Encrypted information migration method, apparatus and device, and readable storage medium

Abstract

The invention discloses an encrypted information migration method, device and equipment and a readable storage medium, and is applied to the field of computers, and the method comprises the following steps: obtaining source volume encrypted information corresponding to a source volume based on a meta-file position of the source volume; the disk physical sector capacity of the target volume is obtained, and the target volume Dbr is read from a target volume Dbr sector based on the disk physical sector capacity of the target volume to generate a target volume encryption meta-file; obtaining a copied source volume obtained based on source volume copying, setting the encrypted capacity of the copied source volume to be 0, and setting the encryption state to be an encryption pause state; and processing the target volume Dbr and the target volume encryption meta-file based on the source volume Dbr and the source volume encryption information of the copied source volume to obtain the target volume encrypted based on the source volume encryption information. According to the method, the encryption method in the source volume encryption information can be directly migrated to the target volume, and the Dbr content of the target volume can be automatically set based on requirements, so that the content of the target volume does not need to be limited, and more flexible encryption is realized.

Description

Technical Field

[0001] This invention relates to the field of computers, and in particular to a method, apparatus, device, and readable storage medium for encrypting information migration. Background Technology

[0002] Currently, when a destination volume with the same encryption method as the source volume is obtained, the source volume is usually copied as a whole according to its encryption state to generate the destination volume. This can achieve the desired effect, but it is not very meaningful. The main issues are that the destination volume can only be newly generated and cannot be operated on on an existing volume. In addition, the generated destination volume is completely identical to the source volume (including volume parameters), so its application is not very meaningful.

[0003] It is evident that how to migrate encrypted information from the source volume and improve the flexibility of encryption is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a method, apparatus, device and readable storage medium for transferring encrypted information, which solves the technical problem that the prior art cannot realize the transfer of encrypted volume information.

[0005] To address the aforementioned technical problems, this invention provides a method for transferring encrypted information, comprising:

[0006] The location of the source volume's metafiles is obtained by analyzing the contents of the source volume Dbr.

[0007] Obtain the source volume encryption information corresponding to the source volume based on the source volume's meta file location;

[0008] Obtain the physical sector capacity of the target volume's disk, read the target volume Dbr from the target volume Dbr sector based on the target volume's physical sector capacity, and generate the target volume encrypted metafile based on the source volume's encryption information;

[0009] The destination volume Dbr and the destination volume encryption metafile are processed to obtain the destination volume encrypted based on the source volume encryption information.

[0010] Optionally, before analyzing the contents of the source volume Dbr to obtain the metafile location of the source volume, the following steps are also included:

[0011] Set the source volume to an unlocked state;

[0012] Set the BitLocker protector of the source volume to a disabled state to put the source volume in a plaintext key protected state.

[0013] Optionally, the physical sector capacity of the destination volume's disk is obtained, the destination volume Dbr is read from the destination volume Dbr sector based on the physical sector capacity of the destination volume's disk, and a destination volume encrypted metafile is generated based on the source volume encryption information, including:

[0014] Generate the FVE2 file in the system volume information directory of the destination volume;

[0015] The destination volume Dbr is read from the destination volume Dbr sector based on the physical sector capacity of the destination volume disk;

[0016] Store the destination volume Dbr into the FVE2 file and record the location of the first metafile corresponding to the destination volume Dbr.

[0017] Optionally, the physical sector capacity of the destination volume's disk is obtained, the destination volume Dbr is read from the destination volume Dbr sector based on the physical sector capacity of the destination volume's disk, and a destination volume encrypted metafile is generated based on the source volume encryption information, including:

[0018] The destination volume encrypted metafile is generated based on the source volume encryption information, and the location of the second metafile corresponding to the destination volume encrypted metafile is recorded.

[0019] Accordingly, the destination volume Dbr and the destination volume encryption metafile are processed to obtain the destination volume encrypted based on the source volume encryption information, including:

[0020] Based on the first metafile location and the second metafile location, the destination volume Dbr and the destination volume encryption metafile are processed to obtain the destination volume encrypted based on the source volume encryption information.

