Memory access method and server
By encrypting the key area of the memory when the operating system is initialized and decrypting and obtaining the encryption password when needed, the double-layer encryption protection of memory access is achieved, the problem of information leakage risk is solved and the security of memory access is improved.
Patent Information
- Application Number
- CN202411134083.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-16
- Publication Date
- 2025-01-03
AI Technical Summary
The risk of information leakage increases, and malware can capture sensitive data from memory, affecting data security. It is difficult for the prior art to effectively improve the security of memory access.
During the initialization of the operating system, the key area of the memory is encrypted using the key, and the target area is protected through a double-layer encryption mechanism. After receiving the processing request, decryption and obtaining the encrypted password to access the target area, ensuring that the open source application is responsible for sensitive information Secure access.
The dual-layer encryption mechanism effectively protects the sensitive information of the memory, reduces the risk of encryption password leakage, improves the security of memory access, and does not require adaptation and modification of open source applications, reducing maintenance workload.
Smart Images
Figure CN119248676A_ABST
Abstract
Description
Technical Field
[0001] The embodiments of the present application relate to the field of computer technology, and in particular, to a memory access method and a server. Background Art
[0002] In the era of rapid development of information technology, the risk of information leakage is increasing. Some malicious software can capture sensitive data from the memory, seriously affecting the security of the data. Therefore, how to improve the security of memory access is crucial. Summary of the invention
[0003] Embodiments of the present application provide a memory access method and a server to improve the security of memory access.
[0004] On the one hand, an embodiment of the present application provides a memory access method, applied to a server, the method comprising:
[0005] During the initialization of the operating system, a key area of the memory is encrypted using a key, the key area of the memory stores an encryption password of a target area, and the target area of the memory is encrypted using the encryption password, and the target area of the memory is used to store sensitive information of an open source application;
[0006] receiving a processing request of an open source application, the processing request being used to access a target area of a memory;
[0007] In response to the processing request, decrypt the key area of the memory using the key to obtain an encrypted password corresponding to the target area;
[0008] Based on the encrypted password, the target area is decrypted to access the target area.
[0009] In the above scheme, an encryption password is used to encrypt the target area of the memory storing sensitive information of the open source application, and the encryption password is encrypted and stored using a key, thereby protecting the target area with double encryption; after receiving a processing request from the open source application, the key area of the memory is decrypted to obtain the encryption password, and the target area is decrypted based on the encryption password, so that the open source application can access the decrypted target area, making the encryption password invisible to the open source application, and being able to effectively protect the encryption password and the target area, thereby effectively protecting the sensitive information of the open source application, improving the security of memory access, and eliminating the need to adapt and modify the open source application, thereby reducing the maintenance workload.
[0010] In one implementation, the using the key to decrypt the key area of the memory to obtain an encryption password corresponding to the target area includes:
[0011] The key area of the memory is decrypted according to the local working key to obtain the encrypted password.
[0012] In the above scheme, the working key is used to encrypt and decrypt the key area of the memory, which can effectively protect the encryption password and improve the security of memory access.
[0013] In one implementation, obtaining the encrypted password according to the local master key includes:
[0014] The encrypted working key is decrypted based on the master key to obtain the working key; the working key is used to encrypt the key area of the memory.
[0015] In the above scheme, the two-layer key and segmented recording method can effectively improve the security of the encryption password, reduce the risk of leakage of the encryption password, and thus improve the security of memory access.
[0016] In one implementation, encrypting a key area of a memory using a key includes:
[0017] Generate the encryption password, the working key and the master key;
[0018] The encrypted password is stored in the key area, and the key area is encrypted using the working key; and the working key is encrypted using the master key.
[0019] In the above scheme, the encryption password is encrypted by the working key, and the working key is encrypted by the master key to achieve secure storage of the encryption password.
[0020] In one implementation, the method further includes:
[0021] The encrypted master key is decrypted based on the root key to obtain the master key; the root key is used to encrypt the master key.
[0022] In the above scheme, the encryption password is encrypted three times based on the root key, the working key and the master key, which can further improve the security of the encryption password.
[0023] In one implementation, the method further includes:
[0024] generating the root key;
[0025] Using the root key, the master key is encrypted.
[0026] In the above scheme, the master key is encrypted by the root key to achieve secure storage of the encrypted password.
[0027] In one implementation, the target area includes multiple sub-areas, and different sub-areas are encrypted with different encryption codes.
[0028] In the above solution, different encryption passwords are set for different sub-areas of the target area, which can effectively improve the security of the encryption password.
[0029] In one implementation, the processing request is used to access a target sub-region of a memory; and the decrypting the key region of the memory to obtain an encryption password corresponding to the target region includes:
[0030] According to the target identifier corresponding to the target sub-area, the encrypted working key is decrypted based on the master key to obtain the target working key corresponding to the target identifier;
[0031] The key area of the memory is decrypted based on the target working key to obtain an encryption password corresponding to the target sub-area.
