A computer full-disk data encryption and security authentication method for high security scenarios

Abstract

The application relates to a computer full-disk data encryption and security authentication method for a high-security scene and belongs to the field of data security. The application first connects an encryption device to a trusted management host, inputs user fingerprint information, binds a computer mainboard ID, a user identity ID, an encryption device hardware chip ID and a software encryption PIN code; installs the encryption device to the computer and performs hard disk authorization authentication, uses the computer mainboard ID and the encryption device hardware chip ID to decrypt the encryption device key after the fingerprint comparison succeeds, and releases the hard disk access permission if the decryption succeeds; performs protected data reading and writing after starting the computer, and obtains the hard disk reading and writing permission after the key calculated by the PIN code input by the user is compared with the key in the encryption device. The application separates the security authorization processes of the system disk and the data disk through a double-layer access control mechanism, and can effectively prevent and control the data security risks caused by unauthorized access, device loss and stolen storage hard disks.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a method for full-disk data encryption and security authentication of computers for high-confidentiality scenarios. Background Technology

[0002] With the rapid development of the Internet, the Internet of Things, and big data technologies, data has become a core element driving development in various fields, encompassing core business data of enterprises, personal privacy data, and even important national data. Ensuring data storage security is of paramount importance for protecting privacy, preventing information leaks, and supporting business development.

[0003] In the current information environment, data security is usually divided into two levels: information system level and host level. (1) Information system level: refers to a system formed by interconnecting multiple computers through network media such as twisted pair and optical fiber, focusing on data security at the entire system level (such as network, application, data flow, etc.); (2) Host level: refers to a single computing device (such as server, PC), focusing on data protection of the operating system, application, local storage, etc. of the single device itself.

[0004] For information system-level data security, the industry already has mature products such as server cryptographic machines, network cryptographic machines, and storage cryptographic machines. These can provide security protection for data in application systems, network transmissions, and centralized storage within an information system. However, these technologies primarily target data security at application system authorized access, network boundaries, and centralized storage systems, and lack the capability to protect the operating system and locally stored data of individual computing devices. Therefore, within information systems, it is often necessary to combine host-level protection to complete the construction of a comprehensive data security protection system.

[0005] For host-level data security, both domestic and international researchers have conducted technical research on cryptography-based software encryption and hardware encryption. However, in engineering applications and implementation, due to compatibility issues, performance bottlenecks, implementation costs, or complex key management, existing technologies can only meet the needs of general data protection scenarios and are not suitable for requirements such as minimal access permissions, whole-machine data encryption, and mandatory data protection in high-security scenarios.

[0006] Therefore, there is an urgent need for a dedicated data encryption protection and authentication technology solution for host devices, especially for host devices in high-security environments, to enhance the security and access control capabilities of data on host devices and effectively address security threats caused by device loss, storage hard drive theft, and unauthorized access. Summary of the Invention

[0007] The purpose of this application is to provide a method for full-disk data encryption and security authentication of computers in high-security scenarios. It aims to solve the problem of the lack of full-disk data security protection in the current host. This application separates the security authorization process of the system disk and the data disk through a two-layer access control mechanism, and realizes full-disk encryption. It can effectively prevent data security risks caused by unauthorized access, device loss and storage hard drive theft.

[0008] This application provides a method for full-disk data encryption and security authentication on computers in high-security scenarios, the method comprising: S1. Connect the encryption device to the trusted management host to initialize the new hardware chip. The encryption device includes a fingerprint input module and an encryption / decryption and read / write control module. The initialization steps include: creating a user in the trusted management host's management software and generating a user ID; using the user ID as encryption parameter P1 and obtaining key Key-1 through an encryption algorithm; recording the user's fingerprint information and generating key Key-5; inputting a software-encrypted PIN code and using it as encryption parameter P4 and obtaining key Key-2 through an encryption algorithm; recording the user's computer's motherboard ID and using it as encryption parameter P2; reading the encryption device's hardware chip ID and using it as encryption parameter P3; using encryption parameters P2 and P3 as common encryption parameters, encrypting key Key-1 to key Key-3 and key Key-2 to obtain key Key-4 through an encryption algorithm; writing key Key-3, key Key-4, and key Key-5 to the secure storage area of ​​the encryption / decryption and read / write control module of the encryption device, and saving key Key-1, key Key-2, and key Key-5 to the trusted management host. S2. The process is as follows: S3, Power-on hard drive authorization and authentication process; After the computer is powered on, a device self-test is performed. After the self-test passes, a fingerprint collection request is initiated; The user's fingerprint is collected through the fingerprint input module, and the fingerprint collection result is compared with the encryption device's key Key-5; If the fingerprint comparison is successful, the computer's motherboard ID and the encryption device's hardware chip ID are obtained, and the computer's motherboard ID and the encryption device's hardware chip ID are used as decryption parameters to decrypt the keys Key-3 and Key-4 in the encryption device; If decryption is successful and keys Key-1 and Key-2 are obtained, hard drive access is granted; S4, Computer startup process; The operating system is started during the computer startup process; S5, Protected data read / write process; The computer's data is automatically started using the authorized software, and the user enters a PIN code; Key-2-User is calculated using the user's entered PIN code and compared with the key Key-2 in the encryption device. If the comparison is successful, hard drive read / write permissions are obtained; The encryption / decryption and read / write control module of the encryption device controls the hard drive data read / write process. The system disk uses key Key-1 for encryption and decryption, and the data disk uses key Key-2 for encryption and decryption.

