Hard disk data lossless encryption migration and specified partition encryption method and device and electronic equipment

Abstract

The invention belongs to the technical field of data security protection for preventing unauthorized behaviors, and particularly relates to a method and device for hard disk data lossless encryption migration and specified partition encryption and electronic equipment. The method comprises the following steps: firstly, distinguishing a system partition and a data partition of a local hard disk, and carrying out lossless encryption migration on the data partition of the local hard disk through an encryption bridge chip and a lossless migration tool based on a host; secondly, the hard disk managed by the encryption bridging chip enters a data partition protection stage, partition protection and encryption and decryption functions are started for data partitions in the data partition protection stage, at the moment, the data partitions are invisible, and a drive letter undistributed state is presented; and finally, when the data partition needs to be used, entering a hard disk data partition use stage, in the data partition use stage, enabling the encryption and decryption functions of the data partition, and releasing partition protection through authentication of a partition authorization mechanism, so that the data of the data partition can be accessed. According to the invention, the process of reinstalling the system during data migration is omitted.

Description

Technical Field

[0001] The present invention belongs to the technical field of protecting data security by preventing unauthorized behavior, and more specifically, relates to a method, device and electronic equipment for lossless encryption migration of hard disk data and encryption of designated partitions. Background Art

[0002] In order to solve the technical problem that hard disk data is stored in plain text without effective identity authentication, it is easy to be illegally modified and leaked, posing a threat to security, and encrypted storage is needed. There are many existing encryption technologies and methods. For example, Chinese patent document CN112560058A discloses an SSD partition encryption storage system based on a smart password key and its implementation method. The partition encryption storage system mentioned in the method, although it explains the encrypted storage of data, does not solve how to conveniently encrypt and migrate the existing plain text data on the hard disk. For example, a hard disk used by a user has 2 partitions, generally the first partition is the system partition, and the second partition is the user data partition. If the user wants the data partition to be encrypted and stored, the traditional method is to back up the hard disk data first, and then add a SATA encryption bridge chip, repartition the hard disk, format it, reinstall the system, encrypt and put in the user data. The process is complicated, the user experience is poor, and because the system needs to be reinstalled, it is time-consuming and laborious.

[0003] In view of the above problems, this method provides a method for lossless encryption migration of hard disk data and encryption of specified partitions to achieve encryption migration of data and partition encryption. Summary of the invention

[0004] The present invention aims to overcome at least one defect of the above-mentioned prior art and provide a method for lossless encryption migration of hard disk data and encryption of specified partitions, so as to solve the problem that the traditional method requires reinstalling the system to encrypt and store data partitions, which is time-consuming and laborious.

[0005] The invention also discloses a device for loading the method.

[0006] The invention also discloses an electronic device for implementing the method.

[0007] The detailed technical scheme of the present invention is as follows:

[0008] A method for lossless encryption migration of hard disk data and encryption of designated partitions, the method comprising:

[0009] S1. The computer connects to the hard disk through the encryption bridge chip and runs the host computer software. The host computer software distinguishes the system partition and data partition of the local hard disk;

[0010] S2. The host computer software performs lossless encryption migration on the data partition of the local hard disk through the encryption bridge chip and the host-based lossless migration tool. Specifically, the lossless migration tool is used to enumerate the files of the data partition, and the lossless encryption migration of the data partition is performed with the help of the host memory resources.

[0011] S3. After the lossless encryption migration of the original hard disk data partition is completed, the hard disk managed by the encryption bridge chip enters the data partition protection stage. In the data partition protection stage, the system partition does not enable encryption and decryption functions, and the data partition enables partition protection and encryption and decryption functions. At this time, the system partition is visible and the data can be recognized normally, while the data partition is invisible and presents an unassigned drive letter state. At this time, the initialization, formatting and partition adjustment of the hard disk will be rejected by the encryption bridge chip, and only the related resources of the system partition can be used;

[0012] S4. When the data partition needs to be used, the hard disk data partition use phase is entered. During the data partition use phase, the system partition does not enable encryption and decryption functions. The data partition enables encryption and decryption functions and removes partition protection through partition authorization mechanism authentication to access data in the data partition.

