Secure disk encryption method and device, electronic equipment and storage medium
By running the disk encryption module and key management module in the operating system kernel space and using a trusted execution environment to perform key operations, the security risks exposed by keys in disk encryption are solved, and the security of disk encryption is improved.
Patent Information
- Application Number
- CN202411251098.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-06
- Publication Date
- 2025-02-14
AI Technical Summary
In the prior art, the decryption of the key during disk encryption is exposed to an untrusted environment, which poses a security risk and is difficult to improve the security of disk encryption.
By running the disk encryption module and key management module in the kernel space of the operating system, the key encryption and decryption of the key is used to ensure that the key plain text is not exposed to the operating system.
It effectively prevents applications in the operating system from stealing the key plaintext, improves the security of disk encryption, and ensures the security of keys.
Smart Images
Figure CN119442351A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a secure disk encryption method, device, electronic device and storage medium. Background Art
[0002] Disk encryption protects important data by encrypting the disk. Important data includes files and file systems on the disk. Disk encryption is to solve the problem of important data leakage caused by the loss of storage media. For example, if a laptop or mobile hard drive is lost, if disk encryption is enabled, the person who obtains the laptop or mobile hard drive will not be able to read the data stored in it.
[0003] When the related technology encrypts the disk, the key decryption is exposed in an untrusted environment, and the application in the operating system has the opportunity to steal the plaintext of the key, which poses a huge security risk.
[0004] Therefore, how to improve the security of disk encryption has become a technical problem that needs to be solved urgently in the industry. Summary of the invention
[0005] The present application provides a secure disk encryption method, device, electronic device and storage medium, which are used to solve the technical problem of how to improve the security of disk encryption.
[0006] The present application provides a secure disk encryption method, comprising: Mount the encrypted partition of the target disk; Calling a disk encryption module to read and write the encrypted partition of the target disk; Return the read and write operation results of the encrypted partition; Among them, the encrypted partition is encrypted and decrypted by the disk encryption module based on the key plaintext obtained from the key management module; the key management module is used to request the trusted execution environment to generate key ciphertext; request the trusted execution environment to decrypt the key ciphertext and generate the key plaintext; the disk encryption module and the key management module run in the kernel space of the operating system.
[0007] In some embodiments, the key ciphertext is generated based on the following steps: Sending a key creation request to the key management module; Calling the key management module to create a key based on the key creation request; The key management module is called to send a key encryption request to the trusted execution environment; the trusted execution environment encrypts the key based on the key encryption request, and sends the key ciphertext generated after encryption to the key management module.
[0008] In some embodiments, the key ciphertext is saved based on the following steps: Receiving the key ciphertext; The key ciphertext is stored in a non-encrypted partition of the target disk.
[0009] In some embodiments, the key plaintext is generated based on the following steps: Loading the key ciphertext from the non-encrypted partition of the target disk to the key management module; Calling the key management module to send a key decryption request to the trusted execution environment; The trusted execution environment encrypts the key ciphertext based on the key decryption request, and sends the key plaintext generated after decryption to the key management module.
[0010] In some embodiments, the encrypted partition is determined based on the following steps: Calling the disk encryption module to obtain the key plaintext from the key management module; The disk encryption module is called to encrypt a designated partition in the target disk based on the key plaintext to determine the encrypted partition.
[0011] In some embodiments, encrypting the specified partition in the target disk based on the key plaintext includes: The designated partition in the target disk is encrypted based on the national encryption algorithm and the key plaintext.
[0012] In some embodiments, the trusted execution environment is built based on a central processing unit or a secure processor.
[0013] The present application provides a secure disk encryption device, comprising: Mounting module, used to mount the encrypted partition of the target disk; A calling module, used for calling a disk encryption module to read and write the encrypted partition of the target disk; A return module, used to return the read and write operation results of the encrypted partition; Among them, the encrypted partition is encrypted and decrypted by the disk encryption module based on the key plaintext obtained from the key management module; the key management module is used to request the trusted execution environment to generate key ciphertext; request the trusted execution environment to decrypt the key ciphertext and generate the key plaintext; the disk encryption module and the key management module run in the kernel space of the operating system.
