Encryption method, encryption device, starting method, starting device and terminal equipment
By writing the boot program and key to a separate storage device and encrypting the entire disk in the mobile device, the problem of data leakage caused by the unencrypted boot partition is solved, and the confidentiality and integrity of the data are guaranteed.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING CHJ AUTOMOTIVE TECH CO LTD
- Filing Date
- 2024-11-18
- Publication Date
- 2026-05-19
AI Technical Summary
In existing mobile device encryption technologies, the boot partition is not encrypted, allowing malicious attackers to obtain keys and other data through offline attacks, thus compromising data integrity.
The boot program and key are written to a separate storage device from the boot partition and the encrypted partition, and then fully encrypted. The boot program and kernel are loaded through multi-level decryption, and the encrypted partition is decrypted and mounted through the algorithm parameter configuration file.
It ensures the confidentiality and integrity of mobile device data, guarantees the security of keys, and achieves full-disk encryption.
Smart Images
Figure CN122065321A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data security technology, specifically to a mobile device encryption method, a mobile device boot method, a mobile device encryption device, a mobile device boot device, a machine-readable storage medium, and a terminal device. Background Technology
[0002] Currently, mobile devices such as cars, mobile phones, and wearable devices are developing rapidly, and the data security of these devices has a significant impact on their use. Encryption technology can currently ensure the confidentiality of device data, preventing it from being obtained by malicious attackers. For example, in Linux systems, files or partitions are encrypted for security reasons; however, current encryption technology for mobile devices typically only encrypts partitions. Figure 1 As shown, the kernel, bootloader, and keys of existing mobile devices are usually stored in the boot partition. The boot partition itself is not encrypted; only the encrypted partition is encrypted. This allows malicious attackers to obtain keys and other data through offline attacks, making it impossible to guarantee the integrity of the data. Summary of the Invention
[0003] The purpose of this application is to provide a mobile device encryption method, encryption device, startup method, startup device, and terminal device to solve the problems of existing technologies that allow malicious attackers to easily obtain data and cannot guarantee data integrity.
[0004] To achieve the above objectives, a first aspect of this application provides an encryption method applied to a data carrier, the data carrier including a first memory and a second memory, the method comprising:
[0005] A first key is obtained from the first memory, and the kernel file and the boot program are encrypted using the first key and a first encryption algorithm. The kernel file and the boot program are stored in the boot partition of the second memory.
[0006] The encrypted partition of the second memory is encrypted using a second key and a second encryption algorithm;
[0007] The kernel file is used to mount the encrypted partition from a specified mount point according to the corresponding algorithm parameter configuration file after being loaded. The algorithm parameter configuration file is generated by encrypting the second key and the algorithm information of the second encryption algorithm with the first key.
[0008] In this embodiment of the application, the first memory is a read-only memory, and the second memory is a random access memory or a flash memory.
[0009] In this embodiment, the first memory is the internal memory of the chip integrated with the data carrier.
[0010] In this embodiment of the application, before encrypting the encrypted partition using the second key and the second encryption algorithm, the method further includes:
[0011] Determine the hash value corresponding to each data block in the encrypted partition;
[0012] Construct a verification table that includes the hash values corresponding to each data block in the encrypted partition;
[0013] Based on the verification table, an integrity verification configuration file for the encrypted partition is generated, and the integrity verification configuration file is mounted to the designated mount point so that the kernel file can perform integrity verification on the encrypted partition through the integrity verification configuration file when mounting the encrypted partition from the designated mount point.
[0014] A second aspect of this application provides a booting method applied to a data carrier, the data carrier being encrypted using the aforementioned encryption method, the booting method comprising:
[0015] In response to the system startup signal, the initial startup program is loaded from the first memory;
[0016] The first key stored in the first memory is read through the initial startup program;
[0017] The kernel file and bootloader in the second memory boot partition are decrypted using the first key and the first encryption algorithm to load the kernel file;
[0018] Based on the first key, the kernel file is used to decrypt the pre-configured algorithm parameter configuration file to obtain the second key and the algorithm information of the second encryption algorithm. The second key and the second encryption algorithm are then used to decrypt the encrypted partition of the second memory and mount the encrypted partition from the specified mount point.
[0019] In this embodiment of the application, before mounting the encrypted partition from the designated mount point, the method further includes:
[0020] Load a pre-configured integrity verification configuration file from the specified mount point. The integrity verification configuration file includes a verification table, which includes the hash values corresponding to each data block in the encrypted partition.