[0021] Optionally, the destination volume Dbr and the destination volume encryption metafile are processed to obtain a destination volume encrypted based on the source volume encryption information, including:

[0022] The destination volume Dbr and the destination volume encrypted metafile are processed using BitLocker rules to obtain the destination volume encrypted based on the source volume encryption information.

[0023] Optionally, after processing the destination volume Dbr and the destination volume encryption metafile to obtain the destination volume encrypted based on the source volume encryption information, the method further includes:

[0024] Reload the destination volume, which is encrypted based on the source volume encryption information;

[0025] Enable BitLocker protectors for both the source and destination volumes.

[0026] This invention also provides an encrypted information migration device, comprising:

[0027] The source volume metafile location determination module is used to analyze the contents of the source volume Dbr to obtain the source volume metafile location;

[0028] The source volume encryption information determination module is used to obtain the source volume encryption information corresponding to the source volume based on the meta file location of the source volume;

[0029] The destination volume Dbr and metafile determination module is used to obtain the physical sector capacity of the disk of the destination volume, read the destination volume Dbr from the sectors of the destination volume Dbr based on the physical sector capacity of the disk of the destination volume, and generate the destination volume encrypted metafile based on the source volume encryption information.

[0030] The encrypted destination volume determination module is used to process the destination volume Dbr and the destination volume encryption metafile to obtain the destination volume encrypted based on the source volume encryption information.

[0031] Optionally, the encrypted information migration device provided in this embodiment of the invention may further include:

[0032] An unlock status setting module is used to set the source volume to an unlocked state;

[0033] The plaintext key protection status determination module is used to set the BitLocker protector of the source volume to a disabled state, so that the source volume is in a plaintext key protection state.

[0034] This invention also provides an encrypted information migration device, comprising:

[0035] Memory, used to store computer programs;

[0036] A processor for executing the computer program to implement the steps of the above-described encrypted information migration method.

[0037] This invention also provides a readable storage medium (i.e., a computer-readable storage medium) storing a computer program, which, when executed by a processor, implements the steps of the above-described encrypted information migration method.

[0038] This invention also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the above-described encrypted information migration method.

[0039] As can be seen, this invention obtains the metafile location of the source volume by analyzing the content of the source volume Dbr; obtains the corresponding source volume encryption information based on the source volume metafile location; obtains the physical sector capacity of the target volume's disk; reads the target volume Dbr from the target volume Dbr sectors based on the target volume's physical sector capacity; and generates a target volume encrypted metafile based on the source volume encryption information; processes the target volume Dbr and the target volume encrypted metafile to obtain the target volume encrypted based on the source volume encryption information. Compared with the current method of inflexibly migrating encrypted information, this invention generates an encrypted target volume file based on the source volume's encryption information, thereby directly migrating the encryption method in the source volume's encryption information to the target volume. Furthermore, since the content of the target volume Dbr can be customized according to requirements, it can achieve more flexible encryption without limiting the content of the target volume.

[0040] In addition, the present invention also provides an encrypted information migration device, equipment, and readable storage medium, which also have the above-mentioned beneficial effects. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0042] Figure 1 A flowchart of an encrypted information migration method provided in an embodiment of the present invention;

[0043] Figure 2 A flowchart illustrating an encrypted information migration method provided in an embodiment of the present invention;

[0044] Figure 3 This is a schematic diagram of the structural framework of an encrypted information migration device provided in an embodiment of the present invention;

[0045] Figure 4 This is a schematic diagram of the structural framework of an encrypted information migration device provided in an embodiment of the present invention. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] Some terms that appear in the description of the embodiments of this application are subject to the following interpretation:

[0048] Dbr: Partition Boot Record (DOS BOOT RECORD)

[0049] Physical sector: refers to one of the physical parameters of a disk, and is a fundamental parameter of the disk;

[0050] FVE2: The BitLocker volume metafile, which works with the BitLocker volume filter driver to complete BitLocker's encryption and decryption volume services;

[0051] Metafiles: These are files generated by BitLocker on a corresponding volume to support its business functions.