[0032] In the above scheme, according to the target identifier corresponding to the processing request, the target working key corresponding to the target identifier is decrypted, and the key area of the memory is decrypted using the target working key to obtain the encryption password corresponding to the target sub-area, so that the encryption password can be obtained accurately and securely.
[0033] In one implementation, the memory includes a disk, and the method further includes:
[0034] Dividing the disk into the target area and the key area;
[0035] The disk is formatted; and the disk is mounted to a directory of the file system of the server.
[0036] In the above solution, the disk is divided into different areas, the disk is formatted and mounted to the file system directory to achieve initial configuration of the disk.
[0037] On the other hand, an embodiment of the present application provides a server, the server comprising an application, an encryption and decryption module, a key management module and a memory; wherein,
[0038] The key management module is used to encrypt the key area of the memory using the key during the initialization of the operating system, wherein the encryption password of the target area is stored in the key area of the memory;
[0039] The encryption and decryption module is used to encrypt the target area of the memory using the encryption password, the target area of the memory is used to store sensitive information of the open source application; and receive a processing request of the open source application, the processing request is used to access the target area of the memory;
[0040] The key management module is also used to, in response to the processing request, use the key to decrypt the key area of the memory to obtain an encrypted password corresponding to the target area;
[0041] The encryption and decryption module is further used to decrypt the target area based on the encryption password to access the target area.
[0042] In the above scheme, an encryption password is used to encrypt the target area of the memory storing sensitive information of the open source application, and the encryption password is encrypted and stored using a key, thereby protecting the target area with double encryption; after receiving a processing request from the open source application, the key area of the memory is decrypted to obtain the encryption password, and the target area is decrypted based on the encryption password, so that the open source application can access the decrypted target area, making the encryption password invisible to the open source application, and being able to effectively protect the encryption password and the target area, thereby effectively protecting the sensitive information of the open source application, improving the security of memory access, and eliminating the need to adapt and modify the open source application, thereby reducing the maintenance workload.
[0043] In one implementation, the encryption and decryption module is specifically used to:
[0044] Sending a decryption request to the key management module;
[0045] The key management module is used to decrypt the key area of the memory according to the local master key to obtain the encrypted password;
[0046] The encryption and decryption module is also used to receive the encrypted password returned by the key management module.
[0047] In the above solution, the encryption password is encrypted and decrypted by the key management module, so that the encryption password is invisible to the application program, which can effectively improve the security of memory access.
[0048] In one implementation, the key management module is specifically used to:
[0049] The encrypted working key is decrypted based on the master key to obtain the working key; the working key is used to encrypt the key area of the memory.
[0050] In the above scheme, the two-layer key and segmented recording method can effectively improve the security of the encryption password, reduce the risk of leakage of the encryption password, and thus improve the security of memory access.
[0051] In one implementation, the key management module is further used to:
[0052] Generate the encryption password, the working key and the master key;
[0053] The encrypted password is stored in the key area, and the key area is encrypted using the working key; and the working key is encrypted using the master key.
[0054] In the above scheme, the encryption password is encrypted by the working key, and the working key is encrypted by the master key to achieve secure storage of the encryption password.
[0055] In one implementation, the key management module is further used to:
[0056] The encrypted master key is decrypted based on the root key to obtain the master key; the root key is used to encrypt the master key.
[0057] In the above scheme, the encryption password is encrypted three times based on the root key, the working key and the master key, which can further improve the security of the encryption password.
[0058] In one implementation, the key management module is further used to:
[0059] generating the root key;
[0060] Using the root key, the master key is encrypted.
[0061] In the above scheme, the master key is encrypted by the root key to achieve secure storage of the encrypted password.
[0062] In one implementation, the target area includes multiple sub-areas, and different sub-areas are encrypted with different encryption codes.
[0063] In the above solution, different encryption passwords are set for different sub-areas of the target area, which can effectively improve the security of the encryption password.
[0064] In one implementation, the key management module is specifically used to:
[0065] According to the target identifier corresponding to the target sub-area, the encrypted working key is decrypted based on the master key to obtain the target working key corresponding to the target identifier;
[0066] The key area of the memory is decrypted based on the target working key to obtain an encryption password corresponding to the target sub-area.
[0067] In the above scheme, the target working key corresponding to the target identifier is decrypted according to the target identifier corresponding to the target sub-area, and the key area of the memory is decrypted using the target working key to obtain the encryption password corresponding to the target sub-area, so that the encryption password can be obtained accurately and securely.
[0068] In one implementation, the memory includes a disk, and the key management module is further used for:
[0069] Dividing the disk into the target area and the key area;
[0070] The disk is formatted; and the disk is mounted to a directory of the file system of the server.
[0071] In the above solution, the disk is divided into different areas, the disk is formatted and mounted to the file system directory to achieve initial configuration of the disk.
[0072] On the other hand, an embodiment of the present application provides a server, which includes a processing chip and a computer-readable storage medium; wherein the computer-readable storage medium stores computer-executable instructions; the processing chip executes the computer-executable instructions stored in the computer-readable storage medium to implement the method described above.