[0009] The computer full-disk data encryption and security authentication method provided in this application for high-security scenarios adopts a layered security protection design of hardware and software. The hardware layer completes hardware-level trusted authentication before the computer operating system is loaded by binding hardware-specific information (fingerprint, user ID, device information, etc.) to unlock the operating system's boot capability. After the operating system starts up, the software layer implements data access control and encryption protection. Therefore, this application separates the security authorization process of the system disk and data disk through a two-layer access control mechanism, realizing full-disk encryption, which can effectively prevent data security risks caused by unauthorized access, device loss, and storage hard drive theft. Moreover, this method has the advantages of low cost, high performance, and high compatibility.

[0010] In an optional embodiment of this application, the encryption device has an input SATA interface; in step S1, the input SATA interface is connected to the motherboard of the trusted management host.

[0011] In the above technical solution, the encryption device adopts the standard SATA protocol interface design, which helps to ensure the compatibility of the encryption device and has a low cost.

[0012] In an optional embodiment of this application, the encryption device has an input SATA interface and an output SATA interface; in step S2, the input SATA interface is connected to the motherboard of the computer, and the output SATA interface is connected to the SATA hard drive configured on the computer.

[0013] In the above technical solution, the encryption device adopts a standard SATA protocol interface design, connecting the input SATA interface to the computer's motherboard and the output SATA interface to the SATA hard drive configured on the computer. This enables complete encryption of a single hard drive, ensuring seamless compatibility with current computer hosts, which helps guarantee the compatibility of the encryption device, and is also low in cost.

[0014] In an optional embodiment of this application, when the computer is configured with multiple SATA hard drives, the encryption device is provided with encryption / decryption and read / write control modules corresponding to the number of SATA hard drives, and the encryption device is configured with one fingerprint input module; each encryption / decryption and read / write control module is configured with one input SATA interface and one output SATA interface; any one of the multiple encryption / decryption and read / write control modules is connected to the fingerprint input module; the multiple encryption / decryption and read / write control modules are connected to each other through a cascading interface.

[0015] In the above technical solution, each hard drive can be controlled by an independent encryption / decryption and read / write control module. User authorization information can be transferred between hard drives through the cascading interface between modules. Users only need to complete the authorization authentication at the fingerprint input module connected to any hard drive (encryption / decryption and read / write control module), and the authorization information can be automatically synchronized to all cascaded hard drives through the cascading channel.

[0016] In an optional embodiment of this application, the encryption device has a fingerprint sensor input interface; in step S2, the fingerprint input module is placed outside the computer and connected to the fingerprint sensor input interface via a data cable.

[0017] In the above technical solution, users can complete the authorization authentication by using an external fingerprint input module connected to any hard drive (encryption / decryption and read / write control module), and the authorization information can be automatically synchronized to all cascaded hard drives through the cascading channel.

[0018] In an optional embodiment of this application, when the hardware chip of the encryption device fails, the computer full-disk data encryption and security authentication method for high-security scenarios further includes: first performing hardware chip initialization recovery, and then performing steps S2, S3, S4 and S5 in sequence; the hardware chip initialization recovery step includes: reading keys Key-1, Key-2 and Key-5 through the management software of the trusted management host; connecting the new encryption device to the trusted management host, reading the hardware chip ID of the new encryption device, and using the hardware chip ID of the new encryption device as the encryption parameter New-P3; using encryption parameter P2 and encryption parameter New-P3 as common encryption parameters, encrypting key Key-1 into key New-Key-3 and encrypting key Key-2 into key New-Key-4 using the encryption algorithm; and writing key New-Key-3, key New-Key-4 and key Key-5 into the secure storage area of ​​the new encryption device.