[0014] The present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the secure disk encryption method when executing the computer program.
[0015] The present application provides a non-transitory computer-readable storage medium having a computer program stored thereon, and the computer program implements the secure disk encryption method when executed by a processor.
[0016] The secure disk encryption method, device, electronic device and storage medium provided by the present application mount the encrypted partition of the target disk; call the disk encryption module to read and write the encrypted partition of the target disk; return the read and write operation results of the encrypted partition; the encrypted partition is encrypted and decrypted by the disk encryption module based on the key plaintext obtained from the key management module; the key management module is used to request the generation of key ciphertext from the trusted execution environment; request the decryption of the key ciphertext from the trusted execution environment to generate the key plaintext; on the one hand, since the encryption and decryption of the key are both performed in the trusted execution environment, the application running in the operating system cannot read the key plaintext of the decrypted disk; on the other hand, since the disk encryption module and the key management module run in the kernel space of the operating system, the application running in the user space cannot obtain the key plaintext during the transmission process; the security of the key plaintext is guaranteed, and the security of the disk encryption is improved. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.
[0018] In order to more clearly illustrate the technical solutions in the present application or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0019] Figure 1 This is one of the flow charts of the secure disk encryption method provided by this application.
[0020] Figure 2 It is a flowchart of the key generation method provided by this application.
[0021] Figure 3 It is a flowchart of the key loading method provided in this application.
[0022] Figure 4 It is a flowchart of the partition encryption method provided by this application.
[0023] Figure 5 It is a flowchart of the partition reading and writing method provided by this application.
[0024] Figure 6 This is the second flowchart of the secure disk encryption method provided by this application.
[0025] Figure 7 It is a structural schematic diagram of the secure disk encryption device provided by this application.
[0026] Figure 8 It is a structural schematic diagram of the electronic device provided by this application. DETAILED DESCRIPTION
[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.
[0028] It should be noted that the terms "first", "second" etc. in the present application are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable in appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, the process, method, system, product or equipment comprising a series of steps or units or modules need not be limited to those steps or units or modules clearly listed, but may include other steps or units or modules that are not clearly listed or inherent to these processes, methods, products or equipment.
[0029] When the related technology encrypts and decrypts the disk, for example, in the Linux system, the key ciphertext is decrypted in the REE (Rich Execution Environment). The application in the operating system has the opportunity to steal the key plaintext obtained after decryption, which brings great security risks to the encrypted data stored on the disk.
[0030] In order to solve the shortcomings of related technologies, Figure 1 This is one of the flowcharts of the secure disk encryption method provided by this application, such as Figure 1 As shown, the method includes step 110 , step 120 and step 130 .
[0031] Step 110: Mount the encrypted partition of the target disk.
[0032] Specifically, the execution subject of the secure disk encryption method provided in the embodiment of the present application is a secure disk encryption device. The device can be implemented by software, such as a secure disk encryption program running in the operating system of the encryption device; it can also be an encryption device that executes the secure disk encryption method, such as a desktop computer or server.
[0033] The target disk refers to the disk that needs to be encrypted. The disk usually stores important or sensitive data, so it needs to be encrypted.
[0034] Partitioning on a disk refers to dividing a physical disk drive (hard disk, solid-state drive, etc.) into multiple logical parts, each of which is called a partition. Each partition is considered an independent drive or volume in the operating system and can be formatted, managed, and used separately. An encrypted partition is an encrypted partition. For a target disk, there can be encrypted partitions and non-encrypted partitions.
[0035] When data in an encrypted partition needs to be read, the user can enter a mount command in the operating system to mount the encrypted partition of the target disk.
[0036] Step 120: Call the disk encryption module to read and write the encrypted partition of the target disk. The encrypted partition is encrypted and decrypted by the disk encryption module based on the key plaintext obtained from the key management module; the key management module is used to request the trusted execution environment to generate the key ciphertext; request the trusted execution environment to decrypt the key ciphertext and generate the key plaintext; the disk encryption module and the key management module run in the kernel space of the operating system.