[0021] Calculate the current hash value of each data block in the encrypted partition, and match the calculated current hash value with the hash value of the corresponding data block in the verification table;
[0022] If the calculated current hash value matches the hash value of the corresponding data block in the verification table, the encrypted partition is mounted from the specified mount point. If the calculated current hash value does not match the hash value of the corresponding data block in the verification table, an error message is returned.
[0023] In this embodiment of the application, the kernel file and boot program in the second memory boot partition are decrypted using the first key and the first encryption algorithm to load the kernel file, including:
[0024] If the bootloader is a multi-level bootloader, obtain the boot order of the multi-level bootloader;
[0025] The first key is passed to the first-level bootloader. After the first-level bootloader is decrypted using the first key, the first key is passed to the lower-level bootloader of the first-level bootloader and decrypted using the first key. This process continues until the last-level bootloader is decrypted according to the boot order. Finally, the last-level bootloader decrypts the kernel file to load the kernel file.
[0026] A third aspect of this application provides an encryption device that applies the encryption method described above, the device comprising:
[0027] The first encryption module is configured to obtain a first key from the first memory and encrypt the kernel file and the boot program using the first key and a first encryption algorithm, wherein the kernel file and the boot program are stored in the boot partition of the second memory;
[0028] The second encryption module is configured to encrypt the encrypted partition of the second memory using a second key and a second encryption algorithm;
[0029] The kernel file is used to mount the encrypted partition from a specified mount point according to the corresponding algorithm parameter configuration file after being loaded. The algorithm parameter configuration file is generated by encrypting the second key and the algorithm information of the second encryption algorithm with the first key.
[0030] A fourth aspect of this application provides a starting device for using the starting method described above, the device comprising:
[0031] The system startup module is configured to load an initial startup program from the first memory in response to a system startup signal;
[0032] The key reading module is configured to read the first key stored in the first memory through the initial startup program;
[0033] The kernel loading module is configured to decrypt the kernel file and boot program in the second memory boot partition using the first key and the first encryption algorithm in order to load the kernel file;
[0034] The mounting module is configured to, based on the first key, decrypt a pre-configured algorithm parameter configuration file through the kernel file to obtain a second key and algorithm information of a second encryption algorithm, and decrypt the encrypted partition of the second memory through the second key and the second encryption algorithm, and mount the encrypted partition from a specified mount point.
[0035] In a fifth aspect, this application provides a machine-readable storage medium storing instructions that, when executed by a processor, configure the processor to perform the encryption method described above, or, when executed by a processor, configure the processor to perform the startup method described above.
[0036] In a sixth aspect, this application provides a terminal device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the encryption method described above, or the instructions, when executed by the processor, cause the processor to be configured to perform the steps of the startup method described above.
[0037] Through the above technical solution, this application writes the boot program and key into a memory independent of the boot partition and the encrypted partition, and performs full-disk encryption on the boot program, key, boot partition and encrypted partition respectively. When the system starts, the boot program and kernel are loaded sequentially through multi-level decryption, and the encrypted partition is decrypted through the algorithm parameter configuration file before being mounted. Thus, this application can ensure the confidentiality and integrity of all data in the data carrier, realize full-disk encryption of the data carrier, and at the same time ensure the security of the key.
[0038] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description
[0039] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings:
[0040] Figure 1 This illustration schematically shows a prior art device encryption diagram according to an embodiment of this application;
[0041] Figure 2 A flowchart illustrating an encryption method according to an embodiment of this application is shown schematically.
[0042] Figure 3 This illustration schematically shows a structural diagram of a data carrier according to an embodiment of this application;
[0043] Figure 4 This illustration schematically shows an encryption diagram of an encryption method according to an embodiment of this application;
[0044] Figure 5 A flowchart illustrating a startup method according to an embodiment of this application is shown schematically.
[0045] Figure 6 A schematic block diagram of an encryption device according to an embodiment of this application is shown;
[0046] Figure 7 A schematic block diagram of a starting device according to an embodiment of this application is shown;
[0047] Figure 8 A schematic diagram of the structure of a terminal device according to an embodiment of this application is shown.
[0048] Explanation of reference numerals in the attached figures
[0049] 10 - Terminal device, 100 - Processor, 101 - Memory, 102 - Computer program. Detailed Implementation
[0050] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.
[0051] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of the components in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.
[0052] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.