[0052] BitLocker rules refer to the metadata files that BitLocker stores on the target volume in a format that it plans to meet its own needs for managing encrypted volumes. The contents of the metadata files can intuitively reflect the different capacities, file systems, and encryption states of the volumes. Therefore, if you want to adapt to a new volume, you also need to rewrite the relevant metadata file contents according to these rules.

[0053] Please refer to Figure 1 , Figure 1 A flowchart illustrating an encrypted information migration method provided in an embodiment of the present invention. The method may include:

[0054] S101, Analyze the contents of the source volume Dbr to obtain the location of the source volume's metafile.

[0055] The execution subject in this embodiment is an electronic device. This electronic device can be a server, computer, etc. In this embodiment, the source volume Dbr refers to the partition boot sector of the source volume. In this embodiment, the contents of the source volume Dbr can be analyzed to determine the location of the source volume's metadata.

[0056] It should be further noted that, based on any of the above embodiments, in order to obtain the relevant content of the source volume, before analyzing the content of the source volume Dbr to obtain the metafile location of the source volume, the following may also be included:

[0057] Step 1: Set the source volume to unlocked;

[0058] Step 2: Disable the BitLocker protector on the source volume to put the source volume under plaintext key protection.

[0059] In this embodiment, the source volume needs to be in an unlocked state. Disabling the BitLocker protector on the source volume allows for successful access and decryption of its contents (the reason is not detailed here), thus facilitating analysis of the source volume and the acquisition of relevant BitLocker metafiles. This embodiment ensures the source volume is protected with a unified plaintext key by disabling the BitLocker protector, allowing subsequent operations to proceed smoothly. In this embodiment, if the source volume is locked, the current process stops; that is, the source volume must be unlocked for the migration of encrypted information to proceed.

[0060] S102, Obtain the source volume encryption information corresponding to the source volume based on the source volume's metafile location.

[0061] In this embodiment, the metafile can be determined based on the location of the metafile in the source volume, and then the metafile can be analyzed to obtain the source volume encryption information. This embodiment does not limit the specific source volume encryption information; for example, the source volume encryption information in this embodiment can be encryption information obtained based on a password protection method protector; or the source volume encryption information in this embodiment can be an encryption password.

[0062] S103, obtain the physical sector capacity of the target volume's disk, read the target volume Dbr from the target volume Dbr sector based on the target volume's physical sector capacity, and generate the target volume encrypted metafile based on the source volume's encryption information.

[0063] This embodiment obtains the physical sector capacity of the target volume's disk, which can be denoted as V1. If V1 is less than 8192 bytes, then V1 is recorded as 8192 bytes. In the System Volume Information directory of the target volume (if this directory does not exist, it needs to be created), the length of the target volume's Dbr sector is recorded as V1, resulting in the FVE2 metafile related to the target volume's Dbr. In this embodiment, another volume encryption metafile is generated in the same directory. This embodiment does not limit the specific volume encryption source file. For example, in this embodiment, the volume encryption metafile consists of three identical metafiles. In this case, these three metafiles, like the previous FVE2 metafiles related to the Dbr content, need to be stored contiguously. In this embodiment, the process of generating the destination volume encrypted metafile based on the source volume's encrypted information can be achieved by generating three additional metafiles in the same directory, each 65536 characters long, named FVE2.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.1,2,3. The contents of these metafiles can be copied from the corresponding metafiles of the source volume, with some modifications made, including changing the encryption status to a paused state and setting the encrypted capacity to 0. The contents of these three files are identical.

[0064] It should be further explained that, based on any of the above embodiments, the process of obtaining the physical sector capacity of the target volume's disk, reading the target volume's Dbr sector based on the target volume's physical sector capacity, and generating the target volume's encrypted metafile based on the source volume's encryption information may include:

[0065] S1031, Generate the FVE2 file in the system volume information directory of the destination volume;

[0066] S1032, Read the destination volume Dbr sector from the destination volume Dbr sector based on the destination volume's physical sector capacity;

[0067] S1033, store the destination volume Dbr to the FVE2 file and record the location of the first metafile corresponding to the destination volume Dbr.

