Linux kernel, a customized initrd.img, driver 2, a disk encryption engine, a root partition file system, and a boot partition file system. The Linux kernel refers to the kernel image of the Linux operating system. initrd.img is a customized temporary root file system image, which is loaded into memory and decompressed during the operating system startup process, and used to complete subsequent operating system startup operations. Driver 2 is a kernel program developed based on the Linux operating system device driver framework to drive the hardware encryption card. It is mainly used for hardware encryption card configuration initialization, memory resource allocation, and hardware encryption / decryption operations. The disk encryption engine is used to create encrypted volume devices for the boot and root partitions during the initrd execution process, enabling the hardware card driver 2 to be invoked when transparently accessing data in the boot and root partitions during the initrd stage of system startup, allowing real-time encryption and decryption of disk data through the hardware encryption card.

[0060] The root partition file system and the boot partition file system are formatted and mounted after the root partition (ciphertext) and boot partition (ciphertext) are overlaid with an encrypted volume device, respectively. The hardware encryption card is mainly used for data encryption and decryption operations. It is usually connected to the host machine via the PCI bus. Handling complex encryption and decryption operations through corresponding hardware can effectively relieve CPU load, thereby accelerating overall system performance. The boot partition (ciphertext) refers to the disk partition on which boot partition data is written. When the operating system starts, it searches for this partition and mounts it as the boot partition file system after overlaying an encryption and decryption layer. In this embodiment, the data in the boot partition is in encrypted form. The root partition (ciphertext) refers to the disk partition on which root partition data is written. After the system starts, it mounts it as the root partition file system after overlaying an encryption and decryption layer. In this embodiment, the data in the root partition is in encrypted form.

[0061] based on Figure 2 The diagram shows the overall structure of a data encryption and decryption method based on a hardware encryption card. This application discloses a data encryption and decryption method based on a hardware encryption card.

[0062] Reference Figure 3 A data encryption and decryption method based on a hardware encryption card is applied to an electronic device, which includes an installation disk and a memory, wherein the memory stores firmware. The method includes the following steps:

[0063] S110. During the operating system installation process of an electronic device, create a boot partition and a root partition on the installation disk.

[0064] The boot partition is used to store the bootloader and related boot files. The bootloader is the first program loaded when an electronic device starts up, and it is used to guide the operating system's boot process. The boot partition typically includes the bootloader, kernel image, device drivers, and other necessary boot files.

[0065] The root partition is the partition where the operating system's root file system resides, including all files and directories of the operating system. The root partition typically contains the operating system kernel, system libraries, configuration files, applications, and user data.

[0066] S120. Encrypt the data in the boot partition and root partition using a hardware encryption card. After the operating system is installed, the data in the boot partition and root partition is encrypted.

[0067] During the operating system installation process of an electronic device, the data in the boot partition and root partition is encrypted using a hardware encryption card. After the operating system installation is complete, the data in the boot partition and root partition is encrypted. Therefore, any unauthorized accessor or attacker cannot directly read or understand the contents of the boot partition and root partition. Only through decryption operations performed by the hardware encryption card can the encrypted data be converted back to its original plaintext form, allowing the operating system to correctly read and use the data.

[0068] Encrypting the data in the boot and root partitions enhances the security of electronic devices. Even with physical access to the device's storage media, data cannot be directly read. This encryption effectively prevents data leaks and unauthorized access, providing enhanced data security.

[0069] S130. During the operating system startup process, the firmware queries and loads the bootloader program, and the bootloader program calls the hardware encryption card to read and decrypt the operating system kernel image and temporary root file system image from the boot partition.

[0070] The bootloader program includes an encryption / decryption module, which drives the hardware encryption card to encrypt and decrypt data in the boot partition.

[0071] Firmware is used to locate and load the bootloader program when the operating system starts. The operating system kernel image contains the core code and functionality of the operating system; it is typically a compiled and packaged binary file.

[0072] A temporary root file system image is a temporary file system that contains the most basic files and directories required for the operating system to boot. It typically includes necessary drivers, configuration files, and startup scripts.

[0073] S140. Load the operating system kernel image into memory and run it to run the operating system kernel in memory.

