Terminal hard disk encryption management system and method

Abstract

The present disclosure belongs to the technical field of information security, and provides a terminal hard disk encryption management system and method. The system comprises a cloud management platform, a terminal execution module arranged on a terminal device, a target hard disk, and a specified storage area. The cloud management platform generates a management password factor based on an obtained management password, and sends the management password factor to the terminal execution module through a network. The terminal execution module determines task information of the terminal device based on at least a state of the terminal device. A user password factor is generated based on an obtained user password and written into the specified storage area. The authentication credential of the target hard disk is generated using at least the management password factor and the user password factor. A task instruction carrying the task information and the authentication credential is generated and issued to the target hard disk, and the authentication credential is cleared in the terminal execution module. The target hard disk executes a target task based on the task instruction in response to the task instruction. The security of hard disk encryption and the controllability of the terminal device are improved.

Description

Technical Field

[0001] This disclosure belongs to the field of information security technology, and in particular relates to a terminal hard disk encryption management system and method. Background Technology

[0002] Hard drive encryption relies on a unified scalable firmware interface (UEFI) and a trusted platform module (TPM) / trusted cryptographic module (TCM) chip to complete key storage and hard drive encryption / unlocking.

[0003] Existing technologies have many shortcomings: structurally, they rely on dedicated TPM / TCM chips, resulting in high hardware costs, and chip failures can easily lead to permanent data loss; functionally, hard drive encryption uses a single password, and any user who can obtain the hard drive encryption password may cause the terminal device to become unmanaged, posing a security risk to the terminal device, and it is impossible to manage the hard drive password of the terminal device online. Summary of the Invention

[0004] To address the aforementioned issues, this disclosure provides a terminal hard disk encryption management system and method.

[0005] This disclosure is achieved through the following technical solution: In a first aspect, embodiments of this disclosure provide a terminal hard disk encryption management system, the system comprising: a cloud management platform and a terminal execution module disposed on a terminal device, a target hard disk, and a designated storage area; the cloud management platform and the terminal execution module are connected via a network for communication. The cloud management platform is configured to: generate a management password factor based on the acquired management password, and send the management password factor to the terminal execution module via the network; The terminal execution module is configured to: determine the task information of the terminal device based at least on the terminal device status; generate a user password factor based on the acquired user password and write it to the designated storage area; generate authentication credentials for the target hard disk using at least the management password factor and the user password factor; generate a task instruction carrying the task information and authentication credentials, send the task instruction to the target hard disk, and clear the authentication credentials in the terminal execution module. The target hard disk is configured to: in response to the acquisition of the task instruction, execute the target task based on the task instruction.

[0006] Furthermore, The terminal execution module includes: terminal application software, firmware driver, and system firmware; the terminal application software communicates with the cloud management platform via a network. The terminal application software is configured to: receive the management password factor and send the management password factor to the firmware driver; when a user interaction instruction is obtained, determine the task information based on the user interaction instruction and send the task information to the firmware driver; generate a user password factor based on the obtained user password and send the user password factor to the firmware driver. The firmware driver is configured to forward the management password factor, user password factor, and task information to the system firmware. The system firmware is configured to: determine task information based on the terminal device status, or receive task information transmitted by the firmware driver; write at least the management password factor and user password factor into the designated storage area using a preset encryption algorithm; generate authentication credentials for the target hard drive using at least the management password factor and user password factor; generate a task instruction based on the task information and authentication credentials, and send the task instruction to the target hard drive; after the task instruction is sent to the target hard drive, clear the authentication credentials in the terminal execution module.

[0007] Furthermore, The terminal execution module is further configured to: generate a unique device identifier code corresponding to the terminal device using a one-way algorithm when the terminal device is first deployed; generate a device identifier factor based on the unique device identifier code; and write the device identifier factor into the designated storage area using a preset encryption algorithm.

[0008] Furthermore, The terminal execution module is further configured to: determine first verification task information and first password modification task information based on the user's password modification instruction; and generate first user password factor and second user password factor based on the obtained first user password and second user password. Obtain the management password factor from the designated storage area, and use at least the management password factor and the first user password factor to generate the first authentication credential of the target hard disk; based on the first verification task information and the first authentication credential, generate a first task instruction carrying the first verification task information and the first authentication credential, and send the first task instruction to the target hard disk; In response to the acquisition of the first verification pass information, at least the management password factor and the second user password factor are used to generate the second authentication credential of the target hard drive; based on the first password change task information and the second authentication credential, a second task instruction carrying the first password change task information and the second authentication credential is generated, and the second task instruction is sent to the target hard drive; In response to the acquisition of the first password change success information, the original user password factor in the designated storage area is replaced with the second user password factor, and the user password change instruction operation is uploaded to the cloud management platform. The target hard drive is configured to: in response to the acquisition of the first task instruction, perform a verification task based on the first authentication credential, verify the first authentication credential with the original authentication credential, and if the verification result is a pass, send the first verification pass information back to the terminal execution module; in response to the acquisition of the second task instruction, perform a password modification task based on the second authentication credential, replace the original authentication credential of the target hard drive with the second authentication credential, and after the password modification task is completed, send the first password modification success information back to the terminal execution module.

[0009] Furthermore, The cloud management platform is also configured to: in response to a user password reset instruction, initiate a password recovery work order; when preset conditions are met, generate a first encrypted verification code and send the first encrypted verification code to the terminal execution module; and in response to the acquisition of verification pass information, issue a one-time recovery token to the terminal execution module. The terminal execution module is further configured to: after running the terminal device in a preset startup mode, obtain a second encrypted verification code, verify the second encrypted verification code with at least the first encrypted verification code, and if the verification result is successful, send the verification success information to the cloud management platform; in response to the acquisition of the one-time recovery token, obtain a management password factor from the designated storage area, and obtain permission to change the password of the target hard drive based at least on the one-time recovery token and the management password factor, and generate reset task information; Based on the obtained third user password, a third user password factor is generated; using at least the management password factor and the third user password factor, a third authentication credential for the target hard drive is generated; based on the reset task information and the third authentication credential, a third task instruction carrying the reset task information and the third authentication credential is generated, and the third task instruction is sent to the target hard drive. The target hard drive is configured to: in response to the acquisition of the third task instruction, perform a reset task based on the third authentication credential, wherein the third authentication credential replaces the original authentication credential of the target hard drive.

[0010] Furthermore, The cloud management platform is also configured to: generate a first management password factor based on the acquired first management password, and send the first management password factor and management password update instruction to the terminal execution module; The terminal execution module is further configured to: respond to the management password update instruction and the acquisition of the first management password factor, determine the second verification task information and the second password modification task information based on the management password update instruction, set the update management password flag to the first logical value, and temporarily store the first management password factor in the designated storage area using a preset encryption algorithm; After the terminal device restarts, when the terminal execution module detects that the update management password flag is at the first logical value, it generates a user password factor based on the acquired user password; it obtains the original management password factor from the specified storage area, and generates a fourth authentication credential for the target hard drive based at least on the user password factor and the original management password factor; it generates a fourth task instruction carrying the second verification task information and the fourth authentication credential based on the second verification task information and the fourth authentication credential, and sends the fourth task instruction to the target hard drive. In response to the acquisition of the second verification pass information, at least the first management password factor and the user password factor are used to generate the fifth authentication credential of the target hard disk; based on the second password change task information and the fifth authentication credential, a fifth task instruction carrying the second password change task information and the fifth authentication credential is generated, and the fifth task instruction is sent to the target hard disk; In response to the acquisition of the second password change success information, the update management password flag is set to the second logical value, and the original management password factor in the specified storage area is replaced with the first management password factor; The target hard drive is configured to: in response to the acquisition of the fourth task instruction, perform a verification task based on the fourth authentication credential, verify the fourth authentication credential with the original authentication credential, and if the verification result is successful, send a second verification success message to the terminal execution module; in response to the acquisition of the fifth task instruction, perform a password modification task based on the fifth authentication credential, the fifth authentication credential replaces the original authentication credential of the target hard drive, and after the password modification task is completed, send a second password modification success message to the terminal execution module.