[0053] like Figure 2 As shown, the first aspect of this application provides an encryption method applied to a data carrier, the data carrier including a first memory and a second memory electrically connected, the method comprising: obtaining a first key from the first memory of the data carrier; encrypting a kernel file and a boot program using the first key and a first encryption algorithm, the kernel file and the boot program of the data carrier being stored in a boot partition of the second memory of the data carrier; encrypting an encrypted partition of the second memory of the data carrier using a second key and a second encryption algorithm; wherein, the kernel file of the data carrier is used to mount the encrypted partition of the data carrier from a specified mount point according to a corresponding algorithm parameter configuration file after being loaded, and the algorithm parameter configuration file of the data carrier is generated by encrypting the second key and the algorithm information of the second encryption algorithm of the data carrier using the first key of the data carrier. Specifically, an initial boot program and a first key are pre-written into the first memory, and the second memory is divided into a boot partition and at least one encrypted partition. The kernel file and boot program are written into the boot partition, where the boot program is used to load the kernel file. The kernel file and boot program are encrypted using the first key and a first encryption algorithm, and the encrypted partition is encrypted using a second key and a second encryption algorithm. An algorithm parameter configuration file is generated by encrypting the algorithm information of the second key and the second encryption algorithm using the first key, and then associated with the kernel file. In this application, the data carrier is used to transfer data between various information points, including but not limited to USB flash drives, external hard drives, smartphones, tablets, drones, mobile robots, and intelligent driving devices.
[0054] Thus, this application writes the boot program and key into the first memory, and divides the second memory into a boot partition and an encrypted partition. The first and second memories are independent but electrically connected. The boot program, key, boot partition, and encrypted partition are encrypted using different keys. During system startup, the boot program and kernel are loaded sequentially through multi-level decryption, and the encrypted partition is decrypted using the algorithm parameter configuration file before being mounted. Therefore, this application can ensure the confidentiality and integrity of all data in the data carrier, achieving full-disk encryption of the data carrier while ensuring the security of the key.
[0055] like Figure 3 As shown in the embodiments of this application, the first memory is a read-only memory, and the initial boot program and the first key stored in the first memory cannot be tampered with; the second memory is a random access memory or a flash memory. To further improve the data security of the data carrier, in these embodiments, the first memory can also be the internal memory of the chip integrated into the data carrier, such as the internal storage of the control chip in devices like USB flash drives and smart terminals. By writing the first key and the initial boot program BootROM into the internal storage of the integrated chip at the factory, the first key and the initial boot program are immutable and cannot be read by external devices. This application, by introducing special hardware such as the chip integrated into the data carrier to securely protect the encryption key, can effectively prevent malicious attackers from obtaining the encryption key.
[0056] As is understandable, the boot partition is a partition used to store a series of boot programs and the system kernel. It is used to mount the encrypted partition for data access by executing the boot program. Its characteristic is that it will not be read again during system runtime. The encrypted partition is a storage partition for storing data such as various system files, and it will be frequently read and written during system runtime.
[0057] like Figure 4 As shown, in this application, the first encryption algorithm can be the AES-GCM algorithm, which is a symmetric encryption algorithm that combines integrity and confidentiality. This application uses the AES-GCM algorithm to encrypt the kernel file and boot program deployed in the boot partition, while ensuring the integrity and security of the files in the boot partition.
[0058] This application encrypts the encrypted partition using a second key and a second encryption algorithm, i.e., an encrypted file system. It is understood that the encrypted file system can transparently encrypt and decrypt data in the storage partition. When using it, parameters such as encryption algorithm information and encryption / decryption keys must be correctly set. In this application, the second key and the algorithm information of the second encryption algorithm are used as encryption algorithm parameters for configuration. Simultaneously, when configuring the encryption algorithm parameters, the first key is used to encrypt the encryption algorithm parameters to generate an algorithm parameter configuration file, which is then associated with the kernel file. Thus, when the bootloader completes loading the kernel file, the kernel file decrypts the algorithm parameter configuration file using the first key to obtain the second key and the algorithm information of the second encryption algorithm. Therefore, the kernel file can decrypt and mount the encrypted partition using the second key and the second encryption algorithm. It is understood that the first key and the second key can be different or the same key, and the first encryption algorithm and the second encryption algorithm can also be different or the same encryption algorithm; this is not limited here.