[0074] The bootloader program can read and load the operating system kernel image and temporary root file system image from the boot partition into the storage, so that the bootloader program can transfer control to the operating system kernel and start the normal operation of the operating system.

[0075] Once the kernel image is loaded into memory, the bootloader program transfers control to the kernel, thus starting the operating system. The kernel runs in memory, performing various functions and tasks of the operating system.

[0076] Specifically, memory can be random access memory (RAM), which is a temporary storage space used to store programs and data.

[0077] When the bootloader program loads the operating system kernel image, because memory read and write speeds are much faster than disk speeds, the kernel image is read from the disk into memory. Therefore, loading the kernel image into memory can improve the operating system's boot speed and performance.

[0078] S150. After the operating system kernel runs, the encrypted data in the boot partition and root partition is decrypted through the hardware encryption card.

[0079] After the operating system kernel runs, the encrypted data in the boot partition and root partition is decrypted using a hardware encryption card.

[0080] Because the data in the boot partition and root partition is encrypted in S120, the encrypted data in the boot partition and root partition cannot be directly read and used by the operating system before the operating system kernel runs. In order to decrypt the encrypted data, the operating system kernel can call the hardware encryption card to perform the decryption operation.

[0081] Decrypted data can be read and used by the operating system kernel, including reading configuration files, loading applications, and accessing user data. The decryption operation via a hardware encryption card effectively ensures that the operating system can correctly access and use data in the boot and root partitions, while providing transparent access to encrypted data during operating system runtime. Only when the operating system kernel has a hardware encryption card can data be successfully decrypted, effectively protecting data security and preventing unauthorized access and data leakage.

[0082] This embodiment encrypts the boot partition and root partition on the installation disk, effectively ensuring that all operating system data is stored in encrypted form, thus preventing unauthorized access and data leakage. During the operating system startup process, the firmware loads the bootloader program, which obtains the operating system kernel image and loads it into memory for execution. After the operating system kernel runs, the encrypted data is decrypted using a hardware encryption card, effectively protecting data security and preventing unauthorized access or tampering during the operating system startup or runtime phases, thus ensuring data security throughout the entire operating system process from startup to operation.

[0083] In one embodiment of this invention, encrypting the data in the boot partition and root partition using a hardware encryption card includes the following steps:

[0084] S210. Install the second driver and the dm-crypt kernel module in the operating system. The dm-crypt kernel module is used to call the hardware encryption card to encrypt the data in the boot partition and the root partition.

[0085] S220. Create a root partition encrypted volume device in the root partition and a boot partition encrypted volume device in the boot partition.

[0086] An encrypted volume device is a logical block device primarily used to perform data encryption and decryption operations by calling a hardware encryption card through a second driver.

[0087] S230. Format the root partition encrypted volume device to obtain the root partition file system, and format the boot partition encrypted volume device to obtain the boot partition file system.

[0088] Formatting refers to creating a corresponding file system structure for an encrypted volume device so that the operating system can read, write, and manage the data in the encrypted volume device.

[0089] S240: The second driver calls the hardware encryption card to encrypt the data written from the boot partition to the boot partition file system, and also encrypts the data written from the root partition to the root partition file system.

[0090] When data is written to the boot partition or root partition, the data is encrypted by a hardware encryption card and finally stored in the corresponding encrypted volume device.

[0091] In other words, during operating system installation, a boot partition and a root partition can be created based on the selected installation disk, and encrypted volume devices can be built on the boot partition and the root partition respectively. Then, the encrypted volume devices are formatted as boot partition file systems and root partition file systems respectively. Finally, the files required by the boot partition and the root partition in the system installation package are written to the boot partition file system and the root partition file system respectively.

[0092] In this implementation, the data in the boot partition and root partition can be encrypted into ciphertext and stored in the corresponding encrypted volume device. Only through decryption using a hardware encryption card can the correct plaintext data be obtained, thus improving the data security of electronic devices and preventing unauthorized access and data leakage.