[0019] In the above technical solution, when the hardware chip of the encryption device fails and the hard drive data cannot be read normally, the hard drive can be bound to a new encryption device through the trusted management software of the trusted management host, and the hard drive data can be read again.

[0020] In an optional implementation of this application, when a computer malfunctions, the method for full-disk data encryption and security authentication for high-security scenarios further includes: first performing hardware chip initialization recovery, and then sequentially performing steps S2, S3, S4, and S5; the hardware chip initialization recovery step includes: reading keys Key-1, Key-2, and Key-5 through the management software of the trusted management host; recording the new computer's motherboard ID into the trusted management host, and using the new computer's motherboard ID as the encryption parameter New-P2; using encryption parameters New-P2 and P3 as common encryption parameters, encrypting key Key-1 into key New-Key-3 and encrypting key Key-2 into key New-Key-4 using an encryption algorithm; and writing key New-Key-3, key New-Key-4, and key Key-5 into the secure storage area of ​​the encryption device.

[0021] In the above technical solution, when a computer malfunction causes the hard drive data to be unreadable, the hard drive can be bound to a new computer through the trusted management software of the trusted management host, thus restoring the readability of the hard drive data.

[0022] In an optional implementation of this application, when both the hardware chip of the encryption device and the computer fail, the computer full-disk data encryption and security authentication method for high-security scenarios further includes: first performing hardware chip initialization recovery, and then performing steps S2, S3, S4, and S5 sequentially; the hardware chip initialization recovery step includes: reading keys Key-1, Key-2, and Key-5 through the management software of the trusted management host; connecting the new encryption device to the trusted management host, reading the hardware chip ID of the new encryption device, and using the hardware chip ID of the new encryption device as the encryption parameter New-P3; recording the motherboard ID of the new computer into the trusted management host, and using the motherboard ID of the new computer as the encryption parameter New-P2; using encryption parameters New-P2 and New-P3 as common encryption parameters, encrypting key Key-1 into key New-Key-3 and encrypting key Key-2 into key New-Key-4 using an encryption algorithm; and writing keys New-Key-3, New-Key-4, and Key-5 into the secure storage area of ​​the new encryption device.

[0023] In the above technical solution, when both the encryption device hardware chip and the computer fail, causing the hard drive data to be unreadable, the hard drive can be bound to a new encryption device and a new computer through the trusted management software of the trusted management host, thereby restoring the readability of the hard drive data.

[0024] In an optional implementation of this application, the computer boot process includes: completing BIOS authentication and user authentication, until the operating system boot is completed. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 A structural diagram of the encryption device provided in this application.

[0027] Figure 2 This is a schematic diagram illustrating the installation of the encryption device and computer provided in this application.

[0028] Figure 3 The system initialization and hardware fault recovery flowchart provided for this application.

[0029] Figure 4 A flowchart of the data encryption and security authentication system provided for this application. Detailed Implementation

[0030] This application provides a method for full-disk data encryption and security authentication in high-security scenarios, the method comprising: S1, Connect the encryption device to the trusted management host to initialize the new hardware chip; The encryption device includes a fingerprint input module and an encryption / decryption and read / write control module. The steps for initializing a new hardware chip include: creating a user and generating a user ID in the management software of the trusted management host; using the user ID as encryption parameter P1 and obtaining key Key-1 through an encryption algorithm; recording the user's fingerprint information and generating key Key-5; inputting a software-encrypted PIN code and using it as encryption parameter P4 and obtaining key Key-2 through an encryption algorithm; recording the motherboard ID of the user's computer and using it as encryption parameter P2; reading the hardware chip ID of the encryption device and using it as encryption parameter P3; using encryption parameters P2 and P3 as common encryption parameters, encrypting key Key-1 into key Key-3 and encrypting key Key-2 into key Key-4 through an encryption algorithm; writing key Key-3, key Key-4, and key Key-5 into the secure storage area of ​​the encryption / decryption and read / write control module of the encryption device, and saving key Key-1, key Key-2, and key Key-5 to the trusted management host. S2, install the encryption device onto the computer; S3, boot disk authorization and authentication process; After the computer is powered on, it first performs a device self-test. If the self-test passes, it initiates a fingerprint collection request. The user's fingerprint is collected through the fingerprint input module, and the fingerprint collection result is compared with the encryption device's key Key-5. If the fingerprint comparison is successful, the computer's motherboard ID and the encryption device's hardware chip ID are obtained. The computer's motherboard ID and the encryption device's hardware chip ID are then used as decryption parameters to decrypt the encryption device's keys Key-3 and Key-4. If the decryption is successful and keys Key-1 and Key-2 are obtained, then hard drive access is granted. S4, Computer startup process; The operating system boots up during the computer startup process. S5, protected data read / write process; The computer's data is automatically started using authorized software, and the user enters a PIN code. The user-entered PIN code is used to calculate Key-2-User, which is then compared with the key Key-2 in the encryption device. If the comparison is successful, hard drive read and write permissions are obtained. The encryption / decryption and read / write control module of the encryption device controls the hard drive data read and write process. The system disk uses key Key-1 for encryption and decryption, and the data disk uses key Key-2 for encryption and decryption.

