System partition startup method, device, equipment and product capable of dual encryption

Abstract

The present invention discloses a method, apparatus, device, and product for booting a system partition capable of dual encryption. The method comprises establishing a plurality of system storage units containing partitions; encrypting each of the system storage units using a first encryption method; encrypting a configuration file storage unit using a second encryption method; decrypting the system storage unit using a key obtained from a key storage device or a decrypted configuration file storage unit, and mounting the decrypted system storage unit. The present invention discloses a method, apparatus, device, and product for booting a system partition capable of dual encryption. The method can select different systems to be mounted according to the needs of the application scenario, thereby achieving mutual isolation and confidentiality of data. The dual encryption method further improves data confidentiality, resulting in good confidentiality, wide application range, and high reliability.

Description

Technical Field

[0001] The present invention belongs to the field of system encryption, and in particular relates to a system partition startup method, device, equipment and product capable of dual encryption. Background Art

[0002] With the rapid development of information technology, data security has become a critical issue that cannot be ignored in all fields, and operating system data security, in particular, has garnered widespread attention. Users typically have varying computing performance and data security requirements for computer operating systems in different application scenarios. Data in each operating scenario must be independent and non-interfering. For example, if a single computer is used by multiple users or teams, each user team must ensure the isolation and protection of their internal data.

[0003] Under existing technical conditions, the above requirements are usually achieved through dual-system block device encryption or file system-level encryption. However, the file system-level encryption method can usually only encrypt a single file or directory and cannot protect the entire system partition. Some system usage record data and related metadata are not private. The block device encryption method only encrypts a single system partition, and the decryption script or key file exists in plain text in the temporary root file system, so there is also a relatively large security risk. Summary of the Invention

[0004] In view of this, the present invention aims to overcome the defects in the prior art and proposes a system partition startup method, device, equipment and product capable of dual encryption.

[0005] To achieve the above object, the technical solution of the present invention is achieved as follows:

[0006] In a first aspect, the present invention discloses a system partition startup method capable of dual encryption, comprising:

[0007] Establishing a plurality of system storage units including partitions, establishing a corresponding configuration file storage unit for each system storage unit, and storing the partition mounting configuration files of the system storage unit in the corresponding configuration file storage unit;

[0008] Encrypting the system storage units respectively using a first encryption method, and storing the keys in corresponding configuration file storage units or key storage devices;

[0009] The configuration file storage unit is encrypted using a second encryption method, and the key is stored in a preset key acquisition address;

[0010] When any grub startup item is selected to start, the configuration file storage unit corresponding to the key decryption is obtained according to the preset key acquisition address corresponding to the grub startup item, and the partition mounting configuration file is obtained;

[0011] The system storage unit is decrypted using a key obtained from the key storage device or the decrypted configuration file storage unit, and the decrypted system storage unit is mounted according to the corresponding partition mounting configuration file.

[0012] In one embodiment of the present invention, when any grub startup item is selected to start, a configuration file storage unit corresponding to key decryption is obtained according to a preset key acquisition address corresponding to the grub startup item, including: establishing an associated configuration file, the associated configuration file is used to record the correspondence between the grub startup item, the preset key acquisition address and the configuration file storage unit; when any grub startup item is selected to start, the associated configuration file is queried, and a configuration file storage unit corresponding to key decryption is obtained according to the corresponding preset key acquisition address.

[0013] In one embodiment of the present invention, the first encryption method is a LUKS encryption method, and the second encryption method is a file system level encryption method.

[0014] In one embodiment of the present invention, the system storage unit includes a ROOT system root partition and a DATA data partition.

[0015] In one embodiment of the present invention, the configuration file storage unit is stored in a temporary root file system.

[0016] In one embodiment of the present invention, a plurality of system storage units are established, and the system storage units are encrypted respectively using a first encryption method, including: different system storage units have different keys.

[0017] In one embodiment of the present invention, the key storage device includes any one of: a Ukey, a trusted module platform device, and a cryptographic server.