[0011] Furthermore, When the terminal device is in the startup state and the terminal execution module is connected to the cloud management platform via the network; The cloud management platform is also configured to: in response to the triggering of a forced reset user password task, generate a third user password, and send the third user password and the forced reset user password instruction to the terminal execution module; The terminal execution module is further configured to: in response to the forced reset user password instruction and the acquisition of the third user password, based on the forced reset user password instruction, replace the original user password factor in the specified storage area with the third user password factor, and send circuit breaker task information to the target hard disk; The target hard drive is configured to switch to a locked state in response to the acquisition of the circuit breaker task information, and wait for the user password to be reset.

[0012] Furthermore, The cloud management platform is further configured to: communicate with multiple terminal devices via a network, generate a management password factor unique to each terminal device, and send each management password factor to the corresponding terminal execution module via the network.

[0013] Furthermore, The cloud management platform is also configured to send a timeliness factor to the terminal execution module based on a preset time period; The terminal execution module is configured to: write the acquired timeliness factor into the designated storage area using a preset encryption algorithm, and generate authentication credentials for the target hard drive using at least the user password factor, management password factor, and timeliness factor.

[0014] Secondly, based on the same inventive concept, this disclosure also provides a terminal hard disk encryption management method, applied to a terminal hard disk encryption management system. The system includes: a cloud management platform and a terminal execution module installed on a terminal device, a target hard disk, and a designated storage area; the cloud management platform and the terminal execution module are connected via a network; the terminal hard disk encryption management method includes: The cloud management platform generates a management password factor based on the acquired management password, and sends the management password factor to the terminal execution module via the network; The terminal execution module determines the task information of the terminal device based at least on the terminal device status; The terminal execution module generates a user password factor based on the acquired user password and writes it into the designated storage area; The terminal execution module uses at least the management password factor and the user password factor to generate authentication credentials for the target hard drive; The terminal execution module generates a task instruction carrying the task information and authentication credentials, sends the task instruction to the target hard disk, and clears the authentication credentials in the terminal execution module; The target hard disk responds to the acquisition of the task instruction and executes the target task based on the task instruction.

[0015] The terminal hard drive encryption management system disclosed herein can achieve unified network management of hard drive passwords without relying on dedicated TPM / TCM chips. This is achieved through network communication between the cloud management platform and the terminal execution module, preventing terminal devices from becoming unmanaged, reducing hardware costs, and avoiding permanent data loss due to chip failure. Authentication credentials are generated by at least the management password factor and the user password factor, and are generated only within the controlled execution area of ​​the terminal execution module. After the task instruction is issued, the authentication credentials are immediately cleared from the controlled execution area, and the plaintext authentication credentials are not exposed to the administrator, the cloud management platform and its interface, or the terminal device's desktop operating system. Even if either the management password or the user password is obtained, the hard drive cannot be unlocked independently, thus effectively improving the security of hard drive encryption and the controllability of the terminal device.

[0016] Other features and advantages of this disclosure will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the disclosure. The objects and other advantages of this disclosure may be realized and obtained by means of the structures pointed out in the description, claims and drawings. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A block diagram of a terminal hard disk encryption management system provided in this disclosure embodiment; Figure 2 Another block diagram of a terminal hard disk encryption management system provided in this disclosure embodiment; Figure 3 This is a flowchart of a terminal hard disk encryption management method provided in an embodiment of the present disclosure. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0020] Firstly, Figure 1 A block diagram of a terminal hard disk encryption management system provided in this disclosure embodiment is shown below. Figure 1 As shown, based on the same inventive concept, this disclosure also provides a terminal hard disk encryption management system. The system includes: a cloud management platform and a terminal execution module, a target hard disk, and a designated storage area, all located on the terminal device. The cloud management platform and the terminal execution module communicate with each other via a network. To ensure the communication security between the cloud management platform and the terminal execution module, a local area network (LAN) is preferred. However, dedicated networks, logical virtual dedicated networks (VRWNs), wide area networks (WANs), etc., can also be used.

[0021] The cloud management platform is configured to generate management password factors based on the acquired management password and send these factors to the terminal execution module via the network. The management password is entered by the enterprise IT (Information Technology) administrator, and the cloud management platform generates management password factors based on this input. Before encrypting and sending the management password factors to the terminal execution module, the management password factors are archived; they can be archived to encrypted storage space or an encrypted hard drive. When sending the management password factors to the terminal execution module via the network, the cloud management platform can use either symmetric or asymmetric encryption methods; no further specific limitations are made here. The specific encryption type and algorithm can be selected and adjusted according to the cloud management platform and the terminal execution module.

[0022] The terminal execution module is configured to determine the terminal device's task information based on at least the terminal device's status. The tasks corresponding to this information include at least password-related tasks such as setting a password, unlocking login, and changing a password. Based on the acquired user password, a user password factor is generated and written to a designated storage area. The local user on the terminal device sets their own password, which is then synchronized to designated locations such as the enterprise work email and a cloud-encrypted storage repository, enabling third-party backup of the user password. After the third-party backup is complete, a user password factor is generated. At least the management password factor and the user password factor are used to generate authentication credentials for the target hard drive. These credentials correspond to the target hard drive password. Additional password factors can be added to generate authentication credentials based on different security requirements, for different enterprises, and for different application scenarios; for example, device identification factors and time-sensitivity factors. Based on task information and authentication credentials, a task instruction carrying the task information and authentication credentials is generated, the task instruction is sent to the target hard drive, and the authentication credentials are cleared in the terminal execution module. The authentication credentials are only generated and used within the controlled execution area of ​​the terminal execution module, and the plaintext results of the authentication credentials are not exposed to the administrator, cloud management platform and interface, or desktop operating system of the terminal device. The task instruction can be a mixed instruction formed by combining control instructions for sending task information to the target hard drive and data instructions carrying the authentication credentials corresponding to the task information.

[0023] The target hard drive is configured to respond to the acquisition of task instructions and, based on these instructions, execute target tasks. The task instructions carry task information and authentication credentials; the authentication credentials in the task instructions are the password for the target hard drive. Based on the task information in the task instructions, the target tasks are executed. These target tasks include at least password-related tasks such as setting a password, unlocking login, and changing the password. The target hard drive can be a self-encrypting hard drive compatible with the Trusted Computing Group Opal 2.0 specification. When storing authentication credentials on the target hard drive, encrypted storage methods can be used, such as hashing and encrypting the authentication credentials before storage to prevent them from being exposed in plaintext. Whether the authentication credentials are stored on the target hard drive encrypted and the specific encryption algorithm used are not specifically limited here.

[0024] It should be noted that when performing encryption management operations on the target hard drive, the terminal device is usually required to be in a secure boot state, and the hardware environment of the terminal device must be verified.

[0025] In this embodiment, the administrator sets a management password through a cloud management platform. The cloud management platform generates management password factors based on the management password and sends the management password factors to the terminal execution module. The terminal execution module determines the task information of the terminal device based at least on the terminal device status. Local users directly set user passwords through the terminal device, and the terminal execution module generates user password factors based on the acquired user passwords. At least the management password factors and user password factors are used to generate authentication credentials for the target hard drive. A task instruction carrying task information and authentication credentials is sent to the target hard drive, and the authentication credentials are cleared in the terminal execution module. The target hard drive responds to the acquisition of the task instruction and executes the target task based on the task instruction. The terminal hard drive encryption management system in this disclosure can achieve unified network management of hard drive passwords without relying on dedicated TPM / TCM chips. This is achieved through network communication between the cloud management platform and the terminal execution module, preventing terminal devices from becoming unmanaged, reducing hardware costs, and avoiding permanent data loss due to chip failure. The authentication credentials are generated by combining at least the management password factor and the user password factor, and are generated only within the controlled execution area of ​​the terminal execution module. After the task instruction is issued, the authentication credentials are immediately cleared from the controlled execution area. The plaintext of the authentication credentials is not exposed to the administrator, the cloud management platform and interface, or the desktop operating system of the terminal device. Even if either the management password or the user password is obtained, the hard drive cannot be unlocked by itself, thereby effectively improving the security of hard drive encryption and the controllability of the terminal device.