[0073] In the above scheme, an encryption password is used to encrypt the target area of the memory storing sensitive information of the open source application, and the encryption password is encrypted and stored using a key, thereby protecting the target area with double encryption; after receiving a processing request from the open source application, the key area of the memory is decrypted to obtain the encryption password, and the target area is decrypted based on the encryption password, so that the open source application can access the decrypted target area, making the encryption password invisible to the open source application, and being able to effectively protect the encryption password and the target area, thereby effectively protecting the sensitive information of the open source application, improving the security of memory access, and eliminating the need to adapt and modify the open source application, thereby reducing the maintenance workload.
[0074] On the other hand, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processing chip, they are used to implement the method as described in any one of the first aspects.
[0075] In the above scheme, an encryption password is used to encrypt the target area of the memory storing sensitive information of the open source application, and the encryption password is encrypted and stored using a key, thereby protecting the target area with double encryption; after receiving a processing request from the open source application, the key area of the memory is decrypted to obtain the encryption password, and the target area is decrypted based on the encryption password, so that the open source application can access the decrypted target area, making the encryption password invisible to the open source application, and being able to effectively protect the encryption password and the target area, thereby effectively protecting the sensitive information of the open source application, improving the security of memory access, and eliminating the need to adapt and modify the open source application, thereby reducing the maintenance workload.
[0076] On the other hand, an embodiment of the present application provides a computer program product, including a computer program, which implements the method provided in any embodiment of the above-mentioned embodiments of the present disclosure when the computer program is executed by a processing chip.
[0077] In the above scheme, the target area of the memory storing the sensitive information of the open source application is encrypted with an encryption password, and the encryption password is encrypted and stored with a key, so that the target area is protected by double encryption; after receiving the processing request of the open source application, the key area of the memory is decrypted to obtain the encryption password, and the target area is decrypted based on the encryption password, so that the open source application can access the decrypted target area, making the encryption password invisible to the open source application, and being able to effectively protect the encryption password and the target area, thereby effectively protecting the sensitive information of the open source application, improving the security of memory access, and no adaptation and modification of the open source application is required, reducing the maintenance workload.
[0078] In the memory access method and server provided in the embodiments of the present application, an encryption password is used to encrypt a target area of the memory storing sensitive information of an open source application, and the encryption password is encrypted and stored using a key, thereby protecting the target area with double encryption; after receiving a processing request from the open source application, the key area of the memory is decrypted to obtain the encryption password, and the target area is decrypted based on the encryption password, so that the open source application can access the decrypted target area, making the encryption password invisible to the open source application, and being able to effectively protect the encryption password and the target area, thereby effectively protecting the sensitive information of the open source application, improving the security of memory access, and eliminating the need to adapt and modify the open source application, thereby reducing the maintenance workload. BRIEF DESCRIPTION OF THE DRAWINGS
[0079] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.
[0080] Figure 1 A schematic diagram of an application scenario provided in an embodiment of the present application;
[0081] Figure 2 A schematic diagram of another application scenario provided by an embodiment of the present application;
[0082] Figure 3 A flowchart of a memory access method provided in an embodiment of the present application;
[0083] Figure 4 A flowchart of another memory access method provided in an embodiment of the present application;
[0084] Figure 5 A flowchart of another memory access method provided in an embodiment of the present application;
[0085] Figure 6 A schematic diagram of the server initialization process provided in an embodiment of the present application. DETAILED DESCRIPTION
[0086] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the appended claims.
[0087] First, the terms involved in the embodiments of the present application are explained.
[0088] Nginx is an open source web server and reverse proxy server, often used to provide static file services.
[0089] Grafana is an open source visualization and data monitoring and analysis tool software that supports query, presentation, alarm, and browsing indicators.
[0090] Prometheus is an open source system monitoring and alerting toolkit software that helps monitor and send alerts about computer systems.
[0091] Kubernetes (K8s for short) is an open source containerized application for managing multiple hosts in a cloud platform. It allows users to deploy, expand, and manage containerized applications more conveniently, and implement load balancing, service discovery, and automatic elastic scaling in an automated way.
[0092] dm-crypto: The standard device-mapper encryption function provided by the Linux kernel is responsible for encryption and decryption of block devices.
[0093] An embodiment of the present application provides a memory access method to improve the security of memory access.
[0094] For ease of understanding, the following Figure 1 , the application scenarios involved in the embodiments of the present application are described.
[0095] Figure 1 A schematic diagram of an application scenario provided by an embodiment of the present application. Figure 1 The user space of the server may include multiple applications, the kernel space of the server may include an encryption and decryption module and a key management module, and the hardware of the server may include a memory.
[0096] The memory may include internal memory and / or external memory, and the external memory may include but is not limited to a hard disk, a floppy disk, an optical disk, a USB flash drive, etc. The memory may be divided into different areas, including but not limited to a target area and a key area, wherein the target area is used to store encrypted data and the key area is used to store passwords.
[0097] In one example, the memory may be a disk, which may include a common area, a target area and a key area. The common area is used to store unencrypted data, the target area is used to store encrypted data, and the key area is used to store encryption passwords, which may be used to encrypt and decrypt the target area.