[0059] In this embodiment, the encryption partition is also subjected to integrity verification. Specifically, before encrypting the encryption partition using the second key and the second encryption algorithm, the method further includes: determining the hash value corresponding to each data block in the encryption partition; constructing a verification table including the hash values corresponding to each data block in the encryption partition; generating an integrity verification configuration file for the encryption partition based on the verification table; and mounting the integrity verification configuration file to a specified mount point so that the kernel file can perform integrity verification on the encryption partition using the integrity verification configuration file when mounting the encryption partition from the specified mount point. Integrity verification can be implemented using the dm-verity tool. It is understood that dm-verity is a security technology that can guarantee the integrity of the storage partition. This application first creates a verification area on the encryption partition, for example, by creating a dm-verity volume, and using the dm-verity tool to create a hash tree on the dm-verity volume as a verification table to store the hash values of each data block of the file system in the encryption partition, and then mounting the dm-verity volume to the specified mount point. In this way, each time a file system is mounted, dm-verity uses a hash tree to verify each data block in the file system. If a mismatch is found, the mounting process fails, thus ensuring the integrity of the encrypted partition.
[0060] like Figure 5 As shown, in a second aspect, this application provides a booting method applied to a data carrier, the data carrier being encrypted using the aforementioned encryption method. The booting method includes:
[0061] Step 1: In response to the system startup signal, for example, the system startup signal can be the electrical signal that the system is powered on, load the initial startup program from the first memory. After the system is powered on, it first starts from the initial startup program BootROM.
[0062] Step 2: The initial startup program reads the first key from the first memory of the data carrier;
[0063] Step 3: The initial startup program uses the first key and the first encryption algorithm to decrypt the boot program and kernel in the boot partition of the second memory data carrier in order to load the kernel file. The boot program and kernel in the boot partition are pre-encrypted based on the first key and the first encryption algorithm.
[0064] If the bootloader is a multi-level bootloader, the boot order of the multi-level bootloader is obtained, the first key is passed to the first-level bootloader, the first key is decrypted using the first key, the first key is passed to the lower-level bootloader of the first-level bootloader and the first key is used to decrypt the lower-level bootloader, and so on, until the last-level bootloader is decrypted according to the boot order. The last-level bootloader uses the first key to decrypt the kernel file to load the kernel file.
[0065] Understandably, the execution order of multi-level bootloaders is predetermined and fixed. Taking the ARM architecture as an example, consider a multi-level bootloader: BL1, BL2, BL31, BL32, and BL33. Their execution order is BL1->BL2->BL31->BL32->BL33. After the bootloader decrypts the bootloader, BL1 decrypts BL2 using the first key and passes the first key to BL2. BL2 then uses the first key to decrypt BL3 and passes the first key to BL3, and so on, until the final bootloader BL33 loads the kernel. In contrast, under the x86 architecture, the boot order of multi-level bootloaders is generally BIOS->UEFI->SHIM->GRUB, with GRUB ultimately loading the kernel.
[0066] Step 4: Based on the first key, decrypt the pre-configured algorithm parameter configuration file through the kernel file to obtain the second key and the algorithm information of the second encryption algorithm. Then, decrypt the encrypted partition of the second memory using the second key and the second encryption algorithm, and mount the encrypted partition from the specified mount point. The encrypted partition of the second memory has been pre-encrypted using the second key and the second encryption algorithm.
[0067] After the kernel starts, it uses the first key to decrypt the pre-configured algorithm parameter configuration file and obtains the pre-configured algorithm parameters, namely the second key and the encryption algorithm information indicating that the encryption algorithm is the second encryption algorithm. Then, it uses the second key to decrypt the encrypted partition through the second encryption algorithm, thereby mounting the encrypted partition from the specified mount point.
[0068] In this embodiment of the application, before mounting the encrypted partition from the designated mount point, i.e., after decrypting the encrypted partition, the method further includes: loading a pre-configured integrity verification configuration file from the designated mount point. The integrity verification configuration file includes a verification table, which includes the hash values corresponding to each data block in the encrypted partition. The integrity verification configuration file is pre-mounted to the designated mount point, and is loaded for integrity verification each time the kernel mounts the encrypted partition. After loading the integrity verification configuration file, the current hash value of each data block in the encrypted partition is calculated, and the calculated current hash value is matched with the hash value of the corresponding data block in the verification table. If the calculated current hash value matches the hash value of the corresponding data block in the verification table, the integrity of the encrypted partition is determined to meet the requirements, and the encrypted partition is mounted from the designated mount point. If the calculated current hash value does not match the hash value of the corresponding data block in the verification table, the integrity of the encrypted partition is determined to not meet the requirements, and mounting the encrypted partition is not allowed, and an error message is returned.