[0037] Specifically, the disk encryption module refers to a module or software that can encrypt and decrypt the disk. For example, in a Linux system, the disk encryption module can be dm-crypt. dm-crypt is a disk encryption system in a Linux system that uses the kernel encryption framework and the device mapper subsystem. Using dm-crypt, users can encrypt entire disks, logical volumes, and partitions.
[0038] A key management module refers to a module or software that manages keys. For example, in a Linux system, the key management module can be keyring. Keyring is a key management subsystem in the kernel, mainly used for kernel-level key management. It forms a security framework that enables system services and applications to store and control access to sensitive data. Keyring provides a way for systems and applications to securely handle authentication and encryption keys without the need for users to manually enter them each time they are used.
[0039] Key plaintext refers to the original state of the key before encryption. Specifically, it can be a key in a readable form, not an encrypted form. Correspondingly, key ciphertext refers to the state of the key after encryption. Specifically, the key plaintext is converted into key ciphertext through an encryption algorithm, usually in an unreadable form, to protect the security of the key and prevent illegal access or cracking during storage or transmission.
[0040] Trusted Execution Environment (TEE) is a hardware isolation technology designed to provide a protected operating environment to ensure the security of data and code. The Trusted Execution Environment can protect the confidentiality and integrity of sensitive data and applications during execution, and protect sensitive data and code from software attacks in the operating system, such as viruses and other malware. The Trusted Execution Environment can be built by the central processing unit (main processor) in the encryption device or a separately set security processor.
[0041] The key management module is used to send a request to the trusted execution environment to encrypt the key in plain text and generate the key ciphertext; it can also send a request to the trusted execution environment to decrypt the key ciphertext and generate the key plaintext. Since the encryption and decryption of the key are both performed in the trusted execution environment, the application running in the operating system cannot read the key plaintext of the decrypted disk, ensuring the security of the key plaintext.
[0042] The disk encryption module can obtain the key plaintext from the key management module. The disk encryption module is called by the operating system, and the encrypted partition of the target disk is encrypted and written according to the key plaintext, or decrypted and read. Since the disk encryption module and the key management module run in the kernel space of the operating system, the application running in the user space cannot obtain the key plaintext.
[0043] Step 130: Return the read and write operation results of the encrypted partition.
[0044] Specifically, after reading and writing the encrypted partition of the target disk, the read and write operation results of the encrypted partition can be returned. The read and write operation results can include the execution results of the data write operation, and can also include the execution results of the data read operation.
[0045] During the reading and writing process of the encrypted partition of the target disk, the user does not need to input a key for encryption and decryption operations, but the encryption and decryption are implemented by the disk encryption module in the operating system.
[0046] The secure disk encryption method provided in the embodiment of the present application mounts the encrypted partition of the target disk; calls the disk encryption module to read and write the encrypted partition of the target disk; returns the read and write operation results of the encrypted partition; the encrypted partition is encrypted and decrypted by the disk encryption module based on the key plaintext obtained from the key management module; the key management module is used to request the trusted execution environment to generate a key ciphertext; request the trusted execution environment to decrypt the key ciphertext and generate the key plaintext; on the one hand, since the encryption and decryption of the key are both performed in the trusted execution environment, the application running in the operating system cannot read the key plaintext of the decrypted disk; on the other hand, since the disk encryption module and the key management module run in the kernel space of the operating system, the application running in the user space cannot obtain the key plaintext during the transmission process; the security of the key plaintext is guaranteed, and the security of the disk encryption is improved.
[0047] It should be noted that each implementation method of the present application can be freely combined, the order can be changed, or it can be executed separately, and does not need to rely on or depend on a fixed execution order.
[0048] In some embodiments, the key ciphertext is generated based on the following steps: Send a key creation request to the key management module; Calling the key management module to create a key based on the key creation request; The key management module is called to send a key encryption request to the trusted execution environment; the trusted execution environment encrypts the key based on the key encryption request, and sends the encrypted key ciphertext to the key management module.
[0049] Specifically, the user can enter a command in the operating system to send a key creation request to the key management module. The key creation request can specify the key type, for example, the key type can be "trusted", indicating that the key to be created is a trusted key. In the Linux system, the trusted key allows the keyring to generate keys based on security features such as TPM (Trusted Platform Module, hardware security module) or TEE. This feature makes it impossible for applications in REE to obtain plaintext keys, eliminating the possibility of leakage.