[0026] In some examples, Figure 2 Another block diagram of a terminal hard disk encryption management system provided in this disclosure embodiment is shown below. Figure 2As shown, the terminal execution module includes: terminal application software, firmware driver, and system firmware. The terminal application software communicates with the cloud management platform via a network. As an interaction bridge between the local system firmware of the terminal device and the cloud management platform, the terminal application software is responsible for receiving the user password entered by the local user and transmitting the user password factors and the management password factors issued by the cloud management platform to the firmware driver. It can also determine task information based on user interaction commands, send the task information to the firmware driver, and perform third-party backup of the user password set by the local user. The terminal application software can run at the terminal device's operating system layer, opening directly after the computer boots up, or allowing it to open after a secure boot. It can also be woken up during the computer startup process using specific keys, such as F1 or F2. The firmware driver is a driver module running at the terminal device's operating system layer. It communicates with the system firmware through the system firmware interface and is responsible for accurately transmitting various password factors and necessary task information from the terminal application software to the system firmware, ensuring the security and stability of password transmission. The system firmware, including UEFI (Unified Extensible Firmware Interface) and BIOS (Basic Input / Output System), serves as the core of the terminal execution module. It incorporates encryption algorithms and password derivation strategy logic, responsible for assembling and deriving user password factors, management password factors, and other factors. It performs tasks such as temporary generation, writing, verification, resetting, and memory clearing of authentication credentials. The password derivation strategy primarily includes the types and derivation methods of password factors required to derive authentication credentials for the target hard drive. Management password factors can be distributed via a cloud management platform, transmitted from the terminal application software to the system firmware via firmware drivers, or retrieved by the system firmware from a designated storage area. The system firmware can also record key information such as password factor version numbers, task-required flags, and device unique identifiers. The controlled execution area of ​​the terminal execution module is located within the system firmware or a designated area within it. When the system firmware has a network module or is set to automatically connect by default, terminal hard drive encryption management can be implemented directly within the system firmware without configuring the terminal application software. However, if some devices are not connected to a network cable or cannot connect, and the system firmware does not have a wireless network driver module, terminal hard drive encryption management requires the assistance of the terminal application software. The cloud management platform and the terminal execution module need to perform a handshake process to establish a communication connection, which needs to be completed through network communication. When the system firmware cannot directly connect to the network, the terminal application software can act as a communication bridge between the terminal device and the cloud management platform, and perform the handshake process in place of the system firmware. For example, the terminal application software can send a handshake request carrying device identification information to the cloud management platform. After the cloud management platform verifies the request, it establishes a communication connection with the terminal execution module, thereby realizing encrypted management of the terminal hard drive. The specific method of the handshake process is not specifically limited here.

[0027] Furthermore, the terminal application software is configured to receive management password factors and send them to the firmware driver; upon receiving user interaction instructions, it determines task information based on the instructions and sends the task information to the firmware driver; based on the acquired user password, it generates a user password factor and sends it to the firmware driver. The firmware driver is configured to forward the management password factor, user password factor, and task information to the system firmware. The system firmware is configured to determine task information based on the terminal device status or receive task information transmitted by the firmware driver; write the management password factor and user password factor to a designated storage area using a preset encryption algorithm; generate authentication credentials for the target hard drive using the management password factor and user password factor; generate a task instruction based on the task information and authentication credentials and send it to the target hard drive; after the task instruction is sent to the target hard drive, clear the authentication credentials in the terminal execution module; the preset encryption algorithm includes a salted hash algorithm, and can also be combined with a symmetric encryption algorithm for storage protection of the password factors; the specific encryption algorithm selected can be determined according to the actual situation of the terminal device.

[0028] In this embodiment, the user password is set and stored locally by the user of the terminal device. Its length can be configured based on factors such as the terminal device and system. The user password can be modified by the user and can be backed up synchronously by a third party, which can be a corporate work email or a cloud-based encrypted repository. Administrators do not have permission to access user passwords or view their plaintext. The management password is generated directly or approved by the administrator through a cloud management platform. A management password factor is formed based on the management password and distributed in encrypted form to the terminal execution module of the terminal device. The terminal execution module stores the management password factor in a protected designated storage area. Administrators can remotely update the management password corresponding to the terminal device through the cloud management platform, thereby updating the management password factor stored in the designated storage area of ​​the terminal device. Local users do not have permission to view or change the management password. The device's unique identifier is automatically generated by the system firmware when the terminal device is first deployed. It serves as the unique hardware identifier for the terminal device, stored in a designated storage area within the system firmware, and acts as a terminal device identity verification factor. This is suitable for mobile office, remote office, device tamper-proofing, and cross-device restriction scenarios. The unique identifier of a device is calculated by combining multiple hardware information and registration information that are difficult to forge simultaneously using a one-way algorithm. This one-way algorithm is irreversible and cannot reverse the original data. It can use a one-way hash function or a key derivation type one-way algorithm.

[0029] In some examples, the terminal execution module is also configured to: generate a unique device identifier for the terminal device using a one-way algorithm upon initial deployment; generate a device identification factor based on the unique device identifier; and write the device identification factor to a designated storage area using a preset encryption algorithm. The preset encryption algorithm includes a salted hash algorithm, and may also combine a symmetric encryption algorithm to protect the password factor during storage. The specific encryption algorithm selected can be determined based on the actual situation of the terminal device. The unique device identifier can be simultaneously reported to a cloud management platform for registration. The cloud management platform records the unique device identifier, terminal device asset ownership, password derivation strategy template, password factor version number, and recovery control index.

[0030] Furthermore, the stability factors in the device's unique identifier can include: motherboard root identity, hard drive identity, processor identifier, on-chip system chip unique identifier, trusted platform module, trusted cryptographic module, network card physical address, firmware version information, and registration salt value. At least three stability factors are selected to participate in generating the device's unique identifier, and a registration salt value randomly generated during the device's initial registration is incorporated to prevent offline counterfeiting based solely on the device's publicly available hardware serial number.

[0031] It should be noted that the unique device identifier is not simply a direct concatenation of the motherboard root identity and the hard drive identity. Instead, it is calculated using a one-way algorithm after combining multiple stable factors mentioned above. For example, the unique device identifier = H(Motherboard Root Identity || Hard Drive Identity || Processor Identifier / System-on-Chip Unique Identifier || Trusted Platform Module / Trusted Cryptographic Module Endorsement Public Key Digest || Network Card Physical Address || Registration Salt Value), where H represents the one-way hash algorithm and || is the data concatenation operator. Management password factors and device identifier factors are managed separately. Management password factors participate in access control and authentication credential derivation, while device identifier factors are used to limit the derivation results to only valid on the terminal device. Even if objects other than local users and administrators obtain the password factors and corresponding plaintext passwords stored in the designated storage area, or copy the hard drive or migrate the software environment, if the unique device identifier does not match, the unlocking capability cannot be reproduced on other terminals. The device's unique identifier can employ a two-tiered constraint combining a primary binding identity and an auxiliary verification identity: the primary binding identity is primarily composed of the motherboard root identity, hard drive identity, and device root public key digest; the auxiliary verification identity can be composed of the processor identifier, network card physical address, firmware version information, and registration salt value. User password factors and management password factors are mandatory, while device identifier factors are optional. When generating authentication credentials, the user password factor and management password factor are the primary components, with the device identifier factor appended when necessary. In scenarios requiring the use of the device identifier factor to derive authentication credentials for the target hard drive, normal unlocking, password modification, recovery, and remote locking operations require at least a matching primary binding identity. In this case, the device's unique identifier corresponding to the device identifier factor must include the primary binding identity. If the terminal device undergoes component replacement such as motherboard repair or hard drive replacement, identity migration must be performed after approval through the cloud management platform to prevent unauthorized users from circumventing the binding of the terminal device and target hard drive authentication credentials using component replacement.