[0093] In one embodiment of this example, the second driver invokes a hardware encryption card to encrypt data written from the boot partition to the boot partition file system, and also encrypts data written from the root partition to the root partition file system, including the following steps:

[0094] S310. Write all file directories of the root partition to the root partition file system, and write all file directories of the boot partition to the boot partition file system. During the process of writing all file directories of the root partition to the root partition file system, all file directories of the root partition pass through the root partition encrypted volume device. During the process of writing all file directories of the boot partition to the boot partition file system, all file directories of the boot partition pass through the boot partition encrypted volume device.

[0095] During the process of writing all files and directories of the root partition to the root partition file system, all files and directories of the root partition pass through the root partition encrypted volume device. Similarly, during the process of writing all files and directories of the boot partition to the boot partition file system, all files and directories of the boot partition pass through the boot partition encrypted volume device.

[0096] S320: When all file directories in the root partition have passed through the root partition encryption volume device, the hardware encryption card is invoked through the second driver to encrypt all file directories in the root partition.

[0097] S330: When all file directories of the boot partition are connected to the boot partition encryption volume device, the hardware encryption card is invoked through the second driver to encrypt all file directories of the boot partition.

[0098] When all files in the root partition pass through the root partition encrypted volume device, the hardware encryption card is invoked by the second driver to encrypt all files in the root partition. Similarly, when all files in the boot partition pass through the boot partition encrypted volume device, the hardware encryption card is invoked by the second driver to encrypt all files in the boot partition. This ensures that files in both the boot and root partitions are encrypted using the hardware encryption card during writing. Because the hardware encryption card is invoked by the second driver to encrypt data during the S310's writing process, the system data in both the root and boot partitions is stored in encrypted form after the operating system installation is complete.

[0099] This implementation method requires a hardware encryption card to decrypt the encrypted data, converting it back to plaintext so that the operating system can correctly read and use it. This effectively improves the data security of electronic devices, preventing unauthorized access and data leakage.

[0100] In one embodiment of this example, obtaining the operating system kernel image and the temporary root file system image through the bootloader program includes the following steps:

[0101] S410: Load the first driver through the bootloader program and query the boot partition.

[0102] After the bootloader program loads the first driver, the first driver searches for the boot partition.

[0103] S420: The boot partition is mounted as a boot partition file system by the bootloader program, and the encrypted data of the operating system kernel image and the encrypted data of the temporary root file system image are read from the boot partition file system.

[0104] S430: Call the first driver to decrypt the encrypted data of the operating system kernel image to obtain the operating system kernel image, and decrypt the encrypted data of the temporary root file system image to obtain the temporary root file system image.

[0105] Mounting refers to connecting a file system to a specific directory on a Linux file system, making the files and directories in that file system accessible and usable within the Linux system.

[0106] During the process of the bootloader program mounting the boot partition as a boot partition file system, the bootloader program reads the encrypted data of the operating system kernel image and the encrypted data of the temporary root file system image from the boot partition, and calls the first driver to decrypt the encrypted data. The decryption process of the encrypted data of the operating system kernel image and the encrypted data of the temporary root file system image is performed in real time when the boot partition reads the encrypted data.

[0107] In summary, when the operating system starts up, that is, after the hardware is powered on, the firmware can find and load the bootloader program. The bootloader program can read the data in the boot partition (including the Linux kernel image and the temporary root file system image initrd.img). At this time, the data is in encrypted form. During the reading process, the first driver can be called in real time to decrypt the read data to obtain the plaintext Linux kernel image and root file system image, so as to complete the subsequent loading and startup of the operating system kernel. The temporary root file system is loaded into memory and mounted as a memory file system. At this time, the Linux operating system begins to run.

[0108] The bootloader program in this embodiment can obtain the encrypted data of the operating system kernel image and the temporary root file system image, and decrypt the encrypted data to obtain the corresponding plaintext image data, so that the operating system kernel and the temporary root file system can be loaded and used, thereby realizing the normal startup and operation of the operating system.

[0109] In one embodiment of this example, after obtaining the operating system kernel image and the temporary root file system image through the bootloader program, the following steps are also included:

[0110] S510. Load the temporary root file system image into the storage and mount it as a memory file system type so that the operating system can access and use the systemd program in the temporary root file system image to start programs and / or components in the operating system through the memory file system type.