[0031] The computer full-disk data encryption and security authentication method provided in this application for high-confidential scenarios adopts a hardware and software layered security protection design. The hardware layer realizes hardware-level trusted authentication by binding hardware feature information (fingerprint, user ID, device information, etc.) before the computer operating system is loaded, thereby unlocking the operating system boot capability. After the operating system is started, the software layer realizes data access control and encryption protection.

[0032] This application separates the security authorization process for the system disk and data disk through a two-layer access control mechanism, applying different security authentication methods to the two disks. At the hardware level, the system disk uses multi-factor authentication, including fingerprints, host device IDs, and user IDs, to authorize and authenticate the legitimacy of the host device and user identity. For the data disk, after successful authentication at the first layer, a further enhanced read / write authentication is performed at the software level using a PIN code. This method effectively solves the problem that existing disk encryption methods cannot encrypt the system disk (encryption makes it unrecognizable by the operating system). Furthermore, the combined hardware and software two-layer access control technology significantly improves the security level of the data disk, achieving full disk encryption. This effectively prevents data security risks caused by unauthorized access, device loss, and storage hard drive theft, thus addressing the current lack of full disk data security protection in enterprises and institutions (especially those with high confidentiality requirements). Moreover, this method offers advantages such as low cost, high performance, and high compatibility.

[0033] The following is a detailed description of the structure of the encryption device.

[0034] Figure 1 For a structural diagram of the encryption device provided in this application, please refer to [link / reference]. Figure 1 In some optional embodiments of this application, the encryption device includes a fingerprint input module (not shown in the figure) and an encryption / decryption and read / write control module; the encryption device provides two standard SATA interfaces (i.e., an input SATA interface and an output SATA interface) and a fingerprint sensor input interface connected to the fingerprint input module.

[0035] The fingerprint input module is used to connect to an external fingerprint sensor and to receive raw fingerprint images or feature data. The fingerprint comparison and verification process is completed in a secure environment within the encryption / decryption and read / write control module of the encryption device.

[0036] Encryption / decryption and read / write control module: Provides cryptographic computation capabilities, stores sensitive data such as fingerprints, and is responsible for controlling read / write permissions to the SATA interface based on authorization status. The cryptographic algorithm in this application is implemented in hardware, providing high-speed, low-latency cryptographic computation capabilities without reducing the data storage and access bandwidth of existing computers, achieving high performance.

[0037] Input SATA interface: Used to connect the motherboard to the computer.

[0038] Output SATA interface: Used to connect the SATA hard drive configured on the computer.

[0039] The encryption device of this application adopts the standard SATA protocol interface design. The encryption, decryption and read / write control modules are implemented based on the standard SATA protocol. The disk is recognized as a standard SATA disk in the host operating system. It does not require a specific motherboard, hard drive, slot, or operating system, nor does it require the installation of specific drivers. It can be adapted to mainstream computer devices and supports the reuse of old personal computers, workstations, and servers, significantly reducing implementation costs.

[0040] When a computer is equipped with multiple SATA hard drives that need protection, the encryption device also has a cascading interface for connecting multiple SATA hard drives. Specifically, the encryption device has encryption / decryption and read / write control modules corresponding to the number of SATA hard drives, and the encryption device is equipped with one fingerprint input module; each encryption / decryption and read / write control module is equipped with one input SATA interface and one output SATA interface; any one of the multiple encryption / decryption and read / write control modules is connected to the fingerprint input module; the multiple encryption / decryption and read / write control modules are connected to each other through the cascading interface.

[0041] Furthermore, when the encryption device is equipped with encryption / decryption and read / write control modules corresponding to the number of SATA hard drives, each encryption / decryption and read / write control module is configured with two cascaded interfaces.