[0068] In this embodiment, a file FVE2.{24e6f0ae-6a00-4f73-984b-75ce9942852d} is generated in the System Volume Information directory (if it does not exist, it needs to be created). The FVE2 file in this embodiment is FVE2.{24e6f0ae-6a00-4f73-984b-75ce9942852d}. This embodiment requires generating the destination System Volume Information in the destination volume; if it already exists, this step is skipped. In this embodiment, the length of V1 (the physical sector capacity of the destination volume's disk) is read from the Dbr sector of the destination volume and recorded in the FVE2 file, with the starting position of the FVE2 file recorded as P0 (byte). In this embodiment, if the physical sector capacity of the destination volume's disk is less than 8192 bytes, then the starting position is determined to be 8192 bytes. In this embodiment, the first metafile position is the starting position.

[0069] It should be further explained that, based on any of the above embodiments, the process of obtaining the physical sector capacity of the target volume's disk, reading the target volume Dbr from the target volume Dbr sector based on the target volume's physical sector capacity, and generating a target volume encrypted metafile based on the source volume's encryption information can include: generating a target volume encrypted metafile based on the source volume's encryption information and recording the location of the second metafile corresponding to the target volume encrypted metafile; correspondingly, processing the target volume Dbr and the target volume encrypted metafile to obtain a target volume encrypted based on the source volume's encryption information can include: processing the target volume Dbr and the target volume encrypted metafile based on the source volume Dbr and source volume encryption information corresponding to the copied source volume, the location of the first metafile, and the location of the second metafile, to obtain a target volume encrypted based on the source volume's encryption information. In this embodiment, three additional files with a length of 65536 are generated in the same directory. The file names are FVE2.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.1,2,3. The content consists of the metafiles corresponding to the source volume, and the positions of these three files are recorded as P1, P2, and P3 respectively. The metafile position information is then modified to P0~P3. This embodiment provides a detailed process for obtaining the destination volume encrypted based on the source volume's encryption information, improving the accuracy of obtaining the destination volume encrypted based on the source volume's encryption information.

[0070] S104, process the destination volume Dbr and the destination volume encrypted metafile to obtain the destination volume encrypted based on the source volume encryption information.

[0071] This embodiment can copy the Dbr information of the source volume to the destination volume and modify the copied Dbr information according to the parameters of the destination volume.

[0072] It should be further explained that, based on any of the above embodiments, the above processing of the destination volume Dbr and the destination volume encrypted metafile to obtain the destination volume encrypted based on the source volume encryption information can include: processing the destination volume Dbr and the destination volume encrypted metafile using BitLocker rules to obtain the destination volume encrypted based on the source volume encryption information. This embodiment can modify the content of the destination volume's Dbr according to BitLocker rules. This step can be performed by copying and modifying the source volume's Dbr, accordingly modifying the destination volume's capacity information, and changing the metafile location information fields to P0~P3.

[0073] It should be further explained that, based on any of the above embodiments, after processing the destination volume Dbr and the destination volume encryption metafile to obtain the destination volume encrypted based on the source volume encryption information, the process may further include: reloading the destination volume encrypted based on the source volume encryption information; and enabling the BitLocker protectors for both the source and destination volumes. In this embodiment, the destination volume is remounted, and obviously, at this point, the destination volume is in a state of encrypted volume with encryption paused, and the protector is disabled. The BitLocker is then notified via an IO call to resume the encryption process for the destination volume, and finally, the BitLocker protectors for both the source and destination volumes are enabled.

[0074] The encryption operation on the destination volume is completed. This means the entire process is finished, the destination volume is now encrypted, and the decryption and authentication process is identical to that of the source volume.

[0075] An embodiment of the present invention provides a method for migrating encrypted information, which may include: S101, analyzing the content of the source volume Dbr to obtain the metafile location of the source volume; S102, obtaining the source volume encryption information corresponding to the source volume based on the metafile location of the source volume; S103, obtaining the physical sector capacity of the disk of the destination volume, reading the destination volume Dbr from the sectors of the destination volume Dbr based on the physical sector capacity of the disk of the destination volume, and generating an encrypted metafile of the destination volume based on the encrypted information of the source volume; S104, processing the destination volume Dbr and the encrypted metafile of the destination volume to obtain the destination volume encrypted based on the encrypted information of the source volume. The beneficial effects of the present invention are: compared with the current inflexible migration of encrypted information, the present invention generates an encrypted file of the destination volume based on the encrypted information of the source volume, thereby enabling the direct migration of the encryption method in the encrypted information of the source volume to the destination volume. Moreover, since the content of the destination volume Dbr can be set according to requirements, it is possible to achieve encryption without limiting the content of the destination volume, thus achieving more flexible encryption.