[0018] In a second aspect, the present invention discloses a system partition startup device capable of dual encryption, the device comprising:

[0019] An establishment module is used to establish a plurality of system storage units including partitions, each system storage unit establishes a corresponding configuration file storage unit, and the partition mounting configuration file of the system storage unit is stored in the corresponding configuration file storage unit;

[0020] a first encryption module, configured to encrypt the system storage units respectively using a first encryption method, and store the keys in corresponding configuration file storage units or key storage devices;

[0021] A second encryption module is used to encrypt the configuration file storage unit using a second encryption method, and the key is stored in a preset key acquisition address;

[0022] The startup module is used to obtain the configuration file storage unit corresponding to the key decryption according to the preset key acquisition address corresponding to the grub startup item when any grub startup item is selected to start, and obtain the partition mounting configuration file;

[0023] The mounting module is used to decrypt the system storage unit using the key obtained from the key storage device or the decrypted configuration file storage unit, and mount the decrypted system storage unit according to the corresponding partition mounting configuration file.

[0024] In a third aspect, the present invention discloses an electronic device comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above method.

[0025] In a fourth aspect, the present invention discloses a computer program product, comprising a computer program, which implements the above method when executed by a processor.

[0026] Compared with the prior art, the present invention has the following advantages:

[0027] The present invention discloses a method, device, equipment and product for booting a system partition capable of double encryption, comprising establishing a plurality of system storage units containing partitions, establishing a corresponding configuration file storage unit for each system storage unit; encrypting the system storage units respectively using a first encryption method, and storing a key in the corresponding configuration file storage unit or a key storage device; encrypting the configuration file storage unit using a second encryption method, and storing the key in a preset key acquisition address; decrypting the system storage unit using a key obtained from the key storage device or the decrypted configuration file storage unit, and mounting the configuration file according to the corresponding partition, and mounting the decrypted system storage unit. The present invention discloses a method, device, equipment and product for booting a system partition capable of double encryption, capable of performing a first encryption on multiple system storage units, and performing a second encryption on the configuration file storage unit storing the key. The setting of multiple system storage units can realize the selection of mounting different systems according to the requirements of the application scenario, and realize the mutual isolation and confidentiality of data; the setting of double encryption further improves the confidentiality of data, and has the characteristics of good confidentiality, wide application range and high reliability. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0029] In the attached figure:

[0030] Figure 1 This is a schematic diagram showing the principle of a method for booting a system partition capable of dual encryption according to an embodiment of the present invention;

[0031] Figure 2 A schematic diagram of a system partition startup method capable of dual encryption according to an embodiment of the present invention;

[0032] Figure 3 A schematic diagram of a system partition startup method capable of dual encryption and associated configuration files according to an embodiment of the present invention;

[0033] Figure 4 A schematic diagram of a system storage unit in a method for booting a system partition capable of dual encryption according to an embodiment of the present invention;

[0034] Figure 5 A schematic diagram of a system partition startup device capable of dual encryption according to an embodiment of the present invention;

[0035] Figure 6 This is a schematic diagram of an electronic device capable of booting a dual-encrypted system partition according to an embodiment of the present invention. DETAILED DESCRIPTION

[0036] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0037] In the description of the present invention, it should be further clarified that the terms "first," "second," etc. are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first," "second," etc. may explicitly or implicitly include one or more of the features. In the description of the present invention, unless otherwise specified, "plurality" means two or more.

[0038] The present invention discloses a method, device, equipment and product for starting a system partition capable of dual encryption. Figure 1As shown, in the prior art, dual systems are usually implemented through block device encryption or file system level encryption. However, the file system level encryption method can usually only encrypt a single file or directory and cannot protect the entire system partition; while the block device encryption method only encrypts a single system partition, and the decryption script or key file exists in plain text in the temporary root file system, which also has a relatively large security risk. The present invention discloses a system partition startup method, device, equipment and product capable of dual encryption, which can perform a first encryption on multiple system storage units and a second encryption on a configuration file storage unit storing a key. The setting of multiple system storage units can realize the selection of mounting different systems according to the requirements of the application scenario, and realize the mutual isolation and confidentiality of data; the setting of dual encryption further improves the confidentiality of data, and has the characteristics of good confidentiality effect, wide application range and high reliability.