[0042] The following provides a detailed description of the computer full-disk data encryption and security authentication method for high-security scenarios provided in this application.

[0043] S1 connects the encryption device to the trusted management host to initialize the new hardware chip.

[0044] The initialization of the new hardware chip is performed on a separate trusted management host; in step S1, the input SATA interface of the encryption device is connected to the motherboard of the trusted management host to perform the initialization of the new hardware chip.

[0045] Figure 3 For the system initialization and hardware fault recovery flowchart provided in this application, please refer to [link / reference needed]. Figure 3The encryption device is connected to the trusted management host. The management software of the trusted management host detects whether the hardware chip status of the encryption device is new hardware. If it is new hardware, the new hardware chip initialization process is performed.

[0046] Specifically, the detailed process for initializing a new hardware chip is as follows: S11. Create a user in the management software of the trusted management host and randomly generate a unique user ID (hereinafter referred to as the user ID). The user ID is fixed after generation and cannot be modified. The user ID is used as the encryption parameter P1 and is encrypted to obtain the key Key-1.

[0047] S12, after the user is created, the user is prompted to enter multiple fingerprint information and generate key Key-5; the user is prompted to enter the software encrypted PIN code, which is used as encryption parameter P4 and encrypted to obtain key Key-2; the user is prompted to enter the motherboard ID of the user's computer, which is used as encryption parameter P2.

[0048] S13, read the unique ID of the hardware chip of the encryption device (hereinafter referred to as the hardware chip ID of the encryption device) through the management software on the trusted management host, and use the hardware chip ID of the encryption device as the encryption parameter P3.

[0049] S14, using encryption parameters P2 and P3 as common encryption parameters, the encryption algorithm encrypts key-1 to key-3 and key-2 to obtain key-4.

[0050] S15, write keys Key-3, Key-4 and Key-5 into the secure storage area of ​​the encryption / decryption and read / write control module of the encryption device, and save keys Key-1, Key-2 and Key-5 to the trusted management host; After completing steps S11 to S15 above, the unique binding of the computer motherboard ID, user identity ID, encryption device hardware chip ID, and software encryption PIN code is completed.

[0051] S2, install the encryption device onto the computer.

[0052] Figure 2 Please refer to the installation diagram of the encryption device and computer provided in this application. Figure 2 In step S2, the input SATA interface is connected to the computer's motherboard, and the output SATA interface is connected to the SATA hard drive configured on the computer.

[0053] The encryption device adopts a standard SATA protocol interface design. The input SATA interface is connected to the computer's motherboard, and the output SATA interface is connected to the SATA hard drive configured on the computer. This enables complete encryption of a single hard drive, which helps ensure the compatibility of the encryption device and is low in cost.

[0054] Furthermore, the fingerprint input module is placed outside the computer, and the fingerprint input module is connected to the fingerprint sensor input interface via a data cable.

[0055] like Figure 2 As shown, in some optional embodiments of this application, when the computer is configured with multiple SATA hard drives, the encryption device is provided with encryption / decryption and read / write control modules corresponding to the number of SATA hard drives. Each encryption / decryption and read / write control module is configured with one input SATA interface and one output SATA interface. All input SATA interfaces are connected to the computer's motherboard, and each output SATA interface is connected to the corresponding SATA hard drive. The encryption device is configured with one fingerprint input module. Any one of the multiple encryption / decryption and read / write control modules is connected to the fingerprint input module, and the multiple encryption / decryption and read / write control modules are connected to each other through a cascading interface.

[0056] The above method allows each hard drive to be controlled by an independent encryption / decryption and read / write control module, maintaining the original SATA interface. User authorization information is transferred between hard drives through the cascading interface between modules, which helps ensure that there is no performance bottleneck when multiple hard drives are read and written simultaneously. In the subsequent boot hard drive authorization authentication process in step S3, the user only needs to complete the authorization authentication at the fingerprint input module connected to any hard drive (encryption / decryption and read / write control module). The user authorization information of the first layer of authentication can be automatically synchronized to all cascaded hard drives through the cascading channel.

[0057] Figure 4 The workflow diagram of the data encryption and security authentication system provided in this application, corresponding to steps S3, S4, and S5 of this application, can be found here. Figure 4 After the encryption device is initialized and installed on the computer, a first-level access authorization authentication must be performed via fingerprint, which only grants access to the system disk. Immediately after system startup, a second-level access security authentication must be performed at the software level, granting access to the remaining disk partitions. If the second-level access security authentication is not completed at the software level within a specific timeframe, further data access will be prohibited at the software level. The specific steps are as follows: S3, boot disk authorization and authentication process.