[0076] When creating a new encrypted volume, the BitLocker service first generates a BitLocker service metadata file based on the authentication method and password. It then saves the destination volume's DBR according to the physical sector capacity and rewrites the DBR content with BitLocker volume-specific information. The encryption process then begins. From the above process, it can be seen that if the entire encryption process is paused after metadata generation and DBR rewriting, the entire volume data is actually completely plaintext. This leads to the entire process described in this invention.

[0077] For a clearer understanding of this invention, please refer to the following details. Figure 2 , Figure 2 A flowchart illustrating an encrypted information migration method provided in this embodiment of the invention may specifically include:

[0078] S201. Set the source volume to unlocked state.

[0079] The method provided by this invention can quickly and efficiently apply BitLocker encryption information from a specified source volume to a destination volume, allowing the destination volume to enter an encrypted protection state using the source volume's encryption authentication method. This results in a better user experience. Furthermore, the contents of the source and destination volumes can be different, as long as the file systems remain consistent. BitLocker is a volume encryption service provided by Microsoft. When using the BitLocker service, after unlocking via a specified authentication method (which can be automatic), users can transparently perform plaintext I / O (input / output) operations at the volume level.

[0080] S202. Disable the BitLocker protector on the source volume.

[0081] In this embodiment, the source volume needs to be in an unlocked state before subsequent operations can be performed. If the source volume is in a locked state, the current process is stopped. The BitLocker protector of the source volume is disabled, so that the source volume is in a state of unified plaintext key protection.

[0082] S203. Based on the source volume's unlocked state and protector disabled state, analyze the source volume to obtain the source volume Dbr, and analyze the contents of the source volume Dbr to obtain the source volume's metafile location.

[0083] S204. Obtain the encrypted information of the source volume based on the metafile location of the source volume.

[0084] This embodiment analyzes the source volume to obtain the source volume Dbr, thereby obtaining the metafile location. Then, it analyzes and obtains the source volume metafile to acquire encryption-related information (encryption information of the source volume). In this embodiment, the location of the BitLocker-related metafiles of the source volume is obtained through information in the source volume Dbr. The BitLocker metafile is analyzed to obtain the necessary encrypted volume information. The current method requires the source volume to be in a fully encrypted state.

[0085] S205. Obtain the physical sector capacity of the target volume's disk, denoted as V1; where the physical sector capacity of the disk is less than 8192 bytes, it is denoted as 8192 bytes.

[0086] In this embodiment, the physical sector capacity of the target volume's disk is obtained and denoted as V1. If V1 is less than 8192 bytes, then V1 is recorded as 8192 bytes. In this embodiment, the logical sector capacity (in bytes) of the target volume's disk is obtained and denoted as V1. This parameter must be consistent with the corresponding parameter of the source volume; otherwise, the current process is stopped.

[0087] S206. Generate an FVE2 file in the system volume information directory of the destination volume, read the V1 length of the Dbr sector of the destination volume to obtain the first metafile, store the first metafile in the FVE2 file, and record the position of the first metafile.

[0088] In this embodiment, the first metafile is used to record Dbr information. Based on the physical sector capacity of the disk, the first metafile is read from the Dbr sectors and stored in the FVE2 file. In this embodiment, the first metafile corresponds to the destination volume Dbr mentioned above. In this embodiment, FVE2.{24e6f0ae-6a00-4f73-984b-75ce9942852d} is generated in the System Volume Information directory of the destination volume. The Dbr sectors are read to a length of V1, recorded in this file, and the file position is recorded as P0 (the position of the first metafile).

[0089] S207. Generate a second metafile in the same system volume information directory; wherein, the second metafile is used to record the encryption information of the source volume.