[0039] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0040] An embodiment disclosed by the present invention, as Figure 2 As shown, a method for booting a system partition capable of dual encryption includes:

[0041] Step S201: Establish a plurality of system storage units including partitions, establish a corresponding configuration file storage unit for each system storage unit, and store the partition mounting configuration file of the system storage unit in the corresponding configuration file storage unit;

[0042] In this embodiment, step S201 is performed during the system installation phase.

[0043] In this embodiment, the system storage unit includes the ROOT system root partition and the DATA data partition. Figure 4 As shown, in a system storage unit, there is one ROOT system root partition and several DATA data partitions, and the ROOT system root partition and the DATA data partition use the same key.

[0044] The ROOT system root partitions of several system storage units all store a complete copy of the operating system data. The operating system data in each ROOT system root partition can be completely consistent or different depending on the usage scenario and different user needs. The DATA data partition of the system storage unit stores system user data.

[0045] The configuration file storage unit is stored in the temporary root file system initramfs.

[0046] In this embodiment, different system storage units have different keys, and each system storage unit is independent and encrypted. Even if a problem occurs in one system storage unit, it will not affect other system storage units.

[0047] In this embodiment, if the system storage units need to be shared, they only need to store the keys in different key slots of the shared system storage units.

[0048] Step S202: encrypting the system storage units respectively using the first encryption method, and storing the keys in the corresponding configuration file storage units or key storage devices;

[0049] In this embodiment, illustratively, the key storage device is any one of a Ukey, a trusted module platform device, and a cryptographic server.

[0050] In another embodiment, the configuration file storage unit stores a decryption configuration file, which records the key storage device type and specific storage address where the key is located. Furthermore, the key is obtained through the record in the decryption configuration file, wherein the key storage device type can be any one of Ukey, trusted module platform device and password server.

[0051] Step S203: encrypt the configuration file storage unit using a second encryption method, and store the key in a preset key acquisition address;

[0052] In this embodiment, the first encryption method is the LUKS encryption method, and the second encryption method is a file system level encryption method. Exemplarily, the file system level encryption method can be any one of ecryptfs, EncFS, gocryptfs, and CryFs.

[0053] In this embodiment, if the ROOT system root partition and the DATA data partition of the system storage unit are constructed on the same physical partition, a single LUKS encryption key, a single encryption algorithm, and a key storage and retrieval method are directly used to construct a LUKS-encrypted partition directly on the physical partition, and the ROOT system root partition and the DATA data partition are constructed on the LUKS device decryption mapping device. If the ROOT system root partition and the DATA data partition of the system storage unit each exist in the form of a physical partition, a unified LUKS encryption key, a single encryption algorithm, and a key storage and retrieval method are used to construct LUKS-formatted partitions on each physical partition within the same system storage unit, and the ROOT system root partition and the DATA data partition are respectively constructed on the decryption mapping device of each LUKS device.

[0054] In this embodiment, data in each system storage unit is effectively isolated, allowing each user or team to have their own independent root partition and data partition, effectively protecting data privacy between users or teams. System performance can be optimized by selecting different system storage units for different application scenarios. For example, for tasks requiring high-performance computing, a system storage unit with a higher configuration can be selected; for tasks storing large amounts of data, a system storage unit with greater storage space can be selected.

[0055] In this embodiment, illustratively, the preset key acquisition address may correspond to any one of a Ukey, a trusted module platform device, and a cryptographic server.

[0056] Step S204: When any GRUB startup item is selected for startup, a configuration file storage unit corresponding to the key is obtained by decrypting the key according to the preset key acquisition address corresponding to the GRUB startup item to obtain a partition mount configuration file;

[0057] In another embodiment, a decryption configuration file may also be obtained from the configuration file storage unit. The decryption configuration file records the key storage device type and specific storage address where the system storage unit key is located.