[0032] In some examples, during the initial hard drive encryption setup process, when the terminal device is deployed for the first time, the terminal execution module uses a one-way algorithm to generate a unique device identifier code corresponding to the terminal device. Based on the unique device identifier code, a device identification factor is generated and written to a designated storage area using a preset encryption algorithm. The cloud management platform generates a management password factor based on the initial management password and sends it to the terminal execution module via the network. At this time, since the target hard drive has not yet been password-set, the terminal device is in the initial hard drive encryption setup state, and the task information of the terminal device corresponds to the initial password setting. The terminal execution module generates a user password factor based on the initial user password and writes it to a designated storage area. The terminal execution module uses at least the management password factor and the user password factor to generate the initial authentication credentials for the target hard drive. The terminal execution module generates a task instruction carrying task information and the initial authentication credentials, sends the task instruction to the target hard drive, and clears the initial authentication credentials in the terminal execution module. The target hard drive responds to the acquisition of the task instruction, determines that the target task is the initial password setting task based on the task information in the task instruction, executes the target task, and sets the initial authentication credentials. The terminal execution module can simultaneously use the management password factor, user password factor, and device identification factor to generate the initial authentication credential for the target hard drive, making the initial authentication credential uniquely bound to the terminal device. Even if the target hard drive is copied or the software environment is migrated, if the device unique identification code does not match, the ability to unlock the target hard drive cannot be reproduced on other terminal devices. Furthermore, the management password factor and device identification factor are managed separately. The management password factor participates in the derivation of authentication credential, while the device identification factor is used to limit the derivation result to be valid only on the target terminal device.

[0033] In some examples, during the power-on login unlock process, the terminal device is in a power-on login unlock state, and the task information of the terminal device corresponds to login unlock. After the user powers on, the terminal execution module prompts the user to enter their password. Based on the obtained password, it generates a user password factor; at least the management password factor and the user password factor are used, and a device identification factor is added if necessary, to generate authentication credentials for the target hard drive. The terminal execution module generates a task instruction carrying task information and authentication credentials, sends the task instruction to the target hard drive, and clears the authentication credentials in the terminal execution module. The target hard drive responds to the acquisition of the task instruction, determines that the target task is a login unlock task based on the task information in the task instruction, executes the target task, and verifies the authentication credentials; if the verification passes, the target hard drive is unlocked; if the verification fails, it remains locked. Authentication credentials are only temporarily generated in the terminal execution module and are immediately cleared after use; authentication credentials are not saved.

[0034] In this embodiment of the disclosure, the user interaction instructions include hard disk encryption initial setting instructions and power-on login unlock instructions.

[0035] Taking the initial hard drive encryption setup process as an example: The local user on the terminal device sets their own password in the terminal application software. The terminal application software synchronizes the user password to designated locations such as the enterprise work email and cloud encrypted storage repository for third-party backup, and generates user password factors based on the user password. The cloud management platform encrypts and distributes the management password factors to the terminal application software. Based on the initial hard drive encryption setup command, the terminal application software determines the task information as the initial password setting and sends the user password factors, management password factors, and task information to the firmware driver. The firmware driver then forwards the user password factors, management password factors, and task information to the system firmware. The system firmware uses a preset encryption algorithm to write the management password factors and user password factors to a designated storage area. This designated storage area can be the flash memory or other storage media in the protected area of ​​the system firmware. The system firmware assembles and derives the initial authentication credentials according to a preset password derivation strategy, adding device identification factors when needed, generating a task instruction carrying task information and the initial authentication credentials, and sending it to the target hard drive. After the task instruction is sent, the system firmware immediately clears the initial authentication credentials. The authentication credentials are only temporarily derived within the controlled execution area and are not stored in plaintext on disk. The target hard drive responds to the task instruction by executing the initial password setting task and sends the success status back to the cloud management platform via the system firmware and terminal application software.

[0036] Taking the boot-up login unlock process as an example: After the user boots up, the system firmware completes secure boot and hardware environment verification, prompting the user to enter their password. The user enters their password through the terminal application software. Based on the boot-up login unlock command, the terminal application software determines the task information to be login unlock and generates a user password factor based on the user password. The terminal application software sends the user password factor and task information to the firmware driver, which then forwards them to the system firmware. The system firmware decrypts and reads the management password factor from the designated storage area, assembles derived authentication credentials based on the user password factor and management password factor, and adds a device identification factor if necessary. It then generates a task command carrying task information and authentication credentials and sends it to the target hard drive for hardware-level verification. After successful verification, the target hard drive is unlocked. The processing method after successful verification varies depending on the intended use of the target hard drive. For example, if the target hard drive is used to run an operating system, the system firmware loads the boot partition and starts the operating system; or if the target hard drive is used to store data, the terminal device's operating system can read and write data to the target hard drive. The processing method for failed verification also varies depending on the intended use of the target hard drive. For example, if the target hard drive is used to run an operating system, the terminal device remains on the boot screen and cannot start the operating system; or if the target hard drive is used to store data, the terminal device cannot unlock the target hard drive and cannot read or write data to it. The terminal device then reports the abnormal login record to the cloud management platform after connecting to the network. Authentication credentials only exist briefly in the controlled memory of the system firmware; they do not enter the terminal device's desktop operating system, are not written to logs, and are not sent back to the cloud management platform. After verification, the temporary cache, derived intermediate values, and the random number for this session are immediately cleared.

[0037] In some examples, consider the scenario of a local user on a terminal device changing their password. The terminal execution module, based on the user's password change instruction, determines the first verification task information and the first password change task information. Based on the acquired first and second user passwords, it generates a first user password factor and a second user password factor, where the first user password can be the currently used original password, and the second user password can be a newly set password. It retrieves the currently valid management password factor from a specified storage area, and using at least the management password factor and the first user password factor, generates the first authentication credential for the target hard drive. Based on the first verification task information and the first authentication credential, it generates a first task instruction carrying the first verification task information and the first authentication credential, and sends the first task instruction to the target hard drive. The target hard drive, responding to the acquisition of the first task instruction, performs a verification task based on the first authentication credential, verifying the first authentication credential against the original authentication credential. If the verification result is successful, it sends first verification success information back to the terminal execution module. In response to the acquisition of the first verification pass information, the terminal execution module generates a second authentication credential for the target hard drive using at least the management password factor and the second user password factor. Based on the first password modification task information and the second authentication credential, it generates a second task instruction carrying the first password modification task information and the second authentication credential, and sends the second task instruction to the target hard drive. In response to the acquisition of the second task instruction, the target hard drive executes the password modification task based on the second authentication credential, replacing the original authentication credential on the target hard drive. After the password modification task is completed, it sends a first password modification success message back to the terminal execution module. In response to the acquisition of the first password modification success message, the terminal execution module replaces the original user password factor in the specified storage area with the second user password factor, and uploads the user password modification instruction operation to the cloud management platform. Simultaneously, it can also synchronize the second user password to a third-party backup channel. The original user password factor is the user password factor actually stored in the specified storage area, and the first user password factor corresponds to the user password factor that needs to be verified by the user. Therefore, the first user password factor and the original user password factor can be the same or different.

[0038] In this embodiment, the user interaction instruction includes a user password modification instruction. Taking the user password modification process as an example: The terminal application software determines the first verification task information and the first password modification task information based on the user password modification instruction. The local user of the terminal device enters the first user password in the terminal application software. The terminal application software generates a first user password factor based on the first user password and sends the first user password factor and the first password modification task information to the firmware driver. The firmware driver forwards the first user password factor and the first password modification task information to the system firmware. The system firmware obtains the currently valid management password factor from the designated storage area, uses at least the management password factor and the first user password factor to generate a first authentication credential for the target hard drive, generates a first task instruction based on the first verification task information and the first authentication credential, sends the first task instruction to the target hard drive, and clears the first authentication credential in the terminal execution module. The target hard drive performs a verification task based on the first authentication credential, verifies the first authentication credential with the original authentication credential, and if the verification result is successful, it sends the first verification success information back to the terminal execution module. Upon receiving the first verification pass information, the terminal application software prompts the user to enter a second user password. After obtaining the second user password, it generates a second user password factor based on it. This password change only replaces the user password factor version and does not change the device's unique identifier, management relationship, or device ownership. The terminal application software sends the second user password factor and the first password change task information to the firmware driver. The firmware driver forwards the second user password factor and the first password change task information to the system firmware. The system firmware uses at least the management password factor and the second user password factor to generate a second authentication credential for the target hard drive. Based on the first password change task information and the second authentication credential, it generates a second task instruction, sends the second task instruction to the target hard drive, and clears the second authentication credential in the terminal execution module. The target hard drive executes the password change task based on the second authentication credential, which replaces the original authentication credential of the target hard drive. After the password change task is completed, it sends a first password change success message back to the terminal execution module. In response to the successful acquisition of the first password change information, the system firmware replaces the original user password factor in the specified storage area with the second user password factor, and feeds back the new version digest, timestamp, device unique identifier and operation log to the terminal application software through the firmware driver. It can also synchronize the second user password to a third-party backup channel.