[0050] The key management module can be called to create a key based on the key creation request according to the preset plaintext; then the key management module is called to send a key encryption request to the trusted execution environment. The trusted execution environment encrypts the key according to the key encryption request, generates a key ciphertext, and sends it to the key management module.
[0051] Figure 2 It is a flowchart of the key generation method provided by this application, such as Figure 2As shown in the figure, the operating system can run command line tools corresponding to the key management module, for example, the command line tool can be the command line tool keyctl of the Linux system's kernel key management subsystem (key management facility). The subsystem provides a secure way to store and control access to sensitive information (such as authentication keys). keyctl allows administrators and users to query, manage, and operate these keys.
[0052] The specific process is as follows: Step 1: Use the keyctl tool to execute commands, submit an application to create a key to keyring, and specify the key type as "trusted".
[0053] Step 2: After receiving the request, keyring creates a key.
[0054] Step 3: Keyring requests the TEE driver to encrypt the created key.
[0055] Step 4: The TEE driver calls the TEE interface for encryption. The TEE driver is the driver for data exchange between REE and TEE.
[0056] Step 5: TEE encrypts the key and finally returns it to the keyring.
[0057] Step 6. After the key is generated, it will be stored in the memory and can be exported and saved to an external storage device (such as a persistent data storage device such as a disk), thereby avoiding the situation where the key is lost when the encryption device is restarted; and the key is encrypted data generated in the TEE environment, so there is no need to worry about information leakage, and data security can be guaranteed.
[0058] The creation command is as follows: $ keyctl add trusted testdiskkey "new 32" @s 836136621
[0060] $ keyctl pipe 836136621>testdiskkey.key
[0061] Among them, $ is the command prompt. The above command creates a key named "testdiskkey". After successful creation, the KeyId will be returned, such as "836136621". The key created here is stored in the memory, so executing the "keyctlpipe 836136621>testdiskkey.key" command is to save the encrypted key to the current directory of the disk, and the saved file name is "testdiskkey.key".
[0062] In the secure disk encryption method provided in the embodiment of the present application, the key is encrypted in a trusted execution environment, so that the application running in the operating system cannot read the key, thereby ensuring the security of the key and improving the security of disk encryption.
[0063] In some embodiments, the key ciphertext is stored based on the following steps: Receive key ciphertext; Store the key ciphertext to the non-encrypted partition of the target disk.
[0064] Specifically, after receiving the key ciphertext returned by the trusted execution environment, the key ciphertext may be stored in the memory of the encryption device, or may be stored in the non-encrypted partition of the target disk.
[0065] The secure disk encryption method provided in the embodiment of the present application stores the key ciphertext in the non-encrypted partition of the target disk, thereby avoiding the loss of the key after the encryption device is restarted, and improving the security of the disk encryption.
[0066] In some embodiments, the key plaintext is generated based on the following steps: Load the key ciphertext from the non-encrypted partition of the target disk to the key management module; Calling the key management module to send a key decryption request to the trusted execution environment; The trusted execution environment encrypts the key ciphertext based on the key decryption request, and sends the key plaintext generated after decryption to the key management module.
[0067] Specifically, before reading and writing to the target disk, the key needs to be obtained. On the one hand, the key ciphertext can be obtained from the memory for decryption, and on the other hand, the key ciphertext can be read from the non-encrypted partition of the target disk for decryption.
[0068] The user can enter a command in the operating system, and the operating system loads the key ciphertext from the non-encrypted partition of the target disk to the key management module. The key management module sends a key decryption request to the trusted execution environment. The trusted execution environment decrypts the key ciphertext according to the key decryption request, generates the key plaintext, and sends it to the key management module.
[0069] Figure 3 is a flowchart of the key loading method provided by this application, such as Figure 3 As shown, the method specifically includes: Step 1: Use keyctl to read and load the key ciphertext to the keyring; Step 2: keyring calls the TEE driver to request decryption of the key ciphertext; Step 3: The TEE driver calls the TEE interface to decrypt the key ciphertext, and the key ciphertext is finally returned to the keyring.