[0013] The partition authorization mechanism authentication first uses the hard disk management tool to issue authorization authentication information, the encryption bridge chip verifies the legality of the authorization information, calculates the key M of the data partition, and uses the calculated key M to encrypt and decrypt the data of the data partition; secondly, the hard disk management tool reloads the data partition and triggers the system re-enumeration mechanism. At this time, the system recognizes the data partition and the actual content. When all data partitions are authorized, the hard disk is initialized, formatted, and partitioned.

[0014] Preferably, according to the present invention, step S1 specifically refers to that the computer connects the hard disk through the encryption bridge chip, runs a dedicated hard disk analysis tool, analyzes the hard disk by obtaining the original unencrypted hard disk LBA0, determines whether it is a partition in MBR format or a partition in GPT format, and then parses the hard disk partition table. LBA0 has 512 bytes of data, and the 451st byte is a flag for the partition type. If its value is 0xEE, it means that it is a partition in GPT format. If it is not 0xEE, it means that it is a partition in MBR format. Then, the system partition and data partition are found according to the information in the partition table.

[0015] Preferably, according to the present invention, the encryption bridge chip has two modes for the system partition and the data partition: the system partition is directly read without encryption and decryption, so that it will not affect the normal startup of the original system and eliminates the complicated process of reinstalling the system; the data partition is directly read, and the read data is converted from plain text to ciphertext to achieve lossless encryption migration of the data partition; before the data partition completes the encryption migration, the data partition will be hidden to protect the data partition; after the data partition completes the encryption migration, the data partition can be displayed normally.

[0016] Preferably, according to the present invention, the lossless encryption migration of the data partition means that the hard disk analysis tool reads the data blocks of the data partition one by one, and then encrypts them through the encryption bridge chip and writes them into the hard disk in ciphertext form to complete the lossless encryption migration of the data partition; during the lossless encryption migration of data, for multiple data partitions of the hard disk, each data partition uses a different key to encrypt the migrated data to increase security.

[0017] Preferably, according to the present invention, the partition authorization mechanism adopts a key synthesis mechanism, which is as follows:

[0018] After the lossless encryption migration of the data partition is completed, the hard disk analysis tool prompts the configurator to set the user identity authentication code R1. The encryption bridge chip obtains the user authentication code R1 sent by the private instruction received through its own SATA / SAS / PCIE interface. The private instruction adopts an illegal LBA offset design. The encryption bridge chip randomly generates a partition random code R2. The user authentication code R1 and the partition random code R2 are fused and calculated, that is, the user authentication code R1 is calculated by MD5 and then XORed with the partition random code R2 to generate the key M:

[0019] M = MD5(R1) || R2 (1)

[0020] In formula (1), R1 represents the user authentication code set by the setter, and R2 represents the partition random code;

[0021] Then perform a hash operation on the key information M to generate H:

[0022] H = Hash(M) (2)

[0023] The encryption bridge chip stores the partition random codes R2 and H in the non-volatile storage area inside the chip, and does not store the user authentication code R1 and the key information M, so as to enhance security.

[0024] During the partition authorization process, the hard disk management tool receives the user identity authentication code R1` input by the user and sends it to the encryption bridge chip through the partition authorization private instruction. The encryption bridge chip extracts the partition random code R2 stored inside the chip and performs a fusion calculation with the obtained user identity authentication code R1`, that is, the user identity authentication code R1` is calculated by MD5 and then XORed with the partition random code R2 to generate the key information M`:

[0025] M` = MD5(R1`) || R2 (3)

[0026] In formula (3), R1` represents the user identity authentication code input by the user, and R2 represents the partition random code;

[0027] Then perform a hash operation on the key information M` to generate H`:

[0028] H`=Hash(M`) (4)

[0029] When H` is consistent with the H stored inside the chip, the user authentication code R1` entered by the user is consistent with the R1 set by the setter, the user has a legal identity, the key information M` is configured in the password module as the key of the data partition, the authorization is successful, and the user can read the ciphertext data normally; when H` is inconsistent with the H stored inside the chip, the user authentication code is wrong, the user has no right to use the data partition, and the authorization fails.

[0030] In another aspect of the present invention, a device for implementing a hard disk data lossless encryption migration and a designated partition encryption method is provided, the device comprising: a computer, an encryption bridge chip, and a hard disk;

[0031] The computer is connected to a hard disk via an encryption bridge chip, and the hard disk is a hard disk that requires partition encryption and data migration.