[0098] The key management module is used to store keys and use the keys to encrypt and decrypt the key area of the memory.
[0099] Exemplarily, the key management module may be integrated with a key management center (KMC) or a trusted platform module (Trusted Platform Module, TPM).
[0100] The encryption and decryption module is used to encrypt and decrypt the target area of the memory using an encryption password.
[0101] Exemplarily, the encryption and decryption module may be implemented by a standard device-mapper encryption (dm-crypto) function provided by the server kernel.
[0102] Exemplarily, the key management module and the encryption / decryption module may communicate via an encryption / decryption interface, such as crypto-api.
[0103] Exemplarily, the encryption and decryption module may respond to a processing request of the application, obtain an encryption password through the key management module, and use the encryption password to decrypt the target area so that the application can access the decrypted target area.
[0104] The embodiment of the present application does not limit the specific type of the server. For example, the server may be a graphics processing unit (GPU) server or an artificial intelligence (AI) server.
[0105] It should be noted that the processing request of the application can be used to instruct the application to access the target area of the memory, and can also be used to instruct the file system to access the target area of the memory. Figure 2 , another application scenario involved in this application is described.
[0106] Figure 2 This is a schematic diagram of another application scenario provided by the embodiment of the present application. Figure 2 The user space of the server may include multiple applications, the kernel space of the server may include a file system, a decryption module and a key management module, and the hardware of the server may include a memory.
[0107] Many applications store sensitive information in files in the storage. For example, open source applications such as ngnix, grafana, promethues, and k8s store sensitive information such as authentication credentials in plain text in configuration files in the storage. The application passwords are recorded in plain text in the nginx configuration file nginx.conf and the prometheus configuration file prometheus.yml.
[0108] The file system can be used to access the storage in response to processing requests from application programs.
[0109] The memory may include a common area, a target area and a key area, wherein the common area is used to store unencrypted data, the target area is used to store encrypted data, such as sensitive information of an application, and the key area is used to store encryption passwords.
[0110] The key management module is used to store keys and use the keys to encrypt and decrypt the key area of the memory.
[0111] The encryption and decryption module is used to encrypt and decrypt the target area of the memory using an encryption password.
[0112] Exemplarily, the encryption and decryption module can respond to a processing request from an application. When the processing request indicates access to a target area of the memory, the encryption and decryption module obtains an encryption password through the key management module and uses the encryption password to decrypt the target area so that the file system can access the decrypted target area.
[0113] In one implementation, the encryption / decryption module may send a processing request to a block device driver, and access the memory through the block device driver.
[0114] Next, combine Figure 3 , the memory access method provided in the embodiment of the present application is described.
[0115] Figure 3 A memory access schematic diagram provided in an embodiment of the present application. The execution subject of the method is a server, or a processing chip set in the server. The following takes the execution subject of the method as an example to illustrate. Figure 3 In one possible implementation, the method may include:
[0116] S301. During the initialization of the operating system, a key area of the memory is encrypted using a key. The key area of the memory stores an encryption password for a target area. The target area of the memory is encrypted using the encryption password. The target area of the memory is used to store sensitive information of an open source application.
[0117] During the project development process, a large number of open source applications need to be used. The sensitive information of these open source applications, such as application passwords, is stored in the target area of the memory. Therefore, the encryption password can be used to encrypt the target area of the memory to protect the sensitive information of the open source application. The encryption password is stored in the key area of the memory, and there is still a risk of leakage. Furthermore, the key can be used to encrypt the key area of the memory, thereby doubly encrypting the sensitive information of the open source application.
[0118] Specifically, the key management module uses the key to encrypt the key area of the memory, and the encryption and decryption module uses the encryption password to encrypt the target area of the memory.
[0119] Exemplarily, storing the key in a key management module can effectively improve the security of the key.
[0120] S302: Obtain a processing request of an open source application, where the processing request is used to access a target area of a memory.
[0121] The open source application may send a processing request to the memory based on the needs of the application process or in response to a user's request. The processing request is used to indicate a target area of the memory to be accessed. Exemplarily, the processing request may include a write request or a read request.
[0122] Exemplarily, the storage may be a disk, and the target area may be a sector of the disk or a disk file.
[0123] Correspondingly, the encryption and decryption module obtains a processing request of the open source application, and according to the processing request, the encryption and decryption module can decrypt the target area.
[0124] S303, in response to the processing request, decrypt the key area of the memory to obtain an encryption password corresponding to the target area.
[0125] The encryption and decryption module can send a decryption request to the key management module in response to the processing request.
[0126] The key management module decrypts the key area of the memory, obtains the encryption code corresponding to the target area, and returns it to the encryption and decryption module. The key management module is used to encrypt and decrypt the key area of the memory, and the key area is used to store the encryption code.
[0127] Exemplarily, decrypting the key area of the memory to obtain the encryption password corresponding to the target area may include decrypting the key area of the memory according to a local working key to obtain the encryption password.