[0111] In this implementation, the temporary root file system image is loaded into memory. At this time, the operating system will mount it as a memory file system type, indicating that the files and directories in the temporary root file system image can be accessed and used like files and directories in memory.

[0112] Once the temporary root filesystem image is loaded into memory and mounted as a memory filesystem type, the operating system runs the systemd program. systemd then proceeds to start other programs or components.

[0113] Other programs or components refer to various services, processes, and applications in the operating system, such as network services, file system services, user interface services, database services, etc.

[0114] By mounting a temporary root filesystem image as a memory filesystem type, the operating system can use the systemd program within it to start other programs and components within the operating system. systemd is a system initialization and system manager used to start and manage various services and processes within the operating system.

[0115] In summary, the bootloader program can read the encrypted data of the temporary root file system image from the mounted boot partition file system, and in the process, it calls the first driver in real time to decrypt the temporary root file system image, and then loads the temporary root file system image into memory (storage) and mounts it as a memory file system type.

[0116] In this embodiment, the operating system can load and mount the temporary root file system image, and use the systemd program in the temporary root file system image to start and manage the programs and components in the operating system, which is beneficial to the normal operation of the operating system and provides various functions and services.

[0117] In one embodiment of this invention, the encrypted data of the boot partition and the root partition is decrypted using a hardware encryption card, including the following steps:

[0118] S610. Install the second driver and the dm-crypt kernel module in the operating system. The dm-crypt kernel module is used to call the hardware encryption card to decrypt the encrypted data in the boot partition and the root partition.

[0119] S620. Create a root partition encrypted volume device in the root partition and a boot partition encrypted volume device in the boot partition.

[0120] S630. Mount the root partition encrypted volume device as the root partition file system so that the operating system can access and use the systemd program in the root partition file system to start programs and / or components in the operating system.

[0121] S640: Read the encrypted data of the root partition, and decrypt the encrypted data of the root partition by calling the second driver through the root partition encrypted volume device.

[0122] In this embodiment, the operating system switches the root file system from the temporary root file system in memory to the root partition file system. During the process of switching the root file system from the temporary root file system in memory to the root partition file system, the operating system reads the encrypted data of the root partition and decrypts the encrypted data of the root partition in real time by calling the second driver through the root partition encrypted volume device.

[0123] During the execution of systemd programs in the root partition file system, the operating system accesses and uses systemd programs in the root partition file system to start programs and / or components in the operating system.

[0124] It should be noted that in subsequent processes, when reading the root partition file system, the root partition encrypted volume device will invoke the second driver in real time to decrypt the root partition data using a hardware encryption card; when writing data to the root partition file system, the root partition encrypted volume device will invoke the second driver in real time to encrypt the root partition data using a hardware encryption card. Similarly, in subsequent processes, when reading the boot partition file system, the boot partition encrypted volume device will invoke the second driver in real time to decrypt the boot partition data using a hardware encryption card; and when writing data to the boot partition file system, the boot partition encrypted volume device will invoke the second driver in real time to encrypt the boot partition data using a hardware encryption card.

[0125] S650: Mount the boot partition encrypted volume device as the boot partition file system, read the encrypted data of the boot partition, and call the second driver through the boot partition encrypted volume device to decrypt the encrypted data of the boot partition.

[0126] In summary, after the operating system boots, encrypted volume devices (boot partition encrypted volume device and root partition encrypted volume device) can be created based on the partition sizes of the boot partition and root partition created during operating system installation. These devices can then be mounted with the file system type formatted during operating system installation. Real-time encryption and decryption of data during reading and writing to the boot partition and root partition can then be achieved through the encrypted volume devices. Subsequently, the operating system boot process can switch the current root directory of the system from the root directory of the temporary root file system to the root directory corresponding to the root partition file system after the root partition is mounted, and continue to complete the subsequent boot process.

[0127] In this embodiment, the encrypted data in the boot partition and root partition is decrypted into plaintext data, which can be read and used normally by the operating system. The operating system can then obtain the correct data and start and run the programs and components therein. Since the decryption operation requires a hardware encryption card, the security and integrity of the data can be effectively ensured.

[0128] In summary, the implementation process of this embodiment may include a bootloader stage and an initrd stage.