[0032] In another aspect of the present invention, there is also provided an electronic device, comprising:

[0033] at least one processor; and

[0034] A memory storing instructions, when the instructions are executed by the at least one processor, enables the at least one processor to execute the method for lossless encryption migration of hard disk data and encryption of designated partitions as described above.

[0035] Compared with the prior art, the present invention has the following beneficial effects:

[0036] (1) The present invention increases the security of data by setting up a partition authorization mechanism authentication based on a key synthesis mechanism to encrypt and store user data.

[0037] (2) During the hard disk data partition protection stage of the present invention, the encryption and decryption functions are not enabled for the system partition, while the partition protection and encryption and decryption functions are enabled for the data partition, thereby ensuring security and increasing flexibility.

[0038] (3) The present invention distinguishes between system partitions and data partitions and implements encrypted data migration only for the data partition, thereby eliminating the process of reinstalling the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a device connection diagram for realizing the hard disk data lossless encryption migration and designated partition encryption method described in the present invention.

[0040] Figure 2 It is a flow chart of partition encrypted data migration described in the present invention. DETAILED DESCRIPTION

[0041] Embodiment 1,

[0042] like Figure 2 As shown, a method for lossless encryption migration of hard disk data and encryption of designated partitions, the method comprising:

[0043] S1. The computer connects to the hard disk through the encryption bridge chip and runs the host computer software. The host computer software distinguishes the system partition and data partition of the local hard disk;

[0044] S2. The host computer software performs lossless encryption migration on the data partition of the local hard disk through the encryption bridge chip and the host-based lossless migration tool. Specifically, the lossless migration tool is used to enumerate the files of the data partition, and the lossless encryption migration of the data partition is performed with the help of the host memory resources.

[0045] S3. After the lossless encryption migration of the original hard disk data partition is completed, the hard disk managed by the encryption bridge chip enters the data partition protection stage. In the data partition protection stage, the system partition does not enable the encryption and decryption functions, and the data partition enables the partition protection and encryption and decryption functions. At this time, the system partition is visible, the data can be recognized normally, and the data partition is invisible, showing the state of unassigned drive letter. At this time, the initialization, formatting and partition adjustment of the hard disk will be rejected by the encryption bridge chip, and only the related resources of the system partition can be used; after power-on by default, the hard disk managed by the HX0168 bridge chip enters the data partition protection stage;

[0046] S4. When the data partition needs to be used, the hard disk data partition usage stage is entered. During the data partition usage stage, the system partition does not enable the encryption and decryption functions; the data partition enables the encryption and decryption functions and removes the partition protection through the partition authorization mechanism authentication, and the data partition data can be accessed; when the data partition is authorized, the authorized data partition and the system partition are consistent in user experience.

[0047] When the encryption bridge chip is removed and the hard disk is directly identified, the system partition is visible, but the data partition does not show any actual data content because there is no key.

[0048] The partition authorization mechanism authentication first uses the hard disk management tool to issue authorization authentication information, the encryption bridge chip verifies the legality of the authorization information, calculates the key M stored in the data partition, and uses the calculated key M to encrypt and decrypt the data in the data partition; secondly, the hard disk management tool reloads the data partition and triggers the system re-enumeration mechanism. At this time, the system recognizes the data partition and the actual content. When all data partitions are authorized, the hard disk is initialized, formatted, and partitioned.

[0049] Step S1 specifically means that the computer connects to the hard disk through the encryption bridge chip HX0168, runs a dedicated hard disk analysis tool, analyzes the hard disk by obtaining the original unencrypted hard disk LBA0, determines whether it is a partition in MBR format or a partition in GPT format, and then parses the hard disk partition table. LBA0 has 512 bytes of data, and the 451st byte is the partition type flag. If its value is 0xEE, it means it is a partition in GPT format. If it is not 0xEE, it means it is a partition in MBR format. Then find the system partition and data partition according to the information in the partition table.

[0050] The encryption bridge chip HX0168 has two modes for system partitions and data partitions. The system partition is read directly without encryption and decryption, which will not affect the normal startup of the original system and eliminate the complicated process of reinstalling the system; the data partition is read directly, and the read data is converted from plain text to ciphertext to achieve lossless encryption migration of the data partition; before the data partition completes the encryption migration, the data partition will be hidden to protect the data partition; after the data partition completes the encryption migration, the data partition can be displayed normally.