[0128] In this embodiment, the key area of the memory is encrypted and decrypted using the working key, which can effectively protect the encrypted password and improve the security of memory access.
[0129] To further improve security, the method may also include:
[0130] The encrypted working key is decrypted based on the master key to obtain the working key; the working key is used to encrypt the key area of the memory.
[0131] In this embodiment, the two-layer key and segmented recording method can effectively improve the security of the encryption password, reduce the risk of leakage of the encryption password, and thus improve the security of memory access.
[0132] Furthermore, the method may further include:
[0133] The encrypted master key is decrypted based on the root key to obtain the master key; the root key is used to encrypt the master key.
[0134] In this embodiment, the encryption password is encrypted three times based on the root key, the working key and the master key, which can further improve the security of the encryption password.
[0135] It should be noted that the server needs to partition and configure the disk in advance. In a possible implementation, the memory may include the disk, and the method further includes:
[0136] Divide the disk into a target area and a key area;
[0137] Format the disk; and mount the disk to a directory in the server file system.
[0138] Specifically, the key management module can divide the disk into an encryption area and a common area. The encryption area is used to store data that needs to be encrypted, and the common area is used to store data that does not need to be encrypted. The server needs to perform encryption and decryption on the encryption area, but does not perform encryption and decryption on the common area. The encryption area may include a target area and a key area, wherein the target area is used to store sensitive information of the open source application, and the key area is used to store the encryption password. The key management module formats the divided disk and mounts the disk to a directory of the server file system so that the server can access the disk.
[0139] Formatting the disk may include deleting all files and directories in the disk or disk area.
[0140] In this embodiment, the disk is divided into different areas, the disk is formatted and mounted to a file system directory to implement initialization configuration of the disk.
[0141] S304: Decrypt the target area based on the encryption password to allow the application to access the target area.
[0142] Specifically, after the encryption and decryption module obtains the encryption password through the key management module, it can decrypt the target area of the memory based on the encryption password, so that the open source application can only access the decrypted target area. The decryption process of the target area is invisible to the open source application, effectively preventing malicious open source applications from obtaining the encryption password during the process of accessing files. After the open source application completes the access, the target area can be encrypted to protect the sensitive information of the open source application.
[0143] In this embodiment, the open source application sends a processing request to the memory, and the processing request can be used to instruct the open source application to access the target area of the memory; the encryption and decryption module can obtain the processing request of the open source application, and decrypt the target area according to the processing request to enable the open source application to access the target area.
[0144] In other embodiments, the open source application may send a processing request to the file system, and the processing request may be used to instruct the file system to access a target area of the memory; the encryption and decryption module may obtain the processing request of the open source application, and decrypt the target area according to the processing request, so that the file system can access the target area.
[0145] In the memory access method provided in this embodiment, an encryption password is used to encrypt the target area of the memory storing sensitive information of the open source application, and the encryption password is encrypted and stored using a key, thereby using double-layer encryption to protect the sensitive information of the open source application; after receiving a processing request from the open source application, the key area of the memory is decrypted to obtain the encryption password, and the target area is decrypted based on the encryption password, so that the open source application can access the decrypted target area, making the encryption password invisible to the open source application, and being able to effectively protect the encryption password and the target area, thereby effectively protecting the sensitive information of the open source application, improving the security of memory access, and eliminating the need to adapt and modify the open source application, thereby reducing the maintenance workload.
[0146] Next, combine Figure 4 , the memory access method provided in the embodiment of the present application is further explained.
[0147] Figure 4 This is a flow chart of another memory access method provided by an embodiment of the present application. The execution subject of the method can be a server or a processing chip set in the server. The following is an example of the execution subject being a server. Figure 4 In one possible implementation, the method may include:
[0148] S401: Obtain a processing request of an open source application, where the processing request is used to access a target area of a memory.
[0149] It should be noted that the specific implementation method of S401 can refer to S301 and will not be repeated here.
[0150] S402: Send a decryption request to the key management module so that the key management module obtains the encryption password according to the local master key.
[0151] In response to the processing request, the encryption and decryption module sends a decryption request to the key management module. The decryption request can be used to instruct the key management module to obtain the encryption password.
[0152] Correspondingly, the key management module receives the decryption request and obtains the encryption password according to the local master key of the key management module.
[0153] Exemplarily, the key management module may decrypt the key area of the memory according to the local master key to obtain the encrypted password.
[0154] In a possible implementation, the key management module obtains the encryption password according to the local master key, which may include:
[0155] Decrypting the encrypted working key based on the master key to obtain the working key; the working key is used to encrypt the key area of the memory;
[0156] The key area of the memory is decrypted based on the working key to obtain the encrypted password.
[0157] Specifically, the key management module obtains the local master key according to the decryption request, and uses the master key to decrypt the encrypted working key to obtain the working key; and uses the working key to decrypt the key area of the memory to obtain the encrypted password.
[0158] In this embodiment, the key management module uses the working key and the master key to perform secondary encryption on the encryption password, which can effectively improve the security of the encryption password and reduce the risk of leakage of the encryption password, thereby improving the security of memory access.