[0070] The loading command is as follows: $ keyctl add trusted testdiskkey "load $(cat testdiskkey.key)" @s 836136621
[0072] The above command will read the "testdiskkey.key" file from the current directory and load it into the keyring through keyctl. The key name is "testdiskkey". The "keyctl pipe 836136621>testdiskkey.key" command saves the encrypted key to the current directory of the disk. The saved file name is "testdiskkey.key".
[0073] In the secure disk encryption method provided in the embodiment of the present application, the key is decrypted in a trusted execution environment, so that the application running in the operating system cannot read the key, thereby ensuring the security of the key and improving the security of disk encryption.
[0074] In some embodiments, the encrypted partition is determined based on the following steps: Call the disk encryption module to obtain the key plaintext from the key management module; The disk encryption module is called to encrypt the specified partition in the target disk based on the key plaintext to determine the encrypted partition.
[0075] Specifically, the disk encryption module can be called to obtain the key plaintext from the key management module. The acquisition process is completed in the kernel space, so the user space program cannot obtain the key plaintext. After obtaining the key plaintext, the disk encryption module can be called to encrypt the specified partition in the target disk according to the key plaintext to determine the encrypted partition.
[0076] Figure 4 It is a flowchart of the partition encryption method provided by this application, such as Figure 4 As shown, the method specifically includes: Step 1: dm-crypt first requests the key from keyring, and keyring returns the key in plaintext to dm-crypt.
[0077] Step 2: dm-crypt encrypts the specified partition using the key in plain text.
[0078] The steps to create a disk encryption partition are as follows: $ dmsetup -v create encrypted --table "0 $(blockdev --getsz / dev / sda1) crypt sm4-cbc-essiv:sm3 :32:trusted:testdiskkey 0 / dev / sda1 0 1 sector_size:512"
[0079] The above command creates an encrypted partition for the " / dev / sda1" disk partition. The name of the encryption key in the keyring is "testdiskkey".
[0080] The secure disk encryption method provided in the embodiment of the present application encrypts the specified partition in the target disk according to the key plaintext, thereby improving the security of the disk encryption.
[0081] In some embodiments, encrypting a specified partition in the target disk based on the key plaintext includes: Encrypt the specified partition in the target disk based on the national encryption algorithm and key plaintext.
[0082] Specifically, national secret algorithms may include SM2 (public key cryptography algorithm based on elliptic curve), SM3 (hash algorithm) and SM4 (symmetric encryption algorithm), etc.
[0083] The encryption algorithm used in the command in the above embodiment is "sm4-cbc-essiv:sm3". "sm4" and "sm3" are national secret algorithms. SM3 is a one-way hash function that can calculate a 256-bit hash value, mainly used for digital signatures and message authentication codes. SM4 is a block cipher algorithm belonging to symmetric ciphers, with a block length and a key length of 128 bits.
[0084] The secure disk encryption method provided in the embodiment of the present application encrypts the specified partition in the target disk according to the national secret algorithm and the key plaintext, thereby improving the security of the disk encryption.
[0085] In some embodiments, the trusted execution environment is built based on a central processing unit or a secure processor.
[0086] Specifically, the central processor of the encryption device may provide a secure area to build a trusted execution environment; or a dedicated security processor may be separately provided in the encryption device to provide a secure area to build a trusted execution environment.
[0087] The secure disk encryption method provided in the embodiment of the present application builds a trusted execution environment through a central processing unit or a security processor, thereby improving the security of disk encryption.
[0088] In some embodiments, Figure 5 It is a flowchart of the partition reading and writing method provided by this application, such as Figure 5 As shown, the method specifically includes: Step 1: The user executes the mount command (mount) to mount the encrypted partition into the operating system.
[0089] Step 2: The user invokes a system call to perform a read or write data operation.
[0090] Step 3: The operating system's disk read and write operations will be called into the dm-crypt module. In the above embodiment, during the process of creating an encrypted partition, dm-crypt has already requested the key from the keyring, and the keyring will return the key plaintext to dm-crypt. Therefore, in this step, dm-crypt can directly use the key plaintext to encrypt and decrypt read and write data.