[0090] In this embodiment, the second metafile (corresponding to the encrypted metafile of the destination volume mentioned above) includes the contents of three identical metafiles. This embodiment can copy the source volume to obtain a copied source volume. The encryption status of the metafiles in the copied source volume is modified to a paused encryption state, and the encrypted capacity is set to 0. This copied source volume is used as the second metafile. That is, this embodiment can generate three additional metafiles in the same directory, which must also be stored contiguously. The filename is FVE2.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.1,2,3. The length is 65536, and the content is the metafile corresponding to the source volume. The positions of these three files are also recorded as P1, P2, and P3 respectively. The encryption status of the above metafiles is modified to a paused encryption state, and the encrypted capacity is set to 0.

[0091] S208. Based on the above steps, modify the contents of the destination volume according to the BitLocker rules to obtain the destination volume encrypted based on the source volume encryption information.

[0092] S209. Remount the destination volume, notify the BitLocker service via IO call to resume the encryption process of the destination volume, and finally enable the BitLocker protector for both the source and destination volumes.

[0093] In this embodiment, the destination volume is remounted. An I / O call is used to notify BitLocker to resume the encryption process on the destination volume. Finally, the BitLocker protectors for both the source and destination volumes are enabled.

[0094] This invention allows for the migration of BitLocker encrypted information through BitLocker's own operations, achieving an operational purpose independent of specific data. By analyzing and modifying the BitLocker metafile, the destination volume can be modified into a BitLocker volume with encryption paused and an encrypted capacity of 0, thus laying the foundation for subsequent operations. Since the first metafile content of the destination volume is based on the destination volume's own settings, the source and destination volumes can differ in size and content. Furthermore, the destination volume does not need to be created. The source and destination volumes can even be located in different environments.

[0095] The encrypted information migration device provided in the embodiments of the present invention will be described below. The encrypted information migration device described below can be referred to in correspondence with the encrypted information migration method described above.

[0096] Please refer to the details. Figure 3 , Figure 3 A schematic diagram of the structural framework of an encrypted information migration device provided in an embodiment of the present invention may include:

[0097] The source volume metafile location determination module 100 is used to analyze the contents of the source volume Dbr to obtain the source volume metafile location;

[0098] The source volume encryption information determination module 200 is used to obtain the source volume encryption information corresponding to the source volume based on the meta file location of the source volume;

[0099] The destination volume Dbr and metafile determination module 300 is used to obtain the physical sector capacity of the disk of the destination volume, read the destination volume Dbr from the sector of the destination volume Dbr based on the physical sector capacity of the disk of the destination volume, and generate the destination volume encrypted metafile based on the source volume encryption information.

[0100] The encrypted destination volume determination module 400 is used to process the destination volume Dbr and the destination volume encryption metafile to obtain the destination volume encrypted based on the source volume encryption information.

[0101] Furthermore, based on any of the above embodiments, the encrypted information migration device may further include:

[0102] An unlock status setting module is used to set the source volume to an unlocked state;

[0103] The plaintext key protection status determination module is used to set the BitLocker protector of the source volume to a disabled state, so that the source volume is in a plaintext key protection state.

[0104] Furthermore, based on any of the above embodiments, the destination volume Dbr and metafile determination module 300 may include:

[0105] The FVE2 file determination unit is used to generate an FVE2 file in the system volume information directory of the destination volume.

[0106] The destination volume Dbr determination unit is used to read the destination volume Dbr from the destination volume Dbr sector based on the physical sector capacity of the disk of the destination volume;

[0107] The first metafile location determination unit is used to store the destination volume Dbr into the FVE2 file and record the first metafile location corresponding to the destination volume Dbr.

[0108] Furthermore, based on the above embodiments, the destination volume Dbr and metafile determination module 300 may include:

[0109] The second metafile location determination unit is used to generate the destination volume encrypted metafile based on the source volume encryption information, and record the location of the second metafile corresponding to the destination volume encrypted metafile.

[0110] Correspondingly, the encrypted destination volume determination module 400 may include:

[0111] The encrypted destination volume determination unit is used to process the destination volume Dbr and the destination volume encrypted metafile based on the first metafile location and the second metafile location to obtain the destination volume encrypted based on the source volume encryption information.