[0058] S31. After the computer is powered on, it first performs a device self-test. After the self-test is passed, it initiates a fingerprint collection request.

[0059] S32 collects the user's fingerprint through the fingerprint input module, compares the fingerprint collection result with the encryption device's key Key-5, and can only proceed with subsequent startup after the user's identity is authenticated (i.e., the fingerprint comparison is successful).

[0060] S33, obtain the computer's motherboard ID (as decryption parameter P2) and the hardware chip ID of the encryption device (as decryption parameter P3), and attempt to use decryption parameters P2 and P3 to decrypt the keys Key-3 and Key-4 in the encryption device to verify the legitimacy of the encryption device.

[0061] S34. After successful decryption, the keys Key-1 and Key-2 are obtained, and hard drive access is granted. The hard drive authorization and authentication process is completed.

[0062] S4, Computer Startup Process.

[0063] The computer boot process involves BIOS authentication and user authentication until the operating system has finished booting, a process consistent with that of a regular computer.

[0064] S5, protected data read / write process.

[0065] After the S51 operating system boots up, the data uses the authorized software to start automatically and prompts the user to enter a PIN code.

[0066] S52 calculates Key-2-User using the PIN code entered by the user, and compares it with the key Key-2 in the encryption device. If the comparison is successful, read and write permissions to the hard drive are obtained.

[0067] S53 controls the hard disk data read / write process through the encryption / decryption and read / write control module of the encryption device. In the subsequent hard disk data read / write process, the system disk uses key-1 for encryption and decryption, and the data disk uses key-2 for encryption and decryption.

[0068] In some optional embodiments of this application, the computer full-disk data encryption and security authentication method for high-security scenarios provided in this application also includes a hardware failure recovery process for the encryption device; such as Figure 3 As shown, when the hardware chip of the encryption device fails, the computer fails, or other failures cause the hard drive data to be unreadable, the encryption device is connected to the trusted management host. The management software of the trusted management host checks whether the hardware chip status of the encryption device is "recovery hardware". If it is "recovery hardware", the recovery hardware chip initialization process is performed. The hard drive is then bound to a new encryption device or a new computer through the management software of the trusted management host to restore the readability of the hard drive data.

[0069] Specifically, the input SATA interface of the encryption device is connected to the motherboard of the trusted management host to perform hardware chip initialization for recovery.

[0070] When a hardware chip failure in the encryption device causes the hard drive data to be unreadable, the hardware chip initialization recovery process is first performed. The hard drive is bound to a new encryption device using the trusted management software on the trusted management host to restore hard drive data read performance. Then, steps S2, S3, S4, and S5 are performed sequentially. Specifically, when the hardware chip of the encryption device fails, the hardware chip initialization recovery steps include: reading keys Key-1, Key-2, and Key-5 using the trusted management host's management software; connecting the new encryption device to the trusted management host, reading the hardware chip ID of the new encryption device, and using the hardware chip ID as the encryption parameter New-P3; using encryption parameters P2 and New-P3 as common encryption parameters, encrypting key Key-1 into key New-Key-3 and key Key-2 into key New-Key-4 using the encryption algorithm; and writing keys New-Key-3, New-Key-4, and Key-5 into the secure storage area of ​​the new encryption device.

[0071] When a computer malfunction causes hard drive data to become unreadable, the hardware chip initialization process is first initiated. The hard drive is then bound to a new computer using the trusted management software on the trusted management host to restore hard drive data read performance. Steps S2, S3, S4, and S5 are then performed sequentially. Specifically, when a computer malfunctions, the hardware chip initialization process includes: reading keys Key-1, Key-2, and Key-5 using the trusted management host's management software; recording the new computer's motherboard ID into the trusted management host, using the new computer's motherboard ID as the encryption parameter New-P2; using encryption parameters New-P2 and P3 as common encryption parameters, encrypting key Key-1 into key New-Key-3 and key Key-2 into key New-Key-4 using an encryption algorithm; and writing keys New-Key-3, New-Key-4, and Key-5 into the secure storage area of ​​the encryption device.