[0091] Step 4: The data encrypted by dm-crypt will be written to the disk or the read data will be returned to the caller. The encryption and decryption process is automatically completed in the dm-crypt subsystem, and the user does not need to handle the encryption and decryption process when performing read and write operations.
[0092] The partition read and write commands are as follows: $ mount / dev / mapper / encrypted / mnt / encrypted /
[0093] $ echo "Test of disk encryption."> / mnt / encrypted / test.txt
[0094] $ cat / mnt / encrypted / test.txt
[0095] Test of disk encryption.
[0096] Figure 6 This is the second flow chart of the secure disk encryption method provided by this application. Figure 6As shown, the overall process of the secure disk encryption method can generally include three stages: creating a key, creating an encrypted partition, and reading and writing the encrypted partition. Each stage can refer to the description in the above embodiment, and will not be repeated here.
[0097] The secure disk encryption method provided in the embodiment of the present application uses the national secret algorithm, combined with the security chip (central processing unit or security processor) and the keyring and dm-crypt subsystem of the Linux kernel to realize a secure encrypted disk. Using this method, the data encryption key of a storage device such as a device disk or a mobile hard disk can only be decrypted on the device that encrypted it for the first time, and the user data security can still be guaranteed after the disk is lost.
[0098] The device provided in the embodiment of the present application is described below. The device described below and the method described above can be referenced to each other.
[0099] Figure 7 is a schematic diagram of the structure of the secure disk encryption device provided by the present application, such as Figure 7 As shown, the device comprises: The mounting module 710 is used to mount the encrypted partition of the target disk; The calling module 720 is used to call the disk encryption module to read and write the encrypted partition of the target disk; The return module 730 is used to return the read and write operation results of the encrypted partition; Among them, the encrypted partition is encrypted and decrypted by the disk encryption module based on the key plaintext obtained from the key management module; the key management module is used to request the trusted execution environment to generate key ciphertext; request the trusted execution environment to decrypt the key ciphertext and generate key plaintext; the disk encryption module and the key management module run in the kernel space of the operating system.
[0100] The secure disk encryption device provided in the embodiment of the present application mounts the encrypted partition of the target disk; calls the disk encryption module to read and write the encrypted partition of the target disk; returns the read and write operation results of the encrypted partition; the encrypted partition is encrypted and decrypted by the disk encryption module based on the key plaintext obtained from the key management module; the key management module is used to request the trusted execution environment to generate a key ciphertext; request the trusted execution environment to decrypt the key ciphertext and generate the key plaintext; on the one hand, since the encryption and decryption of the key are both performed in the trusted execution environment, the application running in the operating system cannot read the key plaintext of the decrypted disk; on the other hand, since the disk encryption module and the key management module run in the kernel space of the operating system, the application running in the user space cannot obtain the key plaintext during the transmission process; the security of the key plaintext is guaranteed, and the security of the disk encryption is improved.
[0101] In some embodiments, the device is also used to: Send a key creation request to the key management module; Calling the key management module to create a key based on the key creation request; The key management module is called to send a key encryption request to the trusted execution environment; the trusted execution environment encrypts the key based on the key encryption request, and sends the encrypted key ciphertext to the key management module.
[0102] In some embodiments, the device is also used to: Receive key ciphertext; Store the key ciphertext to the non-encrypted partition of the target disk.
[0103] In some embodiments, the device is also used to: Load the key ciphertext from the non-encrypted partition of the target disk to the key management module; Calling the key management module to send a key decryption request to the trusted execution environment; The trusted execution environment encrypts the key ciphertext based on the key decryption request, and sends the key plaintext generated after decryption to the key management module.
[0104] In some embodiments, the device is also used to: Call the disk encryption module to obtain the key plaintext from the key management module; The disk encryption module is called to encrypt the specified partition in the target disk based on the key plaintext to determine the encrypted partition.
[0105] In some embodiments, the device is also used to: Encrypt the specified partition in the target disk based on the national encryption algorithm and key plaintext.
[0106] In some embodiments, the device is also used to: The trusted execution environment is built based on the central processing unit or the secure processor.