[0039] In this embodiment, the user password modification adopts a closed-loop mechanism: First, the terminal execution module first performs a legality verification using a first user password factor generated based on the first user password input by the user, combined with the currently valid management password factor; Second, after the verification passes, the new user password is received, only replacing the user password factor version, without changing the device unique identifier, management relationship, or device ownership; Third, the terminal execution module uploads the new version summary, timestamp, device unique identifier, and operation log to the cloud management platform; Fourth, after the cloud management platform confirms success, the old version user password factor index is invalidated, retaining only the new version authorization; Fifth, if the upload fails, the terminal execution module retains the rollback capability or requires the terminal device to establish a communication connection with the cloud management platform the next time it connects to the network to complete the confirmation, avoiding the occurrence of a window where the password has been modified locally but is unknown to the platform. When a user changes their password, it affects the password factor version and the derivation result of the authentication credentials. It does not change the management relationship or the ownership of the device itself. The administrator does not need to know the new user's password, nor will they lose the ability to continuously manage the terminal due to the user changing their password. What is uploaded to the cloud management platform is the password change operation information, not the password itself. The administrator can only view the change record and cannot obtain the new user's password.

[0040] In some examples, consider a scenario where a local user on a terminal device forgets their password and cannot retrieve it from a third-party backup channel. The system sends a password reset command to the cloud management platform. In response, the cloud management platform initiates a password recovery work order. If preset conditions are met, it generates a first encrypted verification code and sends it to the terminal execution module. This first encrypted verification code is a one-time verification code; the administrator cannot see its plaintext. The user or authorized personnel can obtain the plaintext of the first encrypted verification code through the user's email or a trusted channel. Preset conditions may include matching the device's unique identifier, a valid work order, and approval by both parties. Other verification conditions can be added based on actual needs. After the terminal device is run in the preset startup mode, the terminal execution module obtains the second encrypted verification code and verifies it at least with the first encrypted verification code. If the verification result is successful, the module sends verification success information to the cloud management platform. The first encrypted verification code is generated by the cloud management platform and sent to the terminal execution module, while the second encrypted verification code is obtained and entered by the user or authorized personnel from the user's email or trusted channel. Therefore, the second encrypted verification code and the first encrypted verification code may be the same or different. Upon receiving the verification information, the cloud management platform issues a one-time recovery token to the terminal execution module when conditions such as matching the device's unique identifier, valid work order, valid verification code, and approval by both parties are met. This one-time recovery token is a temporary token, not the user password or the target hard drive password in plaintext. The terminal execution module, in response to the one-time recovery token, retrieves the management password factor from the designated storage area. Based on at least the one-time recovery token and the management password factor, and optionally additional device identifier factors, it obtains permission to change the target hard drive password and generates reset task information. Based on the obtained third-party user password, it generates a third-party user password factor. Using at least the management password factor and the third-party user password factor, and optionally additional device identifier factors, it generates a third authentication credential for the target hard drive. Based on the reset task information and the third authentication credential, it generates a third task instruction carrying the reset task information and the third authentication credential, and sends the third task instruction to the target hard drive. The target hard drive, in response to the third task instruction, executes the reset task based on the third authentication credential, which replaces the original authentication credential for the target hard drive.

[0041] In this embodiment, when a user forgets their password and cannot retrieve it from a third-party backup channel, they can submit a password reset request to the administrator. The administrator initiates a password reset command through the cloud management platform. The cloud management platform responds to the command by initiating a password recovery work order and generates a first encrypted verification code when preset conditions are met. This first encrypted verification code is a one-time verification code, and the administrator cannot see its plaintext. The terminal device boots in a preset boot mode. This preset boot mode can be booting from a recovery medium containing terminal application software, such as a Live CD or USB boot disk, or booting through the system firmware recovery interface. The cloud management platform sends the first encrypted verification code to the terminal application software, which receives it. The plaintext of the first encrypted verification code is obtained by the user or an authorized person after the user's departure, via the user's email or a trusted channel. The terminal application software compares the input second encrypted verification code with the received first encrypted verification code. If the verification is successful, the verification information is sent to the firmware driver, which then forwards the verification information to the system firmware. The system firmware triggers a controlled reset process on-premises and sends verification information to the terminal application software via the firmware driver. The terminal application software then uploads this information to the cloud management platform. After confirming that the device's unique identifier matches, the work order is valid, the verification code is valid, and both parties have approved the transaction, the cloud management platform issues a one-time recovery token to the terminal application software. This one-time recovery token is a temporary token, not the user password or the target hard drive password in plaintext. The terminal application software receives the one-time recovery token and sends it to the firmware driver, which then forwards it to the system firmware. In response to the acquisition of the one-time recovery token, the system firmware retrieves the management password factor from the designated storage area. Internally, based on at least the one-time recovery token and the management password factor, and optionally additional device identifier factors, it obtains permission to change the target hard drive password and generates reset task information. The terminal application software generates a third-party password factor based on the acquired third-party password and sends it to the firmware driver, which then forwards it to the system firmware. The system firmware uses at least the management password factor and the third user password factor, and may also add device identification factors if necessary, to generate a third authentication credential for the target hard drive. Based on the reset task information and the third authentication credential, a third task instruction is generated and sent to the target hard drive. The third authentication credential is then cleared in the terminal execution module. The target hard drive responds to the acquisition of the third task instruction, executes the reset task based on the third authentication credential, replaces the original authentication credential of the target hard drive, and sends reset completion information back to the system firmware.Upon receiving the reset completion information, the system firmware invalidates the original password version, recovery token, related caches, and offline authorizations, generates an audit log, and feeds back the reset completion information and audit log to the terminal application software via the firmware driver. The terminal application software then uploads the information to the cloud management platform.

[0042] In this embodiment, when a user forgets their password and cannot retrieve it from a third-party backup channel, password reset requires simultaneous fulfillment of four conditions: device unique identifier matching, valid work order, valid verification code, and approval by both parties. Once these conditions are met, the terminal execution module internally uses at least a one-time recovery token and management password factor, and if necessary, the device unique identifier, to obtain permission to change the target hard drive password. It then regenerates the target hard drive's authentication credentials using at least the management password factor and a third-party user password factor, updating the target hard drive's authentication credentials and thus resetting the user password. At this point, the original password version, recovery token, related caches, and offline authorizations are all invalidated, and an audit log is generated. Throughout this process, the administrator, cloud management platform, and terminal execution module cannot independently export the user password and target hard drive password in plaintext, thus satisfying the mechanism requirement that the target hard drive password cannot be unilaterally restored.

[0043] In some examples, consider the scenario of an enterprise IT administrator updating their management password. The administrator enters a first management password through a cloud management platform. Based on the acquired first management password, the cloud management platform generates a first management password factor and sends the first management password factor and a management password update instruction to the terminal execution module. The terminal execution module responds to the management password update instruction and the acquisition of the first management password factor. Based on the management password update instruction, it determines the second verification task information and the second password change task information, sets the update management password flag to a first logical value, and temporarily stores the first management password factor in a designated storage area using a preset encryption algorithm. After the terminal device restarts, when the terminal execution module detects that the update management password flag is at the first logical value, it generates a user password factor based on the acquired user password; retrieves the original management password factor from the designated storage area; and generates a fourth authentication credential for the target hard drive based at least on the user password factor and the original management password factor. Based on the second verification task information and the fourth authentication credential, it generates a fourth task instruction carrying the second verification task information and the fourth authentication credential, and sends the fourth task instruction to the target hard drive. Upon receiving the fourth task instruction, the target hard drive performs a verification task based on the fourth authentication credential, verifying it against the original authentication credential. If the verification passes, it sends a second verification pass message to the terminal execution module. Upon receiving the second verification pass message, the terminal execution module generates a fifth authentication credential for the target hard drive using at least the first management password factor and the user password factor. Based on the second password modification task information and the fifth authentication credential, it generates a fifth task instruction carrying the second password modification task information and the fifth authentication credential, and sends the fifth task instruction to the target hard drive. Upon receiving the fifth task instruction, the target hard drive performs a password modification task based on the fifth authentication credential, replacing the original authentication credential. After the password modification task is completed, it sends a second password modification success message to the terminal execution module. Upon receiving the second password modification success message, the terminal execution module updates the management password flag to the second logical value and replaces the original management password factor in the specified storage area with the first management password factor. The first logical value can be 1, and the second logical value can be 0, or can be set according to actual needs; no further specific limitations are made here.