[0051] Lossless encryption migration of data partition means that the hard disk analysis tool reads the data blocks of the data partition one by one, and then encrypts them through the encryption bridge chip HX0168 and writes them to the hard disk in ciphertext form to complete the lossless encryption migration of the data partition; during lossless encryption migration of data, if the hard disk has multiple data partitions, each data partition uses a different key to encrypt the migrated data to increase security.

[0052] The partition authorization mechanism adopts a key synthesis mechanism. The data partition key is synthesized by the user authentication code R1 and the partition random code R2. The synthesis mechanism is completed through the private instructions of the SATA / SAS / PCIE interface, as follows:

[0053] After the lossless encryption migration of the data partition is completed, the hard disk analysis tool prompts the user to set the user authentication code R1. The encryption bridge chip HX0168 obtains the user authentication code R1 sent by the private instruction from the computer through its own SATA / SAS / PCIE interface. The encryption bridge chip randomly generates a partition random code R2. R1 and R2 are fused and calculated, that is, MD5 is calculated on R1 and then XORed with R2 to generate a set of 128-bit keys M. M is hashed to generate H, that is: M=MD5(R1)||R2, H=Hash(M). The encryption bridge chip HX0168 stores R2 and H in the non-volatile storage area inside the chip, and does not store the user authentication code R1 and key information M. Key information is not stored to enhance security. The private instruction adopts an illegal LBA offset design.

[0054] During the partition authorization process, the hard disk management tool receives the user authentication code R1` input by the user and sends it to the encryption bridge chip HX0168 through the partition authorization private instruction. The encryption bridge chip HX0168 extracts R2 stored inside the chip, and performs a fusion calculation with the obtained R1`, that is, MD5 calculation is performed on R1 and then XORed with R2 to generate M`. That is: M`=MD5(R1`)||R2. When Hash(M`) is consistent with H stored inside the chip, it is considered that the user authentication code R1` is consistent with R1 in the lossless encryption migration stage of the data partition, and the user has a legal identity. M` is configured into the cryptographic module as the key for the data partition. The authorization is successful and the user can read the ciphertext data normally;

[0055] When Hash(M`) is inconsistent with H stored inside the chip, the user authentication code is considered to be wrong. The user has no right to use the data partition, the authorization fails, and the user cannot read the ciphertext data.

[0056] Embodiment 2,

[0057] like Figure 1 As shown, this embodiment provides a device for implementing a hard disk data lossless encryption migration and a designated partition encryption method, the device comprising: a computer, an encryption bridge chip, and a hard disk;

[0058] The computer is connected to a hard disk via an encryption bridge chip, and the hard disk is a hard disk that requires partition encryption and data migration.

[0059] Embodiment 3,

[0060] This embodiment also provides an electronic device, including:

[0061] at least one processor; and

[0062] A memory storing instructions, when the instructions are executed by the at least one processor, enables the at least one processor to execute the hard disk data lossless encryption migration and designated partition encryption method as described above.

[0063] In this embodiment, the electronic device may include, but is not limited to: personal computers, server computers, workstations, desktop computers, laptop computers, notebook computers, mobile computing devices, smart phones, tablet computers, cellular phones, personal digital assistants (PDAs), handheld devices, messaging devices, wearable computing devices, consumer electronic devices, and the like.

Claims

1. A method for lossless encryption migration of hard disk data and encryption of designated partitions, characterized in that: The method comprises: S1. The computer connects to the hard disk through the encryption bridge chip and runs the host computer software. The host computer software distinguishes the system partition and data partition of the local hard disk; S2. The host computer software performs lossless encryption migration on the data partition of the local hard disk through the encryption bridge chip and the host-based lossless migration tool. Specifically, the lossless migration tool is used to enumerate the files of the data partition, and the host memory resources are used to perform lossless encryption migration on the data partition. S3. After the lossless encryption migration of the original hard disk data partition is completed, the hard disk managed by the encryption bridge chip enters the data partition protection stage. During the data partition protection stage, the system partition does not enable encryption and decryption functions, and the data partition enables partition protection and encryption and decryption functions; S4. When the data partition needs to be used, the hard disk data partition use phase is entered. During the data partition use phase, the system partition does not enable encryption and decryption functions. The data partition enables encryption and decryption functions and removes partition protection through partition authorization mechanism authentication to access data in the data partition. The partition authorization mechanism authentication first uses the hard disk management tool to issue authorization authentication information, the encryption bridge chip verifies the legality of the authorization information, calculates the key M of the data partition, and uses the calculated key M to encrypt and decrypt the data of the data partition; secondly, the hard disk management tool reloads the data partition and triggers the system re-enumeration mechanism. At this time, the system recognizes the data partition and the actual content. When all data partitions are authorized, the hard disk is initialized, formatted, and partitioned.