[0107] Figure 8 is a schematic diagram of the structure of the electronic device provided by this application, such as Figure 8 As shown, the electronic device may include: a processor (Processor) 810, a communication interface (Communications Interface) 820, a memory (Memory) 830 and a communication bus (Communications Bus) 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic command in the memory 830 to execute the method described in the above embodiment, for example: Mount the encrypted partition of the target disk; call the disk encryption module to read and write the encrypted partition of the target disk; return the read and write operation results of the encrypted partition; Among them, the encrypted partition is encrypted and decrypted by the disk encryption module based on the key plaintext obtained from the key management module; the key management module is used to request the trusted execution environment to generate key ciphertext; request the trusted execution environment to decrypt the key ciphertext and generate key plaintext; the disk encryption module and the key management module run in the kernel space of the operating system.
[0108] In addition, the logical commands in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several commands to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.
[0109] The processor in the electronic device provided in the embodiment of the present application can call the logic instructions in the memory to implement the above method. Its specific implementation method is consistent with the implementation method of the aforementioned method and can achieve the same beneficial effects, which will not be repeated here.
[0110] An embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the methods provided in the above embodiments are implemented.
[0111] Its specific implementation is consistent with the aforementioned method implementation and can achieve the same beneficial effects, so it will not be repeated here.
[0112] An embodiment of the present application provides a computer program product, including a computer program, which implements the above method when executed by a processor.
[0113] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.
[0114] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.
[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.
Claims
1. A secure disk encryption method, characterized in that: include: Mount the encrypted partition of the target disk; Calling a disk encryption module to read and write the encrypted partition of the target disk; Return the read and write operation results of the encrypted partition; The encrypted partition is encrypted and decrypted by the disk encryption module based on the key plaintext obtained from the key management module; the key management module is used to request the trusted execution environment to generate the key ciphertext; Requesting the trusted execution environment to decrypt the key ciphertext and generating the key plaintext; the disk encryption module and the key management module run in the kernel space of the operating system.
2. The secure disk encryption method according to claim 1, characterized in that: The key ciphertext is generated based on the following steps: Sending a key creation request to the key management module; Calling the key management module to create a key based on the key creation request; The key management module is called to send a key encryption request to the trusted execution environment; the trusted execution environment encrypts the key based on the key encryption request, and sends the key ciphertext generated after encryption to the key management module.
3. The secure disk encryption method according to claim 2, characterized in that: The key ciphertext is saved based on the following steps: Receiving the key ciphertext; The key ciphertext is stored in a non-encrypted partition of the target disk.
4. The secure disk encryption method according to claim 3, characterized in that: The key plaintext is generated based on the following steps: Loading the key ciphertext from the non-encrypted partition of the target disk to the key management module; Calling the key management module to send a key decryption request to the trusted execution environment; The trusted execution environment encrypts the key ciphertext based on the key decryption request, and sends the key plaintext generated after decryption to the key management module.
5. The secure disk encryption method according to claim 4, characterized in that: The encrypted partition is determined based on the following steps: Calling the disk encryption module to obtain the key plaintext from the key management module; The disk encryption module is called to encrypt a designated partition in the target disk based on the key plaintext to determine the encrypted partition.
6. The secure disk encryption method according to claim 5, characterized in that: The encrypting the designated partition in the target disk based on the key plaintext includes: The designated partition in the target disk is encrypted based on the national encryption algorithm and the key plaintext.
7. The secure disk encryption method according to any one of claims 1 to 6, characterized in that: The trusted execution environment is constructed based on a central processing unit or a security processor.
8. A secure disk encryption device, characterized in that: include: Mounting module, used to mount the encrypted partition of the target disk; A calling module, used for calling a disk encryption module to read and write the encrypted partition of the target disk; A return module, used to return the read and write operation results of the encrypted partition; The encrypted partition is encrypted and decrypted by the disk encryption module based on the key plaintext obtained from the key management module; the key management module is used to request the trusted execution environment to generate the key ciphertext; Requesting the trusted execution environment to decrypt the key ciphertext and generating the key plaintext; the disk encryption module and the key management module run in the kernel space of the operating system.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the secure disk encryption method according to any one of claims 1 to 7 is implemented.
10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the secure disk encryption method according to any one of claims 1 to 7 is implemented.