[0159] It should be noted that the key management module needs to generate the required encryption password, working key and master key in advance. In a possible implementation, the method further includes:
[0160] Generate encryption passwords, working keys, and master keys;
[0161] The encrypted password is stored in the key area, and the key area is encrypted using the working key; and the working key is encrypted using the master key.
[0162] Exemplarily, the key management module generates an encryption password, a working key, and a master key, which may include: randomly generating an encryption password, a working key, and a master key.
[0163] In this embodiment, the key management module can save the generated encryption password in the key area of the memory, encrypt the key area with the working key, and encrypt the working key with the master key. Through two layers of keys and segmented records, the encryption password can be effectively encrypted to improve the security of the encryption password.
[0164] Exemplarily, the working key may be stored in a key management module.
[0165] In this embodiment, the encryption password is encrypted by the working key, and the working key is encrypted by the master key, so as to achieve secure storage of the encryption password.
[0166] In this embodiment, the key management module encrypts and decrypts the working key based on the master key, and encrypts the key area of the memory based on the working key.
[0167] In other embodiments, the key management module may also encrypt and decrypt the master key based on the root key. The method further includes:
[0168] The encrypted master key is decrypted based on the root key to obtain the master key; the root key is used to encrypt the master key.
[0169] In this embodiment, the encryption password is encrypted three times based on the root key, the working key and the master key, which can further improve the security of the encryption password.
[0170] The key management module needs to generate the required root key in advance, and the method also includes:
[0171] Generate root key;
[0172] Using the root key, encrypt the master key.
[0173] Exemplarily, the key management module generating the root key may include randomly generating the root key. The root key may be stored in the key management module.
[0174] In this embodiment, the key management module uses the root key to encrypt the master key to achieve secure storage of the encrypted password.
[0175] S403: Receive the encrypted password returned by the key management module.
[0176] After the key management module obtains the encrypted password, it sends the encrypted password to the encryption and decryption module.
[0177] Correspondingly, the encryption and decryption module receives the encryption password.
[0178] S404: Decrypt the target area based on the encryption password, so that the open source application can access the target area.
[0179] It should be noted that the specific implementation method of S404 can refer to S303 and will not be repeated here.
[0180] In the memory access method provided in this embodiment, a processing request of an open source application can be obtained, and a decryption request can be sent to a key management module so that the key management module decrypts the key area of the disk storage encryption password, and obtains the encryption password from the key management module to protect the encryption password; the target area is decrypted based on the encryption password so that the open source application can access the decrypted memory target area, thereby effectively improving the security of memory access.
[0181] Based on the above embodiment, the target area of the memory may include multiple sub-areas, and different sub-areas are encrypted by different encryption passwords, which can further improve the data security of the target area of the memory. Figure 5 , the memory access method provided in this application is further explained.
[0182] Figure 5 Another memory access method provided by the embodiment of the present application. The execution subject of the method can be a server or a processing chip set in the server. The following is only an example of the execution subject being the encryption and decryption module of the server. Figure 5 In one possible implementation, the method may include:
[0183] S501: Obtain a processing request of an open source application, where the processing request is used to access a target sub-region of a memory.
[0184] It should be noted that the specific implementation method of S501 can refer to S301 and will not be repeated here.
[0185] S502: Send a decryption request to the key management module, where the decryption request includes a target identifier corresponding to the target sub-region, so that the key management module obtains an encryption password corresponding to the target region according to a local master key.
[0186] In response to the processing request, the encryption and decryption module sends a decryption request to the key management module, the decryption request including the target identifier corresponding to the target sub-area. The decryption request may include instructing the key management module to obtain the encryption password corresponding to the target area.
[0187] Exemplarily, the target identifier may be generated when the key management module generates the key corresponding to the target sub-region. The encryption / decryption module obtains the target identifier corresponding to the target sub-region and sends a decryption request to the key management module.
[0188] Correspondingly, the key management module receives the decryption request and obtains the encryption password corresponding to the target area according to the local master key of the key management module.
[0189] Exemplarily, the key management module may decrypt the key area of the memory according to the local master key to obtain the encrypted password.
[0190] In this embodiment, different encryption passwords are set for different sub-areas of the target area, which can effectively improve the security of the encryption passwords.
[0191] It should be noted that different encryption passwords may correspond to different working keys or the same working key. Here, different encryption passwords may correspond to different working keys as an example. In a possible implementation, the key management module obtains the encryption password according to the local master key, which may include:
[0192] According to the target identifier corresponding to the target sub-area, the encrypted working key is decrypted based on the master key to obtain the target working key corresponding to the target identifier;
[0193] The key area of the memory is decrypted based on the target working key to obtain the encryption password corresponding to the target sub-area.
[0194] Specifically, the key management module obtains the local master key according to the decryption request, and uses the master key to decrypt the encrypted working key to obtain the target working key; and uses the working key to decrypt the key area of the memory to obtain the encrypted password.
[0195] Exemplarily, the working key may be stored in the key management module, wherein different working keys may be stored in the same area of the key management module or in different areas of the key management module and encrypted by the master key.