[0112] Furthermore, based on any of the above embodiments, the encrypted destination volume determination module 400 may include:

[0113] The encrypted destination volume unit is determined based on BitLocker rules, and is used to process the destination volume Dbr and the destination volume encrypted metafile using BitLocker rules to obtain the destination volume encrypted based on the source volume encryption information.

[0114] Furthermore, based on any of the above embodiments, the encrypted information migration device may further include:

[0115] The reload module is used to reload the destination volume encrypted based on the source volume encryption information;

[0116] Enable protector module, used to enable BitLocker protectors for the source and destination volumes.

[0117] It should be noted that the order of the modules and units in the above-mentioned encrypted information migration device can be changed without affecting the logic.

[0118] This invention provides an encrypted information migration device, which may include: a source volume metadata location determination module 100, used to analyze the content of the source volume Dbr to obtain the source volume metadata location; a source volume encrypted information determination module 200, used to obtain the source volume encrypted information corresponding to the source volume based on the source volume metadata location; a destination volume Dbr and metadata determination module 300, used to obtain the physical sector capacity of the destination volume's disk, read the destination volume Dbr from the sectors of the destination volume Dbr based on the physical sector capacity of the destination volume's disk, and generate a destination volume encrypted metadata file based on the source volume encrypted information; and an encrypted destination volume determination module 400, used to process the destination volume Dbr and the destination volume encrypted metadata file to obtain a destination volume encrypted based on the source volume encrypted information. Compared with the current inflexible migration of encrypted information, this invention generates an encrypted destination volume file based on the source volume's encrypted information, thereby enabling the direct migration of the encryption method in the source volume's encrypted information to the destination volume. Furthermore, since the content of the destination volume Dbr can be set according to requirements, it can achieve more flexible encryption without limiting the content of the destination volume.

[0119] The following describes an encrypted information migration device provided by an embodiment of the present invention. The encrypted information migration device described below can be referred to in correspondence with the encrypted information migration method described above.

[0120] Please refer to Figure 4 , Figure 4 A schematic diagram of the structural framework of an encrypted information migration device provided in an embodiment of the present invention may include:

[0121] Memory 10 is used to store computer programs;

[0122] Processor 20 is used to execute computer programs to implement the encrypted information migration method described above.

[0123] The memory 10, processor 20, and communication interface 30 all communicate with each other through the communication bus 40.

[0124] In this embodiment of the invention, the memory 10 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment of the invention, the memory 10 may store programs for implementing the following functions:

[0125] The location of the source volume's metafiles is obtained by analyzing the contents of the source volume Dbr.

[0126] Obtain the source volume encryption information corresponding to the source volume based on the source volume's meta file location;

[0127] Obtain the physical sector capacity of the target volume's disk, read the target volume's Dbr sector based on the target volume's physical sector capacity, and generate the target volume's encrypted metafile based on the source volume's encryption information;

[0128] The destination volume Dbr and the destination volume encrypted metafile are processed to obtain the destination volume encrypted based on the source volume encryption information.

[0129] In one possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0130] Furthermore, memory 10 may include read-only memory and random access memory, providing instructions and data to the processor. A portion of the memory may also include NVRAM. The memory stores operating systems and operating instructions, executable modules, or data structures, or subsets thereof, or extended sets thereof, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and handling hardware-based tasks.

[0131] Processor 20 can be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic device. Processor 20 can be a microprocessor or any conventional processor. Processor 20 can call programs stored in memory 10.

[0132] The communication interface 30 can be an interface for the communication module, used to connect with other devices or systems.

[0133] Of course, it should be noted that, Figure 4 The structure shown does not constitute a limitation on the encrypted information migration device in the embodiments of the present invention. In practical applications, the encrypted information migration device may include devices that are more advanced than those described above. Figure 4 More or fewer components as shown, or combinations of certain components.

[0134] The following describes the computer-readable storage medium provided in the embodiments of the present invention. The computer-readable storage medium described below can be referred to in correspondence with the encrypted information migration method described above.

[0135] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described encrypted information migration method.