[0069] Compared to existing technologies where keys are unprotected or weakly protected, this application uses internal chip storage for protection, ensuring that attackers cannot obtain them. Furthermore, unlike existing technologies that lack encryption and integrity protection for the boot partition, this application encrypts and stores the boot partition files while simultaneously providing integrity protection, meeting secure boot requirements. While existing technologies encrypt the storage partition but lack integrity protection, this application encrypts and provides integrity protection, thus effectively ensuring the confidentiality and integrity of all data in the data carrier, achieving full-disk encryption while guaranteeing key security.
[0070] like Figure 6 As shown, in a third aspect of this application, an encryption device is provided, employing the encryption method described above. The device includes:
[0071] The first encryption module is configured to obtain a first key from the first memory and encrypt the kernel file and the boot program using the first key and a first encryption algorithm, wherein the kernel file and the boot program are stored in the boot partition of the second memory;
[0072] The second encryption module is configured to encrypt the encrypted partition of the second memory using a second key and a second encryption algorithm;
[0073] The kernel file is used to mount the encrypted partition from the specified mount point according to the corresponding algorithm parameter configuration file after being loaded. The algorithm parameter configuration file is generated by encrypting the second key and the algorithm information of the second encryption algorithm with the first key.
[0074] like Figure 7 As shown, in a fourth aspect of this application, a starting device is provided, which applies the starting method described above. The device includes:
[0075] The system startup module is configured to load an initial startup program from the first memory in response to a system startup signal;
[0076] The key reading module is configured to read the first key stored in the first memory via the initial startup program;
[0077] The kernel loading module is configured to decrypt the kernel file and boot program in the second memory boot partition using a first key and a first encryption algorithm in order to load the kernel file;
[0078] The mounting module is configured to, based on the first key, decrypt the pre-configured algorithm parameter configuration file through the kernel file to obtain the second key and the algorithm information of the second encryption algorithm, and then decrypt the encrypted partition of the second memory through the second key and the second encryption algorithm, and mount the encrypted partition from the specified mount point.
[0079] In a fifth aspect, this application provides a machine-readable storage medium storing instructions that, when executed by a processor, cause the processor to perform the encryption method described above, or when executed by a processor, cause the processor to perform the startup method described above.
[0080] In a sixth aspect, this application provides a terminal device including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the encryption method described above, or the instruction, when executed by the processor, causes the processor to be configured to perform the steps of the startup method described above.
[0081] like Figure 8 The diagram shown is a schematic representation of a terminal device provided in an embodiment of this application. Figure 8 As shown, the terminal device 10 of this embodiment includes a processor 100, a memory 101, and a computer program 102 stored in the memory 101 and executable on the processor 100. When the processor 100 executes the computer program 102, it implements the steps in the above method embodiments. Alternatively, when the processor 100 executes the computer program 102, it implements the functions of each module / unit in the above device embodiments.
[0082] For example, computer program 102 may be divided into one or more modules / units, one or more of which are stored in memory 101 and executed by processor 100 to complete this application. One or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of computer program 102 in terminal device 10.
[0083] Terminal device 10 may be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. Terminal device 10 may include, but is not limited to, a processor 100 and a memory 101. Those skilled in the art will understand that... Figure 8 This is merely an example of terminal device 10 and does not constitute a limitation on terminal device 10. It may include more or fewer components than shown, or combine certain components, or different components. For example, terminal device may also include input / output devices, network access devices, buses, etc.
[0084] The processor 100 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.
[0085] The memory 101 can be an internal storage unit of the terminal device 10, such as a hard disk or RAM of the terminal device 10. The memory 101 can also be an external storage device of the terminal device 10, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the terminal device 10. Furthermore, the memory 101 can include both internal and external storage units of the terminal device 10. The memory 101 is used to store computer programs and other programs and data required by the terminal device 10. The memory 101 can also be used to temporarily store data that has been output or will be output.
[0086] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0087] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0088] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0089] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0090] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.
[0091] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.
[0092] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.
[0093] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.
[0094] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.
Claims
1. An encryption method applied to a data carrier, characterized in that, The data carrier includes a first memory and a second memory, and the method includes: A first key is obtained from the first memory, and the kernel file and the boot program are encrypted using the first key and a first encryption algorithm. The kernel file and the boot program are stored in the boot partition of the second memory. The encrypted partition of the second memory is encrypted using a second key and a second encryption algorithm; The kernel file is used to mount the encrypted partition from a specified mount point according to the corresponding algorithm parameter configuration file after being loaded. The algorithm parameter configuration file is generated by encrypting the second key and the algorithm information of the second encryption algorithm with the first key.