[0044] In this embodiment, the cloud management platform generates a first management password factor based on a first management password and sends the first management password factor and management password update instruction to the terminal application software. Upon receiving the management password, the terminal application software determines second verification task information and second password modification task information based on the management password update instruction, and sends the first management password factor, second verification task information, and second password modification task information to the firmware driver. The firmware driver forwards the first management password factor and task information to the system firmware. The system firmware sets the update management password flag to a first logical value and temporarily stores the first management password factor in a designated storage area using a preset encryption algorithm. After the terminal device restarts, the terminal application software generates a user password factor based on the acquired user password and forwards the user password factor to the system firmware via the firmware driver. When the system firmware detects that the update management password flag is at the first logical value, it retrieves the original management password factor from the designated storage area, generates a fourth authentication credential for the target hard drive based at least on the user password factor and the original management password factor, generates a fourth task instruction based on the second verification task information and the fourth authentication credential, sends the fourth task instruction to the target hard drive, and clears the fourth authentication credential in the terminal execution module. The target hard drive performs a verification task based on the fourth authentication credential. If the verification result is successful, it sends a second verification success message to the system firmware. In response to the second verification success message, the system firmware generates a fifth authentication credential for the target hard drive using at least the first management password factor and the user password factor. Based on the second password modification task information and the fifth authentication credential, it generates a fifth task instruction, sends the fifth task instruction to the target hard drive, and clears the fifth authentication credential in the terminal execution module. The target hard drive performs a password modification task based on the fifth authentication credential, replacing the original authentication credential. After the password modification task is completed, it sends a second password modification success message to the system firmware. In response to the second password modification success message, the system firmware updates the management password flag to the second logical value and replaces the original management password factor in the specified storage area with the first management password factor.

[0045] In this embodiment, the management password update process is as follows: The cloud management platform generates a first management password factor based on the first management password. After archiving, it encrypts and sends the first management password factor and the management password update instruction to the terminal execution module. The terminal execution module sets the update management password flag to a first logical value and temporarily stores the first management password factor in a designated storage area using a preset encryption algorithm. After the terminal device restarts, the terminal execution module detects that the update management password flag is at the first logical value. It first verifies the user password factor against the original management password factor. After successful verification, it generates a new authentication credential based at least on the user password factor and the first management password factor to complete the target hard drive password update. The update management password flag is then set to a second logical value, and the first management password factor officially takes effect and overwrites the original management password factor. The management password update does not mean that the administrator has obtained the authentication credential for the target hard drive. The new authentication credential still needs to be derived within the terminal device by combining the user password factor and the management password factor. If necessary, a device identification factor can be added to limit the derivation result to only be valid on the target terminal device.

[0046] In some examples, taking the scenario of an enterprise IT administrator forcibly resetting user passwords as an example, this scenario can be applied to situations such as lost or stolen devices, or users leaving the company. When the terminal device is powered on and the terminal execution module is connected to the cloud management platform via the network, the cloud management platform, in response to the forced password reset task, generates a third-party password and sends the third-party password and the forced password reset command to the terminal execution module. The third-party password is sent in encrypted form; the specific encryption method can be determined based on the actual situation, such as using hash encryption, without further specific limitations here. The terminal execution module, in response to the forced password reset command and the acquisition of the third-party password, replaces the original user password factor in the specified storage area with the third-party password factor generated from the third-party password, and sends a circuit breaker task information to the target hard drive. The target hard drive, in response to the acquisition of the circuit breaker task information, switches to a locked state, awaiting the user password reset. At this time, the user password reset method can be the same as the user password reset process corresponding to scenarios where the local user of the terminal device forgets their password or cannot retrieve the original user password from a third-party backup channel.

[0047] In this embodiment, when the terminal device is in the startup state and the terminal execution module is connected to the cloud management platform via the network, the cloud management platform, in response to the triggering of the forced user password reset task, generates a third user password and sends the third user password and the forced user password reset instruction to the terminal application software. The terminal application software receives the third user password and the forced user password reset instruction, generates a third user password factor based on the third user password, and forwards the third user password factor and the forced user password reset instruction to the system firmware via the firmware driver. The system firmware, in response to the forced user password reset instruction and the acquisition of the third user password factor, replaces the original user password factor in the specified storage area with the third user password factor based on the forced user password reset instruction, and sends a circuit breaker task information to the target hard drive. The target hard drive, in response to the acquisition of the circuit breaker task information, switches to a locked state by calling the locking interface of the self-encrypted hard drive, waiting for the user password to be reset; simultaneously, the cloud management platform can synchronously invalidate the terminal device's password version, invalidate the recovery work order, and freeze the authorization relationship corresponding to the device's unique identifier.

[0048] In this embodiment, the third user password is issued in encrypted form, and the administrator cannot obtain its plaintext. The target hard drive can be switched to a locked state by calling the locking interface of the encrypted hard drive, such as the Opal Lock command, instantly locking the hard drive. After the user password is forcibly reset, even if the user enters the original password, the target hard drive will still fail to verify the authentication credentials, remaining encrypted and unlockable. If unlocking the hard drive is required, the unlocking process for a forgotten user password is followed, requiring at least platform approval and verification code verification to complete the password reset. Forcibly resetting the user password does not mean the administrator has obtained the target hard drive's authentication credentials; it only means the user password factor version has been replaced. The new authentication credentials still need to be derived within the terminal device by combining the user password factor and the management password factor. If necessary, a device identification factor can be added to limit the derivation result to only valid on the target terminal device. Even if the administrator possesses the forced reset command and the management password factor, they cannot calculate the same authentication credentials offline on other terminal devices. In remote locking scenarios, the cloud management platform can also simultaneously invalidate the password factor version of the terminal device, void the recovery work order, freeze the authorization relationship corresponding to the device's unique identifier, and require the device to re-enter the approval and recovery process when it is restarted next time. Thus, even if the terminal is physically stolen, the unauthorized user cannot recover the target hard drive's authentication credentials based on materials from only one party.

[0049] In some examples, the cloud management platform is also configured to communicate with multiple terminal devices via a network, generating a unique management password factor for each terminal device, and sending each management password factor to the corresponding terminal execution module via the network. The management password factors for each terminal device are independent, updated independently, and do not interfere with each other. Once the management password factor of any terminal device is obtained, it cannot be used to generate target hard drive authentication credentials for other terminal devices. The cloud management platform can remotely configure, manage passwords, and monitor the status of target hard drive encryption for all terminal devices in an enterprise, and record the unique device identifier, asset ownership, password derivation policy template, password version number, and recovery control index for each terminal device, meeting the enterprise's large-scale terminal device management needs. When generating target hard drive authentication credentials, each terminal device uses at least its own user password factor and management password factor, and if necessary, also combines the device identifier factor to complete the authentication credential derivation within the controlled execution area of ​​the local system firmware, thereby maintaining the independence of the target hard drive authentication credentials for each terminal device and improving the security of target hard drive encryption management in multi-terminal device scenarios.