[0129] Figure 4 The diagram shows the structure of the bootloader stage. In this embodiment, the bootloader stage includes finding and reading the Linux kernel image and the temporary root file system image initrd.img from the boot partition, and loading the Linux kernel image and the temporary root file system image initrd.img into memory (storage), thus completing the booting and startup of the operating system.

[0130] In this embodiment, the data in the boot partition is written to the boot partition in encrypted form by a hardware encryption card during operating system installation. Therefore, the data in the boot partition needs to be decrypted during the bootloader stage in order to be correctly identified and loaded for execution.

[0131] Since the operating system has not yet been booted and started during the bootloader stage, and the hardware and software interrupt mechanisms have not yet been activated, it is impossible to implement the driver program for the hardware encryption card based on the device driver framework of the Linux operating system. This embodiment creatively breaks through the limitations of implementing the hardware encryption card driver 1 (first driver program) based on the bootloader framework, and introduces an encryption and decryption layer. Through the encryption and decryption layer, the hardware encryption card is transparently driven to complete the function of encrypting and decrypting boot partition data.

[0132] Specifically, an encryption / decryption layer is implemented and added to the bootloader program. During the bootloader's booting and system loading processes, when the boot partition (encrypted data) needs to be read, this access is done through the encryption / decryption layer. Each time encrypted data is read, the encryption / decryption layer calls the data decryption interface of Driver 1 (the first driver program), decrypts the data via a hardware encryption card, and then returns the decrypted data to the caller. If the bootloader stage needs to write data to the boot partition, the bootloader program first writes plaintext data. This plaintext data is then encrypted via the encryption / decryption layer by calling the data encryption interface of Driver 1 (the first driver program) and the hardware encryption card before being written to the boot partition. The entire encryption / decryption process is transparent to the bootloader's booting and system loading process. The data in the boot partition includes critical data such as the kernel, file system image, and system configuration. All data exists in encrypted form. Newly generated and modified data are dynamically and in real-time encrypted / decrypted by the encryption / decryption layer. The encryption / decryption algorithm and key management scheme can be configured according to user requirements.

[0133] Figure 5The diagram illustrates the structure of the initrd stage, which refers to the process where the Linux operating system kernel has been loaded and is running, the temporary root file system image is decompressed and mounted as a memory file system, and the root partition file system and boot partition file system are subsequently mounted.

[0134] In this embodiment, during the initrd stage, the disk encryption engine can create an encrypted volume device based on the device where the root partition and the boot partition are located and the partition size, according to the system disk partitioning situation at startup.

[0135] The encrypted volume device is a logical block device primarily used by Driver 2 (the second driver program) to call the hardware encryption card to perform data encryption and decryption operations. Because it appears externally as a logical block device, it can be formatted and mounted as both the root partition file system and the boot partition file system. Since the Linux kernel is loaded and the Linux device driver framework is activated at this stage, and Hardware Encryption Card Driver 2 (the second driver program) is implemented and runs based on this framework, the encryption and decryption logic or algorithm called by Driver 2 (the second driver program) should be consistent with the encryption and decryption logic or algorithm used in the bootloader stage.

[0136] Any subsequent read / write operations on the root partition file system and the boot partition file system will be performed through the encrypted volume device where they reside. The hardware encryption card will be called by driver 2 (the second driver program) to encrypt and decrypt the data. This not only ensures that the system and data are completely encrypted, but also enables the file system and its applications to be unaware of the encryption and decryption operations, resulting in a low degree of coupling.

[0137] In summary, the embodiments of this application have the following effects:

[0138] 1. The first driver is designed based on the bootloader framework. It has the ability to call the hardware encryption card to encrypt and decrypt data during the bootloader stage. This allows key software and configuration data such as the operating system kernel image and temporary root file system image in the boot partition to exist in encrypted form. It can also effectively ensure that data that may change during the boot process can also be saved to the disk in encrypted form. Compared with the method of simply saving and verifying hash values, it greatly improves the security of data and system.