[0058] Step S205: decrypt the system storage unit using the key obtained from the key storage device or the decrypted configuration file storage unit, and mount the decrypted system storage unit according to the corresponding partition mount configuration file.

[0059] In this embodiment, the key may be obtained through a pre-acquired key storage device, or a stored key may be obtained from a configuration file storage unit;

[0060] In another embodiment, the configuration file storage unit stores a decryption configuration file, which records the key storage device type and specific storage address where the key is located. Furthermore, the key is obtained through the record in the decryption configuration file, wherein the key storage device type can be any one of Ukey, trusted module platform device and password server.

[0061] This embodiment can perform a first encryption on multiple system storage units and a second encryption on a configuration file storage unit storing keys. The setting of multiple system storage units can realize the selection of mounting different systems according to the requirements of application scenarios, and has the characteristics of good confidentiality, wide application range and high reliability.

[0062] The technical solution disclosed in this embodiment prevents attackers from obtaining the decryption key of the system storage unit, making the attack more difficult. At the same time, attackers are also unable to obtain the mount configuration file. For highly confidential storage units among multiple system storage units, these highly confidential storage units can be effectively hidden within the other storage units, further enhancing the protection of critical data.

[0063] On the basis of the previous embodiment, in another embodiment of the present invention, as Figure 2 and Figure 3 , step S204, when any grub startup item is selected to start, the configuration file storage unit corresponding to the key decryption is obtained according to the preset key acquisition address corresponding to the grub startup item, including: establishing an associated configuration file, the associated configuration file is used to record the correspondence between the grub startup item, the preset key acquisition address and the configuration file storage unit. When any grub startup item is selected to start, the associated configuration file is queried, and the configuration file storage unit corresponding to the key decryption is obtained according to the corresponding preset key acquisition address.

[0064] In this embodiment, an associated configuration file is created in the temporary root file system initramfs.

[0065] In this embodiment, when the grub startup item is started, the partition mount configuration file and the key are transplanted to the conventional path, including: the crypttab file is transplanted to the / cryptroot directory of initramfs, the fstab file is transplanted to the / etc directory of initramfs, and the key is transplanted to the / scripts directory of initramfs. After the system storage unit is decrypted, the partitions in the system storage unit are mounted, thereby successfully starting the system of the selected grub startup item.

[0066] This embodiment can achieve unified mount management of all grub startup items by establishing an associated configuration file, and isolate internal data from each other, which has the characteristics of fast startup speed, good security and reliable performance.

[0067] In one embodiment of the present invention, Figure 1 As shown:

[0068] During the system installation phase, the administrator chooses to create three system storage units and sets the specific number and capacity of the ROOT system root partition and DATA data partition for each system storage unit. For example, system storage unit 1 is created, and the ROOT system root partition and DATA data partition are set for it, and configuration file storage unit 1 is set. Furthermore, for example, in system storage unit 1, all partitions in system storage unit 1 (one ROOT system root partition and one DATA data partition) will be LUKS encrypted partition by partition with the same key, and the key will be saved in a preset manner; in system storage unit 2, all partitions in system storage unit 2 will be LUKS encrypted partition by partition with another key different from that in system storage unit 1, and the key will be stored in a preset manner.

[0069] A configuration file storage unit of each system storage unit is generated in the temporary file system initramfs, and is encrypted using a file system level encryption method and the key is stored in a preset key acquisition address.

[0070] Generate an associated configuration file in the temporary file system initramfs in the form of a list. For example, the first line records: "grub startup item 1; configuration file storage unit 1; preset key acquisition address."

[0071] After the system is installed, for example, the user selects grub startup item 1, the init program of the temporary file system initramfs finds the entry of grub startup item 1 in the associated configuration file, obtains the configuration file storage unit 1 and the preset key acquisition address, obtains the key according to the preset key acquisition address, decrypts the configuration file storage unit 1, obtains the partition mounting configuration file, and uses the key obtained in the configuration file storage unit or the key storage device to decrypt the system storage unit 1, and mounts the ROOT system root partition and DATA data partition in the system storage unit 1 to realize the operation of the selected system and complete the startup of grub startup item 1.