[0072] When both the encryption device hardware chip and the computer fail, causing the hard drive data to be unreadable, the hardware chip initialization process is first performed. The hard drive is then bound to a new encryption device and a new computer by the trusted management software of the trusted management host to restore the hard drive data reading performance. Then, steps S2, S3, S4 and S5 are performed in sequence. Specifically, when both the encryption device hardware chip and the computer fail, the steps to restore the hardware chip initialization include: reading keys Key-1, Key-2, and Key-5 through the management software of the trusted management host; connecting the new encryption device to the trusted management host, reading the hardware chip ID of the new encryption device, and using the hardware chip ID of the new encryption device as the encryption parameter New-P3; recording the motherboard ID of the new computer into the trusted management host, and using the motherboard ID of the new computer as the encryption parameter New-P2; using encryption parameters New-P2 and New-P3 as common encryption parameters, encrypting key Key-1 into key New-Key-3 and encrypting key Key-2 into key New-Key-4 using an encryption algorithm; and writing keys New-Key-3, New-Key-4, and Key-5 into the secure storage area of ​​the new encryption device.

[0073] In summary, the computer full-disk data encryption and security authentication method provided in this application for high-security scenarios consists of two levels of authorization. The first level of authorization can be performed after the computer motherboard is powered on, mainly through an external fingerprint sensor, without requiring the computer's operating system to boot. The second level of authorization must be performed after the computer's operating system boots up, requiring the user to enter a relevant PIN code. The disk is divided into system disk and non-system disk. For the system installation disk (unique), only the first level of authorization is required for access for a specified duration. The first level of authorization authentication must be completed before entering the BIOS password. For non-system disks, the first level of authorization authentication must also be performed when the computer motherboard is powered on, and the second level of authorization authentication must be completed after the computer's system boots up. Data access is only permitted after both authentications are successful. Based on this access authorization scheme, encryption of all data files, including operating system data files, can be achieved without affecting system operation. After authorization, the device performs real-time decryption and low-latency data forwarding for hard drive access, ensuring that the device's data access is consistent with that of ordinary disks, guaranteeing its universality and compatibility. Therefore, this application provides a low-cost, highly compatible, and flexible data encryption storage solution for existing personal computers. This solution has the advantages of low cost, good compatibility, and no reduction in the data storage and access bandwidth of existing computers, while meeting the requirements for encrypting and storing all data files on personal computers.

[0074] The embodiments described above are some, but not all, of the embodiments of this application. The detailed description of the embodiments of this application is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

Claims

1. A method for full-disk data encryption and security authentication in high-security scenarios, characterized in that, include: S1, Connect the encryption device to the trusted management host to initialize the new hardware chip; The encryption device includes a fingerprint input module and an encryption / decryption and read / write control module. The steps for initializing the newly added hardware chip include: creating a user in the management software of the trusted management host and generating a user identity ID; using the user identity ID as encryption parameter P1 and obtaining key Key-1 through an encryption algorithm; recording the user's fingerprint information and generating key Key-5; inputting a software-encrypted PIN code and using the software-encrypted PIN code as encryption parameter P4 and obtaining key Key-2 through an encryption algorithm; recording the motherboard ID of the user's computer and using the motherboard ID of the computer as encryption parameter P2; reading the hardware chip ID of the encryption device and using the hardware chip ID of the encryption device as encryption parameter P3; using encryption parameters P2 and P3 as common encryption parameters, encrypting key Key-1 into key Key-3 and encrypting key Key-2 into key Key-4 through an encryption algorithm; writing key Key-3, key Key-4, and key Key-5 into the secure storage area of ​​the encryption / decryption and read / write control module of the encryption device; and saving key Key-1, key Key-2, and key Key-5 to the trusted management host. S2, Install the encryption device into the computer; S3, boot disk authorization and authentication process; After the computer is powered on, it first performs a device self-test process. After the self-test is passed, it initiates a fingerprint collection request. The fingerprint input module collects the user's fingerprint, and the fingerprint collection result is compared with the key Key-5 of the encryption device. If the fingerprint comparison is successful, the motherboard ID of the computer and the hardware chip ID of the encryption device are obtained, and the motherboard ID of the computer and the hardware chip ID of the encryption device are used as decryption parameters to decrypt the keys Key-3 and Key-4 in the encryption device. If the decryption is successful and the keys Key-1 and Key-2 are obtained, then hard drive access is granted. S4, Computer startup process; The operating system startup is completed during the computer startup process; S5, protected data read / write process; The computer uses authorized software to start automatically, and the user enters a PIN code; Key-2-User is calculated using the PIN code entered by the user, and compared with the key Key-2 in the encryption device. If the comparison is successful, hard drive read and write permissions are obtained; the hard drive data read and write process is controlled by the encryption / decryption and read / write control module of the encryption device. The system disk uses the key Key-1 for encryption and decryption, and the data disk uses the key Key-2 for encryption and decryption.