[0196] It should be noted that the key management module needs to generate the required encryption password, working key and master key in advance. In a possible implementation, the method further includes:
[0197] Generate a master key and the encryption password and target working key corresponding to the target area;
[0198] The encrypted password is stored in the key area, and the key area is encrypted using the working key; and the working key is encrypted using the master key.
[0199] Specifically, the key management module generates a master key, and generates corresponding encryption passwords, working keys and identifiers for each sub-area of the target area of the memory. The key management module stores each encryption password in each sub-area of the key area, and uses the working keys corresponding to each encryption password to encrypt each sub-area of the key area; and uses the master key to encrypt each working key. The key management module can also return the identifiers of each sub-area of the target area to the encryption and decryption module, so that the encryption and decryption module can obtain the corresponding target identifier according to the processing request of the open source application.
[0200] Exemplarily, the key management module generates the encryption password, the working key, and the master key, which may include: randomly generating the encryption password, the working key, and the master key.
[0201] Exemplarily, the working key may be stored in a key management module, wherein different working keys may be stored in different areas of the key management module or in the same area of the key management module.
[0202] In this embodiment, according to the target identifier corresponding to the target area, the target working key corresponding to the target identifier is decrypted, and the key area of the memory is decrypted using the target working key to obtain the encryption password corresponding to the target area, so that the encryption password can be obtained accurately and securely.
[0203] In this embodiment, the key management module encrypts and decrypts the working key based on the master key, and encrypts the key area of the memory based on the working key.
[0204] In other embodiments, the key management module can also generate a root key, encrypt and decrypt the master key based on the root key, encrypt and decrypt the working key based on the master key, and encrypt the key area of the memory based on the working key, which can further improve the security of the encryption password.
[0205] Figure 6 The schematic diagram of the process of server initialization provided in the embodiment of the present application. The execution subject of the method is Figure 1 , Figure 2 The server shown. Figure 6 As shown, before obtaining the processing request of the open source application, the method may include:
[0206] S601, generate encryption password, working key, master key and root key;
[0207] S602, saving the encrypted password to the key area of the disk;
[0208] S603, encrypting the key area using the working key;
[0209] S604, using the master key to encrypt and save the working key;
[0210] S605, using the root key to encrypt and save the master key;
[0211] S606, configuring the target area of the disk to be encrypted using the encryption password;
[0212] S607, formatting the disk;
[0213] S608: Mount the disk to the file system directory of the server.
[0214] Among them, after the key management module divides the disk into a target area and a key area, it encrypts the encryption password and saves it in the key area, and uses the encryption password to configure the target area as encrypted, that is, the target area needs to be decrypted using the encryption password before it can be accessed.
[0215] It should be noted that the specific implementation method of S601-S607 is as described above and will not be repeated here.
[0216] In the memory access method provided in this embodiment, the target area of the disk is configured as three-layer encryption and the disk is mounted to a file system directory, which can effectively improve the security of the target area of the disk.
[0217] The present application embodiment also provides a memory access device. The memory access device can be Figure 1 or Figure 2 The memory access device includes an application, an encryption and decryption module, a key management module and a memory; wherein,
[0218] The key management module is used to encrypt the key area of the memory using the key during the initialization of the operating system, wherein the encryption password of the target area is stored in the key area of the memory;
[0219] The encryption and decryption module is used to encrypt the target area of the memory using the encryption password, the target area of the memory is used to store sensitive information of the open source application; and receive a processing request of the open source application, the processing request is used to access the target area of the memory;
[0220] The key management module is also used to, in response to the processing request, use the key to decrypt the key area of the memory to obtain an encrypted password corresponding to the target area;
[0221] The encryption and decryption module is further used to decrypt the target area based on the encryption password to access the target area.
[0222] In one implementation, the encryption and decryption module is specifically used to:
[0223] Sending a decryption request to the key management module;
[0224] The key management module is used to decrypt the key area of the memory according to the local master key to obtain the encrypted password;
[0225] The encryption and decryption module is also used to receive the encrypted password returned by the key management module.
[0226] In one implementation, the key management module is specifically used to:
[0227] The encrypted working key is decrypted based on the master key to obtain the working key; the working key is used to encrypt the key area of the memory.
[0228] In one implementation, the key management module is further used to:
[0229] Generate the encryption password, the working key and the master key;
[0230] The encrypted password is stored in the key area, and the key area is encrypted using the working key; and the working key is encrypted using the master key.
[0231] In one implementation, the key management module is further used to:
[0232] The encrypted master key is decrypted based on the root key to obtain the master key; the root key is used to encrypt the master key.
[0233] In one implementation, the key management module is further used to:
[0234] generating the root key;
[0235] Using the root key, the master key is encrypted.
[0236] In one implementation, the target area includes multiple sub-areas, and different sub-areas are encrypted with different encryption codes.