2. A method for hard disk data lossless encryption migration and designated partition encryption according to claim 1, characterized in that: The step S1 specifically means that the computer connects the hard disk through the encryption bridge chip, runs a dedicated hard disk analysis tool, analyzes the hard disk by obtaining the original unencrypted hard disk LBA0, determines whether it is a partition in MBR format or a partition in GPT format, and then parses the hard disk partition table. LBA0 has 512 bytes of data, and the 451st byte is a partition type flag. If its value is 0xEE, it means that it is a partition in GPT format. If it is not 0xEE, it means that it is a partition in MBR format. Then, the system partition and data partition are found according to the information in the partition table.

3. A method for hard disk data lossless encryption migration and designated partition encryption according to claim 1, characterized in that: The encryption bridge chip has two modes for the system partition and the data partition: the system partition is directly read without encryption and decryption; the data partition is directly read, and the read data is converted from plain text to cipher text to achieve lossless encryption migration of the data partition; Before the data partition is encrypted and migrated, it will be hidden to protect the data partition. After the data partition is encrypted and migrated, it can be displayed normally.

4. A method for hard disk data lossless encryption migration and designated partition encryption according to claim 3, characterized in that: The lossless encryption migration of the data partition means that the hard disk analysis tool reads the data blocks of the data partition one by one, and then encrypts them through the encryption bridge chip and writes them into the hard disk in ciphertext form to complete the lossless encryption migration of the data partition; during the lossless encryption migration of data, for multiple data partitions of the hard disk, each data partition uses a different key to encrypt the migrated data.

5. A method for hard disk data lossless encryption migration and designated partition encryption according to claim 1, characterized in that: The partition authorization mechanism adopts a key synthesis mechanism, which is as follows: After the lossless encryption migration of the data partition is completed, the hard disk analysis tool prompts the setter to set the user identity authentication code R1. The encryption bridge chip obtains the user authentication code R1 sent by the private instruction received through its own SATA / SAS / PCIE interface. The encryption bridge chip randomly generates a partition random code R2. The user authentication code R1 and the partition random code R2 are fused and calculated, that is, the user authentication code R1 is calculated by MD5 and then XORed with the partition random code R2 to generate the key M: M = MD5(R1) || R2 (1) In formula (1), R1 represents the user authentication code set by the setter, and R2 represents the partition random code; Then perform a hash operation on the key information M to generate H: H = Hash(M) (2) The encryption bridge chip stores the partition random code R2 and H in the non-volatile storage area inside the chip, and does not store the user authentication code R1 and the key information M; During the partition authorization process, the hard disk management tool receives the user identity authentication code R1` input by the user and sends it to the encryption bridge chip through the partition authorization private instruction. The encryption bridge chip extracts the partition random code R2 stored inside the chip and performs a fusion calculation with the obtained user identity authentication code R1`, that is, the user identity authentication code R1` is calculated by MD5 and then XORed with the partition random code R2 to generate the key information M`: M` = MD5(R1`) || R2 (3) In formula (3), R1` represents the user identity authentication code input by the user, and R2 represents the partition random code; Then perform a hash operation on the key information M` to generate H`: H`=Hash(M`) (4) When H` is consistent with the H stored inside the chip, the user authentication code R1` entered by the user is consistent with the R1 set by the setter, the user has a legal identity, the key information M` is configured in the password module as the key of the data partition, the authorization is successful, and the user can read the ciphertext data normally; when H` is inconsistent with the H stored inside the chip, the user authentication code is wrong, the user has no right to use the data partition, and the authorization fails.

6. A device for implementing lossless encryption migration of hard disk data and encryption of designated partitions, characterized in that: The device includes a computer, an encryption bridge chip, and a hard disk; The computer is connected to a hard disk via an encryption bridge chip, and the hard disk is a hard disk that requires partition encryption and data migration.

7. An electronic device, characterized in that: The electronic device comprises: at least one processor; and A memory storing instructions, which, when executed by the at least one processor, enables the at least one processor to execute the method for hard disk data lossless encryption migration and designated partition encryption as described in any one of claims 1-5.

Images