[0136] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0137] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0138] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0139] Finally, it should be noted that in this document, relationships such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0140] The above provides a detailed description of the encrypted information migration method, apparatus, device, and readable storage medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for migrating encrypted information, characterized in that, include: The location of the source volume's metafiles is obtained by analyzing the contents of the source volume Dbr. The source volume encryption information corresponding to the source volume is obtained based on the meta file location of the source volume; Obtain the physical sector capacity of the target volume's disk, read the target volume Dbr from the target volume Dbr sector based on the target volume's physical sector capacity, and generate the target volume encrypted metafile based on the source volume's encryption information; The destination volume Dbr and the destination volume encryption metafile are processed to obtain the destination volume encrypted based on the source volume encryption information.

2. The encrypted information migration method according to claim 1, characterized in that, Before analyzing the contents of the source volume Dbr to determine the location of the source volume's metafiles, the following steps are also included: Set the source volume to an unlocked state; Set the BitLocker protector of the source volume to a disabled state to put the source volume in a plaintext key protected state.

3. The encrypted information migration method according to claim 1, characterized in that, Obtain the physical sector capacity of the target volume's disk; read the target volume's Dbr sector based on the target volume's physical sector capacity; and generate a target volume encrypted metafile based on the source volume's encryption information, including: Generate the FVE2 file in the system volume information directory of the destination volume; The destination volume Dbr is read from the destination volume Dbr sector based on the physical sector capacity of the destination volume disk; Store the destination volume Dbr into the FVE2 file and record the location of the first metafile corresponding to the destination volume Dbr.

4. The encrypted information migration method according to claim 3, characterized in that, Obtain the physical sector capacity of the target volume's disk; read the target volume's Dbr sector based on the target volume's physical sector capacity; and generate a target volume encrypted metafile based on the source volume's encryption information, including: The destination volume encrypted metafile is generated based on the source volume encryption information, and the location of the second metafile corresponding to the destination volume encrypted metafile is recorded. Accordingly, the destination volume Dbr and the destination volume encryption metafile are processed to obtain the destination volume encrypted based on the source volume encryption information, including: Based on the first metafile location and the second metafile location, the destination volume Dbr and the destination volume encryption metafile are processed to obtain the destination volume encrypted based on the source volume encryption information.

5. The encrypted information migration method according to any one of claims 1 to 4, characterized in that, The destination volume Dbr and the destination volume encryption metafile are processed to obtain the destination volume encrypted based on the source volume encryption information, including: The destination volume Dbr and the destination volume encrypted metafile are processed using BitLocker rules to obtain the destination volume encrypted based on the source volume encryption information.

6. The encrypted information migration method according to claim 1, characterized in that, After processing the destination volume Dbr and the destination volume encryption metafile to obtain the destination volume encrypted based on the source volume encryption information, the process further includes: Reload the destination volume, which is encrypted based on the source volume encryption information; Enable BitLocker protectors for both the source and destination volumes.

7. An encrypted information migration device, characterized in that, include: The source volume metafile location determination module is used to analyze the contents of the source volume Dbr to obtain the source volume metafile location; The source volume encryption information determination module is used to obtain the source volume encryption information corresponding to the source volume based on the meta file location of the source volume; The destination volume Dbr and metafile determination module is used to obtain the physical sector capacity of the disk of the destination volume, read the destination volume Dbr from the sectors of the destination volume Dbr based on the physical sector capacity of the disk of the destination volume, and generate the destination volume encrypted metafile based on the source volume encryption information. The encrypted destination volume determination module is used to process the destination volume Dbr and the destination volume encryption metafile to obtain the destination volume encrypted based on the source volume encryption information.

8. The encrypted information migration device according to claim 7, characterized in that, Also includes: An unlock status setting module is used to set the source volume to an unlocked state; The plaintext key protection status determination module is used to set the BitLocker protector of the source volume to a disabled state, so that the source volume is in a plaintext key protection state.

9. An encrypted information migration device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the encrypted information migration method as described in any one of claims 1 to 6.

10. A readable storage medium, characterized in that, The readable storage medium stores a computer program that, when executed by a processor, implements the steps of the encrypted information migration method as described in any one of claims 1 to 6.

Images