[0237] In one implementation, the key management module is specifically used to:
[0238] According to the target identifier corresponding to the target sub-area, the encrypted working key is decrypted based on the master key to obtain the target working key corresponding to the target identifier;
[0239] The key area of the memory is decrypted based on the target working key to obtain an encryption password corresponding to the target sub-area.
[0240] In one implementation, the memory includes a disk, and the key management module is further used for:
[0241] Dividing the disk into the target area and the key area;
[0242] The disk is formatted; and the disk is mounted to a directory of the file system of the server.
[0243] The memory access device provided in this embodiment can be used to execute the memory access method shown in the above method embodiment. Its implementation principle and technical effects are similar and will not be described in detail here.
[0244] The embodiment of the present application further provides a server, the server comprising a processing chip and a computer-readable storage medium; wherein:
[0245] The computer-readable storage medium stores computer-executable instructions;
[0246] The processing chip executes the computer-executable instructions stored in the computer-readable storage medium to implement the method described above.
[0247] An embodiment of the present application also provides a computer-readable storage medium, in which computer execution instructions are stored. When the computer execution instructions are executed by a processing chip, they can be used to execute the memory access method shown in the above method embodiment. The implementation principle and technical effect are similar and will not be repeated here.
[0248] An embodiment of the present application also provides a computer program product, including a computer program, which implements the method provided in any embodiment of the above-mentioned embodiment of the present disclosure when the computer program is executed by a processing chip.
[0249] All or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned memory (storage medium) includes: read-only memory (English: read-only memory, abbreviated: ROM), RAM, flash memory, hard disk, solid state drive, magnetic tape (English: magnetic tape), floppy disk (English: floppy disk), optical disc (English: optical disc) and any combination thereof.
[0250] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable terminal device to generate a machine, so that the instructions executed by the processing unit of the computer or other programmable terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0251] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0252] These computer program instructions can also be loaded onto a computer or other programmable terminal device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0253] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the spirit and scope of the embodiments of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the embodiments of the present application are also intended to include these modifications and variations.
[0254] In the embodiments of the present application, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "include one..." do not exclude the existence of other identical elements in the process, method, article or device including the element. The term "or" and its variations may refer to "and / or". In the embodiments of the present application, the terms "first", "second", etc. are used to distinguish similar objects, and do not have to be used to describe a specific order or sequence. In the embodiments of the present application, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, A and / or B, which may represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship.
[0255] After considering the invention disclosed in the specification and practice, those skilled in the art will easily think of other embodiments of the present application. The embodiments of the present application are intended to cover any variation, use or adaptive change of the embodiments of the present application, which follows the general principles of the embodiments of the present application and includes common knowledge or conventional technical means in the technical field that are not disclosed in the embodiments of the present application.
Claims
1. A memory access method, characterized in that: Applied to a server; the method comprises: During the initialization of the operating system, a key area of the memory is encrypted using a key, the key area of the memory stores an encryption password of a target area, and the target area of the memory is encrypted using the encryption password, and the target area of the memory is used to store sensitive information of an open source application; receiving a processing request of an open source application, the processing request being used to access a target area of a memory; In response to the processing request, decrypt the key area of the memory using the key to obtain an encrypted password corresponding to the target area; Based on the encrypted password, the target area is decrypted to access the target area.
2. The method according to claim 1, characterized in that The step of using the key to decrypt the key area of the memory to obtain an encrypted password corresponding to the target area includes: The key area of the memory is decrypted according to the local working key to obtain the encrypted password.
3. The method according to claim 2, characterized in that The method further comprises: The encrypted working key is decrypted based on the master key to obtain the working key; the working key is used to encrypt the key area of the memory.
4. The method according to claim 3, characterized in that The method of using a key to encrypt a key area of the memory includes: Generate the encryption password, the working key and the master key; The encrypted password is stored in the key area, and the key area is encrypted using the working key; and the working key is encrypted using the master key.
5. The method according to claim 4, characterized in that The method further comprises: The encrypted master key is decrypted based on the root key to obtain the master key; the root key is used to encrypt the master key.
6. The method according to claim 5, characterized in that The method further comprises: generating the root key; The master key is encrypted based on the root key.
7. The method according to claim 3, characterized in that The target area includes multiple sub-areas, and different sub-areas are encrypted with different encryption codes.
8. The method according to claim 7, characterized in that The processing request is used to access a target sub-area of a memory; and the decrypting of a key area of the memory to obtain an encryption password corresponding to the target area includes: According to the target identifier corresponding to the target sub-area, the encrypted working key is decrypted based on the master key to obtain the target working key corresponding to the target identifier; The key area of the memory is decrypted based on the target working key to obtain an encryption password corresponding to the target sub-area.
9. The method according to any one of claims 1 to 8, characterized in that: The memory includes a disk, and the method further includes: Dividing the disk into the target area and the key area; The disk is formatted; and the disk is mounted to a directory of the file system of the server.
10. A server, characterized in that: The server includes a processing chip and a computer-readable storage medium; wherein, The computer-readable storage medium stores computer-executable instructions; The processing chip executes the computer-executable instructions stored in the computer-readable storage medium to implement the method according to any one of claims 1-9.