[0050] In some examples, the cloud management platform sends a validity period factor to the terminal execution module based on a preset time period. The terminal execution module writes the acquired validity period factor into a designated storage area using a preset encryption scheme, generating authentication credentials for the target hard drive using at least the user password factor, management password factor, and validity period factor. The validity period factor can be used to limit the validity time of the authentication credentials. The authentication credentials are valid for the time corresponding to the validity period factor. After the validity period expires, the terminal execution module needs to obtain a new validity period factor and regenerate the authentication credentials. The validity period factor can be associated with the password derivation policy version number issued by the cloud management platform. After a periodic update, the old validity period factor becomes invalid, and authentication credentials need to be re-derived using the new validity period factor, thereby further improving the security of terminal hard drive encryption management. The preset time period can be set according to the enterprise security policy and is not further specifically limited here.

[0051] Furthermore, if the terminal device exceeds the valid time while offline, the system firmware can roll back to the previous valid validity period factor, or temporarily use the current validity period factor, and then re-derive the authentication credentials of the target hard drive after obtaining a new validity period factor the next time it connects to the network.

[0052] In some examples, the terminal hard disk encryption management system in this disclosure can be widely applied in fields with data security protection needs, such as the financial industry, government agencies, internet companies, manufacturing, and education. In each industry scenario, user password factors and management password factors are mandatory. Device identification factors are added as needed based on industry requirements. Through the collaboration of the cloud management platform and the terminal execution module, unified management and differentiated configuration of hard disk encryption are achieved. The financial industry can use multi-factor encryption of user password factors and management password factors for core business terminal devices and server terminal devices. Government agencies can encrypt classified terminal devices and distribute management password factors in conjunction with the government intranet environment, adding device identification factors as needed. Internet companies can add device identification factors to R&D terminal devices based on user password factors and management password factors, and combine remote locking functions to prevent source code and R&D data from being taken away from the terminal device. For ordinary office terminal devices, a basic combination of user password factors and management password factors is used. In the manufacturing industry, device identification factors can be added to production terminal equipment and industrial control equipment terminal equipment in addition to user password factors and management password factors. This ensures that authentication credentials are valid only on the target terminal equipment, preventing the hard drive from being removed and used on external devices. In the education sector, research terminal equipment and administrative terminal equipment can be configured with differentiated encryption to achieve unified management and cost control. In all the aforementioned industry scenarios, device identification factors are used throughout the entire process of initial hard drive encryption setup, login unlocking, user password modification, user password reset, remote locking, and auditing. User password modifications must be confirmed by the cloud management platform to complete the closed loop. The user password reset process never exposes the target hard drive password in plaintext to individual administrators, thus ensuring a consistent security boundary across different industry scenarios.

[0053] In this embodiment, the terminal devices include, but are not limited to: computer equipment such as servers, desktop computers, laptops, workstations, all-in-one machines, and tablets; office equipment such as printers, copiers, scanners, and multifunction printers; conferencing equipment such as conference tablets, video conferencing terminals, and projectors; and other terminal devices with data storage requirements such as industrial control computers, self-service terminals, cash registers, and embedded terminals. Each of the above terminal devices is equipped with a target hard drive and is connected to the cloud management platform via a network to receive at least the corresponding management password factor, enabling remote configuration, password management, and status monitoring of the terminal hard drive encryption. The operating system of each terminal device can be Windows, Linux, or other systems; this embodiment does not impose specific limitations on the specific type and operating system of the terminal devices.

[0054] Secondly, Figure 3 A flowchart of a terminal hard disk encryption management method provided in this disclosure embodiment is shown below. Figure 3As shown, this disclosure provides a terminal hard drive encryption management method, applied to a terminal hard drive encryption management system. The system includes: a cloud management platform and a terminal execution module installed on the terminal device, a target hard drive, and a designated storage area; the cloud management platform and the terminal execution module communicate via a network; the terminal hard drive encryption management method includes: S1: The cloud management platform generates management password factors based on the obtained management password and sends the management password factors to the terminal execution module via the network.

[0055] Specifically, to ensure the communication security between the cloud management platform and the terminal execution module, a local area network (LAN) is preferred, but leased networks, logical virtual private networks (VLANs), and wide area networks (WANs) can also be used. The management password is entered by the enterprise IT (information technology) administrator. Based on the administrator's input, the cloud management platform generates management password factors. Before encrypting and sending the management password factors to the terminal execution module, the management password factors are archived. These factors can be archived to encrypted storage space or encrypted hard drives. When the cloud management platform sends the management password factors to the terminal execution module over the network, it can use symmetric or asymmetric encryption methods. No further specific limitations are made here. The specific encryption type and encryption algorithm can be selected and adjusted according to the cloud management platform and the terminal execution module.

[0056] S2: The terminal execution module determines the task information of the terminal device based at least on the terminal device status.

[0057] Specifically, the tasks corresponding to the task information include at least password-related tasks such as setting a password, unlocking a login account, and changing a password.

[0058] S3: The terminal execution module generates user password factors based on the obtained user password and writes them to the specified storage area.

[0059] Specifically, user passwords are set by the local user on the terminal device and synchronized to designated locations such as the enterprise work email and cloud encrypted storage repository to achieve third-party backup of user passwords; after the third-party backup of user passwords is completed, user password factors are generated.

[0060] S4: The terminal execution module uses at least the management password factor and the user password factor to generate authentication credentials for the target hard drive.

[0061] Specifically, the terminal execution module can add cryptographic factors for generating authentication credentials, such as device identification factors and time expiration factors, according to different security requirements, different enterprises, and different application scenarios.

[0062] S5: The terminal execution module generates a task instruction carrying task information and authentication credentials, sends the task instruction to the target hard disk, and clears the authentication credentials in the terminal execution module.

[0063] Specifically, authentication credentials are generated and used only within the controlled execution area of ​​the terminal execution module, and the plaintext results of the authentication credentials are not exposed to the administrator, cloud management platform and interface, or the desktop operating system of the terminal device; task instructions can be a combination of control instructions for sending task information to the target hard disk and data instructions carrying the authentication credentials corresponding to the task information.

[0064] S6: The target hard disk responds to the acquisition of the task instruction and executes the target task based on the task instruction.

[0065] Specifically, the task instruction carries task information and authentication credentials, and the authentication credentials in the task instruction are the password of the target hard drive; the target hard drive executes the target task based on the task information in the task instruction, and the target task includes at least password-related tasks such as setting password, unlocking login, and changing password; the target hard drive can be a self-encrypting hard drive that is compatible with the Trusted Computing Group Opal 2.0 specification.

[0066] In this embodiment, the administrator sets a management password through a cloud management platform. The cloud management platform generates management password factors based on the management password and sends the management password factors to the terminal execution module. The terminal execution module determines the task information of the terminal device based at least on the terminal device status. Local users directly set user passwords through the terminal device, and the terminal execution module generates user password factors based on the acquired user passwords. At least the management password factors and user password factors are used to generate authentication credentials for the target hard drive. A task instruction carrying task information and authentication credentials is sent to the target hard drive, and the authentication credentials are cleared in the terminal execution module. The target hard drive responds to the acquisition of the task instruction and executes the target task based on the task instruction. The terminal hard drive encryption management method in this disclosure can achieve unified network management of hard drive passwords without relying on dedicated TPM / TCM chips. This is achieved through network communication between the cloud management platform and the terminal execution module, avoiding terminal device detachment, reducing hardware costs, and preventing permanent data loss due to chip failure. The authentication credentials are generated by combining at least the management password factor and the user password factor, and are generated only within the controlled execution area of ​​the terminal execution module. After the task instruction is issued, the authentication credentials are immediately cleared from the controlled execution area. The plaintext of the authentication credentials is not exposed to the administrator, the cloud management platform and interface, or the desktop operating system of the terminal device. Even if either the management password or the user password is obtained, it is impossible to unlock the hard drive alone, thereby effectively improving the security of hard drive encryption and the controllability of the terminal device.

[0067] Although the present disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure.