[0072] like Figure 5 As shown, the present invention also discloses a system partition startup device capable of dual encryption, comprising:

[0073] Establishing module 501, used to establish a plurality of system storage units including partitions, each system storage unit establishes a corresponding configuration file storage unit, and the partition mounting configuration file of the system storage unit is stored in the corresponding configuration file storage unit;

[0074] A first encryption module 502 is configured to encrypt the system storage units using a first encryption method, and store the keys in the corresponding configuration file storage units or key storage devices;

[0075] The second encryption module 503 is used to encrypt the configuration file storage unit using a second encryption method, and the key is stored in a preset key acquisition address;

[0076] The startup module 504 is used to obtain the key decryption corresponding to the configuration file storage unit according to the preset key acquisition address corresponding to the grub startup item when any grub startup item is selected for startup, so as to obtain the partition mounting configuration file;

[0077] The mounting module 505 is configured to decrypt the system storage unit using a key obtained from the key storage device or the decrypted configuration file storage unit, and mount the decrypted system storage unit according to the corresponding partition mounting configuration file.

[0078] The present invention also discloses an electronic device, such as Figure 6 As shown, an embodiment is disclosed, which is a block diagram of an electronic device capable of booting a dual-encrypted system partition.

[0079] The electronic device 60 of this embodiment includes a processor 601, which can perform various appropriate actions and processes according to the program stored in the ROM 602 or the program loaded from the storage part 608 into the RAM 603. The processor 601 may include, for example, a general-purpose microprocessor, an instruction set processor and / or a related chipset and / or a dedicated microprocessor, etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiment of the present invention.

[0080] RAM 603 stores various programs and data required for the operation of electronic device 60. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 executes the programs in ROM 602 and / or RAM 603 to perform various operations according to the method flow of the embodiment of the present invention. It should be noted that the programs may also be stored in one or more memories other than ROM 602 and RAM 603, and processor 601 may also execute the programs stored in one or more memories to perform various operations according to the method flow of the embodiment of the present invention.

[0081] According to an embodiment of the present invention, the electronic device 60 may further include an I / O interface 605, which is also connected to the bus 604. The electronic device 60 may further include one or more of the following components connected to the I / O interface 605: an input unit 606 including a keyboard, a mouse, etc.; an output unit 607 including a cathode ray tube, a liquid crystal display, and a speaker; a storage unit 608 including a hard disk; and a communication unit 609 including a network interface card such as a LAN card or a modem. The communication unit 609 performs communication processing via a network such as the Internet. A drive 6010 is also connected to the I / O interface 605 as needed. Removable media 6011, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed in the drive 6010 as needed, so that computer programs read therefrom can be installed into the storage unit 608 as needed.

[0082] The present invention also provides a computer-readable storage medium.

[0083] The computer-readable storage medium may be included in the electronic device / device system described in the above embodiments, or may exist independently and not be incorporated into the electronic device / device. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of the present invention.

[0084] According to an embodiment of the present invention, a computer-readable storage medium may be a non-volatile computer-readable storage medium. Examples include, but are not limited to, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM) or flash memory, a portable compact disk read-only memory (CDROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0085] Embodiments of the present invention also include a computer program product.

[0086] The computer program product includes a computer program, which contains program code for executing the method provided by the embodiment of the present invention. When the computer program product runs on an electronic device, the program code is used to enable the electronic device to implement the method provided by the embodiment of the present invention.

[0087] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal over a network medium. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0088] According to an embodiment of the present invention, the program code for executing the computer program provided by the embodiment of the present invention can be written by any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level procedural and / or object-oriented programming languages. Programming languages ​​include, but are not limited to, Java, C++, Python, C language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network or a wide area network, or can be connected to an external computing device.