[0139] 2. An encryption / decryption layer is introduced in the bootloader. When the bootloader reads or writes data to the boot partition on the disk, all data passes through this layer, which performs encryption and decryption processing in real time. This approach eliminates the need to read the entire boot partition data into memory for encryption and decryption, significantly reducing memory usage and improving processing efficiency. Furthermore, the specific encryption and decryption process is transparent to those above the encryption / decryption layer and does not impact the bootloader's boot and loading workflow. In addition, processing at the bootloader stage reduces restrictions on boot firmware or disk partition formats, providing good support for MBR and GPT partition formats, traditional BIOS boot methods, and UEFI boot methods.

[0140] 3. During the initrd stage of the operating system startup, a disk encryption and decryption engine is introduced to create encrypted volume devices for the disk boot partition and the disk root partition respectively. Through the layered design of the file system, encrypted volume device and underlying disk, the hardware encryption card driver 2 software and driver 1 software are consistent in encryption and decryption operation logic or algorithm. This not only ensures the normal startup of the system based on disk encrypted data, but also enables the encrypted storage of data generated in real time during operation.

[0141] 4. During operating system installation, after creating disk partitions, create encrypted volume devices for each partition, then format the file system on the encrypted volume device before proceeding with the system installation. This method enables real-time data encryption during system installation, eliminating the need to encrypt and decrypt the entire partition. It requires minimal modification to the overall system installation process and has minimal impact on installation efficiency.

[0142] Example 2:

[0143] In this embodiment, the encryption method for the root partition can be designed based on the LUKS framework. That is, the boot partition still uses the scheme in Embodiment 1, while the root partition encryption is implemented by adapting to the hardware encryption card algorithm supported by LUKS (Linux Unified Key Settings). This embodiment introduces an additional LUKS disk header format and adapts the processes and supporting tools for scenarios where it cannot be used.

[0144] Example 3:

[0145] In this embodiment, the initrd stage of the operating system startup only mounts the root partition. After the operating system switches to the real root file system, the boot partition is mounted by adding a systemd service. The relevant process will not be described in detail here.

[0146] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0147] This embodiment also provides a data encryption / decryption device based on a hardware encryption card, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0148] A data encryption / decryption device based on a hardware encryption card according to an embodiment of the present invention includes:

[0149] The encryption module is used to create a boot partition and a root partition on the installation disk during the operating system installation process of an electronic device, and to encrypt the data in the boot partition and the root partition through a hardware encryption card. After the operating system installation is completed, the data in the boot partition and the root partition is encrypted data.

[0150] The operating system kernel execution module is used to query and load the bootloader program through the firmware during the operating system startup process, obtain the operating system kernel image and temporary root file system image through the bootloader program, load the operating system kernel image into the memory and run it to run the operating system kernel in the memory.

[0151] The decryption module is used to decrypt encrypted data in the boot partition and root partition via a hardware encryption card after the operating system kernel is running.

[0152] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0153] Embodiments of the present invention also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

[0154] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0155] Embodiments of the present invention also provide an electronic device, comprising:

[0156] The aforementioned data encryption and decryption device based on a hardware encryption card;

[0157] The memory is configured to store instructions; and

[0158] The processor is configured to retrieve instructions from memory and, when executing instructions, to implement the aforementioned data encryption and decryption methods based on a hardware encryption card.