Claims

1. A terminal hard disk encryption management system, characterized in that, The system includes: a cloud management platform and a terminal execution module, a target hard disk, and a designated storage area, all located on the terminal device; the cloud management platform and the terminal execution module communicate with each other via a network. The cloud management platform is configured to: generate a management password factor based on the acquired management password, and send the management password factor to the terminal execution module via the network; The terminal execution module is configured to: determine the task information of the terminal device based at least on the terminal device status; generate a user password factor based on the acquired user password and write it to the designated storage area; generate authentication credentials for the target hard disk using at least the management password factor and the user password factor; generate a task instruction carrying the task information and authentication credentials, send the task instruction to the target hard disk, and clear the authentication credentials in the terminal execution module. The target hard disk is configured to: in response to the acquisition of the task instruction, execute the target task based on the task instruction.

2. The system according to claim 1, characterized in that, The terminal execution module includes: terminal application software, firmware driver, and system firmware; the terminal application software communicates with the cloud management platform via a network. The terminal application software is configured to: receive the management password factor and send the management password factor to the firmware driver; when a user interaction instruction is obtained, determine the task information based on the user interaction instruction and send the task information to the firmware driver; generate a user password factor based on the obtained user password and send the user password factor to the firmware driver. The firmware driver is configured to forward the management password factor, user password factor, and task information to the system firmware. The system firmware is configured to: determine task information based on the terminal device status, or receive task information transmitted by the firmware driver; write at least the management password factor and user password factor into the designated storage area using a preset encryption algorithm; generate authentication credentials for the target hard drive using at least the management password factor and user password factor; generate a task instruction based on the task information and authentication credentials, and send the task instruction to the target hard drive; after the task instruction is sent to the target hard drive, clear the authentication credentials in the terminal execution module.

3. The system according to claim 1, characterized in that, The terminal execution module is further configured to: generate a unique device identifier code corresponding to the terminal device using a one-way algorithm when the terminal device is first deployed; generate a device identifier factor based on the unique device identifier code; and write the device identifier factor into the designated storage area using a preset encryption algorithm.

4. The system according to claim 1, characterized in that, The terminal execution module is further configured to: determine first verification task information and first password modification task information based on the user's password modification instruction; and generate first user password factor and second user password factor based on the obtained first user password and second user password. Obtain the management password factor from the designated storage area, and use at least the management password factor and the first user password factor to generate the first authentication credential of the target hard disk; based on the first verification task information and the first authentication credential, generate a first task instruction carrying the first verification task information and the first authentication credential, and send the first task instruction to the target hard disk; In response to the acquisition of the first verification pass information, at least the management password factor and the second user password factor are used to generate the second authentication credential of the target hard drive; based on the first password change task information and the second authentication credential, a second task instruction carrying the first password change task information and the second authentication credential is generated, and the second task instruction is sent to the target hard drive; In response to the acquisition of the first password change success information, the original user password factor in the designated storage area is replaced with the second user password factor, and the user password change instruction operation is uploaded to the cloud management platform. The target hard drive is configured to: in response to the acquisition of the first task instruction, perform a verification task based on the first authentication credential, verify the first authentication credential with the original authentication credential, and if the verification result is a pass, send the first verification pass information back to the terminal execution module; in response to the acquisition of the second task instruction, perform a password modification task based on the second authentication credential, replace the original authentication credential of the target hard drive with the second authentication credential, and after the password modification task is completed, send the first password modification success information back to the terminal execution module.

5. The system according to claim 1, characterized in that, The cloud management platform is also configured to: in response to a user password reset instruction, initiate a password recovery work order; when preset conditions are met, generate a first encrypted verification code and send the first encrypted verification code to the terminal execution module; and in response to the acquisition of verification pass information, issue a one-time recovery token to the terminal execution module. The terminal execution module is further configured to: after running the terminal device in a preset startup mode, obtain a second encrypted verification code, verify the second encrypted verification code with at least the first encrypted verification code, and if the verification result is successful, send the verification success information to the cloud management platform; in response to the acquisition of the one-time recovery token, obtain a management password factor from the designated storage area, and obtain permission to change the password of the target hard drive based at least on the one-time recovery token and the management password factor, and generate reset task information; Based on the obtained third user password, a third user password factor is generated; using at least the management password factor and the third user password factor, a third authentication credential for the target hard drive is generated; based on the reset task information and the third authentication credential, a third task instruction carrying the reset task information and the third authentication credential is generated, and the third task instruction is sent to the target hard drive. The target hard drive is configured to: in response to the acquisition of the third task instruction, perform a reset task based on the third authentication credential, wherein the third authentication credential replaces the original authentication credential of the target hard drive.

6. The system according to claim 1, characterized in that, The cloud management platform is also configured to: generate a first management password factor based on the acquired first management password, and send the first management password factor and management password update instruction to the terminal execution module; The terminal execution module is further configured to: respond to the management password update instruction and the acquisition of the first management password factor, determine the second verification task information and the second password modification task information based on the management password update instruction, set the update management password flag to the first logical value, and temporarily store the first management password factor in the designated storage area using a preset encryption algorithm; After the terminal device restarts, when the terminal execution module detects that the update management password flag is at the first logical value, it generates a user password factor based on the acquired user password. Obtain the original management password factor from the designated storage area, and generate the fourth authentication credential for the target hard drive based at least on the user password factor and the original management password factor; Based on the second verification task information and the fourth authentication credential, a fourth task instruction carrying the second verification task information and the fourth authentication credential is generated, and the fourth task instruction is sent to the target hard disk. In response to the acquisition of the second verification pass information, at least the first management password factor and the user password factor are used to generate the fifth authentication credential of the target hard disk; based on the second password change task information and the fifth authentication credential, a fifth task instruction carrying the second password change task information and the fifth authentication credential is generated, and the fifth task instruction is sent to the target hard disk; In response to the acquisition of the second password change success information, the update management password flag is set to the second logical value, and the original management password factor in the specified storage area is replaced with the first management password factor; The target hard disk is configured to: in response to the acquisition of the fourth task instruction, perform a verification task based on the fourth authentication credential, verify the fourth authentication credential with the original authentication credential, and if the verification result is a pass, send a second verification pass message back to the terminal execution module; In response to the acquisition of the fifth task instruction, a password change task is performed based on the fifth authentication credential. The fifth authentication credential replaces the original authentication credential of the target hard drive. After the password change task is completed, the second password change success information is fed back to the terminal execution module.

7. The system according to claim 1, characterized in that, When the terminal device is in the startup state and the terminal execution module is connected to the cloud management platform via the network; The cloud management platform is also configured to: in response to the triggering of a forced reset user password task, generate a third user password, and send the third user password and the forced reset user password instruction to the terminal execution module; The terminal execution module is further configured to: in response to the forced reset user password instruction and the acquisition of the third user password, based on the forced reset user password instruction, replace the original user password factor in the specified storage area with the third user password factor, and send circuit breaker task information to the target hard disk; The target hard drive is configured to switch to a locked state in response to the acquisition of the circuit breaker task information, and wait for the user password to be reset.

8. The system according to claim 1, characterized in that, The cloud management platform is further configured to: communicate with multiple terminal devices via a network, generate a management password factor unique to each terminal device, and send each management password factor to the corresponding terminal execution module via the network.

9. The system according to claim 1, characterized in that, The cloud management platform is also configured to send a timeliness factor to the terminal execution module based on a preset time period. The terminal execution module is configured to: write the acquired timeliness factor into the designated storage area using a preset encryption algorithm, and generate authentication credentials for the target hard drive using at least the user password factor, management password factor, and timeliness factor.

10. A terminal hard disk encryption management method, characterized in that, An encryption management system for terminal hard drives is provided, comprising: a cloud management platform and a terminal execution module installed on the terminal device, a target hard drive, and a designated storage area; the cloud management platform and the terminal execution module communicate via a network; the terminal hard drive encryption management method includes: The cloud management platform generates a management password factor based on the acquired management password, and sends the management password factor to the terminal execution module via the network; The terminal execution module determines the task information of the terminal device based at least on the terminal device status; The terminal execution module generates a user password factor based on the acquired user password and writes it into the designated storage area; The terminal execution module uses at least the management password factor and the user password factor to generate authentication credentials for the target hard drive; The terminal execution module generates a task instruction carrying the task information and authentication credentials, sends the task instruction to the target hard disk, and clears the authentication credentials in the terminal execution module; The target hard disk responds to the acquisition of the task instruction and executes the target task based on the task instruction.

Images