[0089] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of the systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each box in the flowchart or block diagram may represent a module, program segment, or portion of code, which contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the boxes may occur in an order different from that marked in the accompanying drawings. For example, two boxes shown in succession may actually be executed substantially in parallel, or they may sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, as well as the combination of boxes in the block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or may be implemented using a combination of dedicated hardware and computer instructions. It will be understood by those skilled in the art that the features described in the various embodiments and / or claims of the present invention may be combined and / or coupled in various ways, even if such combinations or couplings are not explicitly described in the present invention. In particular, without departing from the spirit and teachings of the present invention, the features described in the various embodiments and / or claims of the present invention may be combined and / or coupled in various ways, and all such combinations and / or couplings fall within the scope of the present invention.

[0090] The embodiments of the present invention have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present invention. Although each embodiment has been described above separately, this does not mean that the measures in each embodiment cannot be advantageously used in combination. The scope of the present invention is defined by the appended claims and their equivalents. Without departing from the scope of the present invention, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present invention.

Claims

1. A system partition startup method capable of dual encryption, characterized in that: include: Establishing a plurality of system storage units including partitions, establishing a corresponding configuration file storage unit for each of the system storage units, and storing the partition mounting configuration files of the system storage units in the corresponding configuration file storage unit; Encrypting the system storage units respectively using a first encryption method, and storing the keys in the corresponding configuration file storage units or key storage devices; The configuration file storage unit is encrypted using a second encryption method, and the key is stored in a preset key acquisition address; When any grub startup item is selected to start, the configuration file storage unit corresponding to the key decryption is obtained according to the preset key acquisition address corresponding to the grub startup item to obtain the partition mount configuration file; The system storage unit is decrypted using a key obtained from the key storage device or the decrypted configuration file storage unit, and the decrypted system storage unit is mounted according to the corresponding partition mounting configuration file.

2. The method for booting a system partition capable of dual encryption according to claim 1, characterized in that: The method comprises: establishing an associated configuration file, wherein the associated configuration file is used to record the correspondence between the grub startup item, the preset key acquisition address, and the configuration file storage unit; and when any grub startup item is selected to start, querying the associated configuration file and obtaining the configuration file storage unit corresponding to the key decryption according to the corresponding preset key acquisition address.

3. The method for booting a system partition capable of dual encryption according to claim 1, wherein: The first encryption method is a LUKS encryption method, and the second encryption method is a file system level encryption method.

4. The method for booting a system partition capable of dual encryption according to claim 1, wherein: The system storage unit includes a ROOT system root partition and a DATA data partition.

5. The method for booting a system partition capable of dual encryption according to claim 1, wherein: The configuration file storage unit is stored in a temporary root file system.

6. The method for booting a system partition capable of dual encryption according to claim 1, wherein: A plurality of system storage units are established, and the system storage units are encrypted respectively using a first encryption method, including: different keys of the system storage units are different.

7. The method for booting a system partition capable of dual encryption according to claim 1, wherein: The key storage device includes any one of: Ukey, trusted module platform device and password server.

8. A dual-encrypted system partition boot device, characterized by: The device comprises: An establishment module, configured to establish a plurality of system storage units including partitions, wherein each of the system storage units establishes a corresponding configuration file storage unit, and the partition mounting configuration file of the system storage unit is stored in the corresponding configuration file storage unit; a first encryption module, configured to encrypt the system storage units respectively using a first encryption method, and store a key in the corresponding configuration file storage unit or key storage device; A second encryption module is used to encrypt the configuration file storage unit using a second encryption method, and the key is stored in a preset key acquisition address; A startup module, configured to, when any grub startup item is selected for startup, obtain the configuration file storage unit corresponding to the key decryption according to the preset key acquisition address corresponding to the grub startup item, and obtain the partition mount configuration file; The mounting module is used to decrypt the system storage unit using the key obtained from the key storage device or the decrypted configuration file storage unit, and mount the decrypted system storage unit according to the corresponding partition mounting configuration file.

9. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are caused to perform the method according to any one of claims 1 to 7.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images