2. The method for full-disk data encryption and security authentication in high-security scenarios according to claim 1, characterized in that, The encryption device has an input SATA interface; In step S1, the input SATA interface is connected to the motherboard of the trusted management host.

3. The method for full-disk data encryption and security authentication in high-security scenarios according to claim 1, characterized in that, The encryption device has an input SATA interface and an output SATA interface; In step S2, the input SATA interface is connected to the motherboard of the computer, and the output SATA interface is connected to the SATA hard drive configured on the computer.

4. The method for full-disk data encryption and security authentication in high-security scenarios according to claim 3, characterized in that, When the computer is configured with multiple SATA hard drives, the encryption device is equipped with encryption / decryption and read / write control modules corresponding to the number of SATA hard drives, and the number of fingerprint input modules configured in the encryption device is one. Each of the encryption / decryption and read / write control modules is configured with one input SATA interface and one output SATA interface; Any one of the plurality of encryption / decryption and read / write control modules is connected to the fingerprint input module; The multiple encryption / decryption and read / write control modules are connected via a cascading interface.

5. The method for full-disk data encryption and security authentication in high-security scenarios according to claim 4, characterized in that, The encryption device has a fingerprint sensor input interface; In step S2, the fingerprint input module is placed outside the computer and connected to the fingerprint sensor input interface via a data cable.

6. The method for full-disk data encryption and security authentication in high-security scenarios according to claim 1, characterized in that, When the hardware chip of the encryption device fails, the computer full disk data encryption and security authentication method for high-security scenarios further includes: first performing hardware chip initialization recovery, and then performing steps S2, S3, S4 and S5 in sequence. The steps for restoring hardware chip initialization include: reading the keys Key-1, Key-2, and Key-5 through the management software of the trusted management host; connecting the new encryption device to the trusted management host, reading the hardware chip ID of the new encryption device, and using the hardware chip ID of the new encryption device as encryption parameter New-P3; using encryption parameter P2 and encryption parameter New-P3 as common encryption parameters, encrypting key Key-1 into key New-Key-3 and key Key-2 into key New-Key-4 using an encryption algorithm; and writing key New-Key-3, key New-Key-4, and key Key-5 into the secure storage area of ​​the new encryption device.

7. The method for full-disk data encryption and security authentication in high-security scenarios according to claim 1, characterized in that, When the computer malfunctions, the computer full disk data encryption and security authentication method for high-security scenarios further includes: first performing hardware chip initialization for recovery, and then performing steps S2, S3, S4 and S5 in sequence; The steps for restoring hardware chip initialization include: reading the keys Key-1, Key-2, and Key-5 through the management software of the trusted management host; recording the motherboard ID of the new computer into the trusted management host, and using the motherboard ID of the new computer as the encryption parameter New-P2; using the encryption parameter New-P2 and the encryption parameter P3 as common encryption parameters, encrypting the key Key-1 into the key New-Key-3 and encrypting the key Key-2 into the key New-Key-4 using an encryption algorithm; and writing the key New-Key-3, the key New-Key-4, and the key Key-5 into the secure storage area of ​​the encryption device.

8. The method for full-disk data encryption and security authentication in high-security scenarios according to claim 1, characterized in that, When both the hardware chip of the encryption device and the computer fail, the computer full-disk data encryption and security authentication method for high-security scenarios further includes: first performing hardware chip initialization recovery, and then performing steps S2, S3, S4 and S5 in sequence. The steps for restoring hardware chip initialization include: reading the keys Key-1, Key-2, and Key-5 through the management software of the trusted management host; connecting the new encryption device to the trusted management host, reading the hardware chip ID of the new encryption device, and using the hardware chip ID of the new encryption device as encryption parameter New-P3; recording the motherboard ID of the new computer into the trusted management host, and using the motherboard ID of the new computer as encryption parameter New-P2; using the encryption parameters New-P2 and New-P3 as common encryption parameters, encrypting the key Key-1 into key New-Key-3 and encrypting the key Key-2 into key New-Key-4 using an encryption algorithm; and writing the keys New-Key-3, New-Key-4, and Key-5 into the secure storage area of ​​the new encryption device.

9. The method for full-disk data encryption and security authentication in high-security scenarios according to any one of claims 1 to 8, characterized in that, The computer boot process includes: completing BIOS authentication and user authentication, until the operating system boot is completed.

Images