2. The encryption method according to claim 1, characterized in that, The first memory is a read-only memory, and the second memory is a random access memory or a flash memory.
3. The encryption method according to claim 2, characterized in that, The first memory is the internal memory of the chip integrated with the data carrier.
4. The encryption method according to claim 1, characterized in that, Before encrypting the encrypted partition using the second key and the second encryption algorithm, the method further includes: Determine the hash value corresponding to each data block in the encrypted partition; Construct a verification table that includes the hash values corresponding to each data block in the encrypted partition; Based on the verification table, an integrity verification configuration file for the encrypted partition is generated, and the integrity verification configuration file is mounted to the designated mount point so that the kernel file can perform integrity verification on the encrypted partition through the integrity verification configuration file when mounting the encrypted partition from the designated mount point.
5. A startup method applied to a data carrier, characterized in that, The data carrier is encrypted using the encryption method described in any one of claims 1-4, and the initiation method includes: In response to the system startup signal, the initial startup program is loaded from the first memory; The first key stored in the first memory is read through the initial startup program; The kernel file and bootloader in the second memory boot partition are decrypted using the first key and the first encryption algorithm to load the kernel file; Based on the first key, the kernel file is used to decrypt the pre-configured algorithm parameter configuration file to obtain the second key and the algorithm information of the second encryption algorithm. The second key and the second encryption algorithm are then used to decrypt the encrypted partition of the second memory and mount the encrypted partition from the specified mount point.
6. The startup method according to claim 5, characterized in that, Before mounting the encrypted partition from the specified mount point, the method further includes: Load a pre-configured integrity verification configuration file from the specified mount point. The integrity verification configuration file includes a verification table, which includes the hash values corresponding to each data block in the encrypted partition. Calculate the current hash value of each data block in the encrypted partition, and match the calculated current hash value with the hash value of the corresponding data block in the verification table; If the calculated current hash value matches the hash value of the corresponding data block in the verification table, the encrypted partition is mounted from the specified mount point. If the calculated current hash value does not match the hash value of the corresponding data block in the verification table, an error message is returned.
7. The startup method according to claim 5, characterized in that, Decrypting the kernel file and bootloader in the second memory boot partition using the first key and the first encryption algorithm to load the kernel file includes: If the bootloader is a multi-level bootloader, obtain the boot order of the multi-level bootloader; The first key is passed to the first-level bootloader. After the first-level bootloader is decrypted using the first key, the first key is passed to the lower-level bootloader of the first-level bootloader and decrypted using the first key. This process continues until the last-level bootloader is decrypted according to the boot order. Finally, the last-level bootloader decrypts the kernel file to load the kernel file.
8. An encryption device, characterized in that, The apparatus for using the encryption method as described in any one of claims 1-4 comprises: The first encryption module is configured to obtain a first key from the first memory and encrypt the kernel file and the boot program using the first key and a first encryption algorithm, wherein the kernel file and the boot program are stored in the boot partition of the second memory; The second encryption module is configured to encrypt the encrypted partition of the second memory using a second key and a second encryption algorithm; The kernel file is used to mount the encrypted partition from a specified mount point according to the corresponding algorithm parameter configuration file after being loaded. The algorithm parameter configuration file is generated by encrypting the second key and the algorithm information of the second encryption algorithm with the first key.
9. A starting device, characterized in that, The device comprising the starting method as described in any one of claims 5-7, wherein the device includes: The system startup module is configured to load an initial startup program from the first memory in response to a system startup signal; The key reading module is configured to read the first key stored in the first memory through the initial startup program; The kernel loading module is configured to decrypt the kernel file and boot program in the second memory boot partition using the first key and the first encryption algorithm in order to load the kernel file; The mounting module is configured to, based on the first key, decrypt a pre-configured algorithm parameter configuration file through the kernel file to obtain a second key and algorithm information of a second encryption algorithm, and decrypt the encrypted partition of the second memory through the second key and the second encryption algorithm, and mount the encrypted partition from a specified mount point.
10. A machine-readable storage medium storing instructions thereon, characterized in that, When executed by a processor, the instruction causes the processor to be configured to perform the encryption method as described in any one of claims 1-4, or when executed by a processor, the instruction causes the processor to be configured to perform the startup method as described in any one of claims 5-7.
11. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the encryption method as claimed in any one of claims 1-4, or the instruction, when executed by the processor, causes the processor to be configured to perform the steps of the startup method as claimed in any one of claims 5-7.