[0159] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0160] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0161] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0162] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A data encryption / decryption method based on a hardware encryption card, characterized in that, Applied to an electronic device, the electronic device including an installation disk and a memory, the memory storing firmware, the method includes: During the operating system installation process of the electronic device, a boot partition and a root partition are created on the installation disk; The data in the boot partition and the root partition are encrypted using a hardware encryption card. After the operating system is installed, the data in the boot partition and the root partition is encrypted data. During the operating system startup process, the firmware queries and loads the bootloader program, and the bootloader program calls the hardware encryption card to read and decrypt the operating system kernel image and temporary root file system image from the boot partition. The operating system kernel image is loaded into the memory and run to run the operating system kernel in the memory; After the operating system kernel runs, the encrypted data of the boot partition and the root partition is decrypted through the hardware encryption card; The step of encrypting the data in the boot partition and the root partition using a hardware encryption card includes: A second driver and a dm-crypt kernel module are installed in the operating system, wherein the dm-crypt kernel module is used to call the hardware encryption card to encrypt the data in the boot partition and the root partition; Create a root partition encrypted volume device in the root partition, and create a boot partition encrypted volume device in the boot partition; The root partition encrypted volume device is formatted to obtain the root partition file system, and the boot partition encrypted volume device is formatted to obtain the boot partition file system; The second driver invokes the hardware encryption card to encrypt data written from the boot partition to the boot partition file system, and also encrypts data written from the root partition to the root partition file system; The step of encrypting data written from the boot partition to the boot partition file system by calling the hardware encryption card through the second driver, and encrypting data written from the root partition to the root partition file system, includes: All file directories of the root partition are written to the root partition file system, and all file directories of the boot partition are written to the boot partition file system. During the process of writing all file directories of the root partition to the root partition file system, all file directories of the root partition pass through the root partition encrypted volume device. During the process of writing all file directories of the boot partition to the boot partition file system, all file directories of the boot partition pass through the boot partition encrypted volume device. When all file directories of the root partition pass through the root partition encryption volume device, the second driver calls the hardware encryption card to encrypt all file directories of the root partition; When all file directories of the boot partition pass through the boot partition encryption volume device, the second driver calls the hardware encryption card to encrypt all file directories of the boot partition.

2. The method according to claim 1, characterized in that, The process of obtaining the operating system kernel image and temporary root file system image through the bootloader program includes: The bootloader program loads the first driver and queries the boot partition; The bootloader program mounts the boot partition as a boot partition file system and reads the encrypted data of the operating system kernel image and the encrypted data of the temporary root file system image from the boot partition file system. The first driver is invoked to decrypt the encrypted data of the operating system kernel image to obtain the operating system kernel image, and the encrypted data of the temporary root file system image is decrypted to obtain the temporary root file system image.

3. The method according to claim 1, characterized in that, After obtaining the operating system kernel image and temporary root file system image through the bootloader program, the process further includes: The temporary root file system image is loaded into the storage and mounted as a memory file system type, so that the operating system can access and use the systemd program in the temporary root file system image to start programs and / or components in the operating system through the memory file system type.

4. The method according to claim 1, characterized in that, The step of decrypting the encrypted data in the boot partition and the root partition using the hardware encryption card includes: A second driver and a dm-crypt kernel module are installed in the operating system, wherein the dm-crypt kernel module is used to call the hardware encryption card to decrypt the ciphertext data of the boot partition and the root partition; Create a root partition encrypted volume device in the root partition, and create a boot partition encrypted volume device in the boot partition; The root partition encrypted volume device is mounted as the root partition file system, so that the operating system can access and use the systemd program in the root partition file system to start programs and / or components in the operating system; Read the encrypted data of the root partition, and decrypt the encrypted data of the root partition by calling the second driver through the root partition encrypted volume device; The boot partition encrypted volume device is mounted as a boot partition file system, and the encrypted data of the boot partition is read. The second driver is then called through the boot partition encrypted volume device to decrypt the encrypted data of the boot partition.

5. The method according to claim 1, characterized in that, The bootloader program includes an encryption / decryption module, which drives the hardware encryption card to encrypt and decrypt data in the boot partition.

6. A data encryption / decryption device based on a hardware encryption card, characterized in that, Performing the method as described in claim 1 includes: An encryption module is used to create a boot partition and a root partition on the installation disk during the operating system installation process of an electronic device, and to encrypt the data in the boot partition and the root partition using a hardware encryption card. After the operating system installation is completed, the data in the boot partition and the root partition is encrypted data. The operating system kernel execution module is used to query and load the bootloader program through the firmware during the boot process of the operating system, obtain the operating system kernel image and the temporary root file system image through the bootloader program, load the operating system kernel image into the memory and run it, so as to run the operating system kernel in the memory; The decryption module is used to decrypt the encrypted data of the boot partition and the root partition through the hardware encryption card after the operating system kernel is running.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program is configured to perform the method described in any one of claims 1 to 5 when executed.

8. An electronic device, characterized in that, include: The apparatus according to claim 6; The memory is configured to store instructions; as well as The processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the data encryption / decryption method based on a hardware encryption card according to any one of claims 1 to 5.

Images