JP2021185472A - Disk encryption protection method and device, electronic device, computer readable storage medium and computer program - Google Patents

Abstract

To provide a disk encryption protection method and device, an electronic device, a computer readable storage medium and a computer program which can protect a disk by using a different encryption method, and increase security of an encryption disk, by determining different hardware.SOLUTION: A disk encryption protection method includes: encrypting a disk of a target device to generate a key corresponding to the disk and obtain an encryption disk; detecting whether or not a security chip is prepared in the target device; and determining an encryption method of the key and a storage slot of a key parameter based on a detection result. The encryption disk includes a plurality of storage slots. The key parameter which encrypts the disk is stored based on a fixed password, in a first storage slot.SELECTED DRAWING: Figure 2

Description

The embodiments of the present disclosure relate to the field of computer technology, specifically to artificial intelligence technology, to disk encryption protection methods and devices, electronic devices, computer readable storage media and computer programs.

To prevent sensitive data from being stolen offline, disk devices generally employ disk encryption technology and traditional Linux (Linux® Unified Key Setup, Linux® unified key setup) disk encryption. The encryption key is protected by a simple password or file. The password-protected method requires manual input and does not meet the requirements of autonomous driving systems. The method of file protection requires that the file be stored on an unencrypted disk, and security is not guaranteed.

The present disclosure provides disk encryption protection methods and devices, electronic devices, computer-readable storage media and computer programs.

According to the first aspect, the disk of the target device is encrypted, the key corresponding to the disk is generated, the encrypted disk is obtained, and whether or not the target device is provided with a security chip is detected and detected. Based on the result, the encryption method of the key and the storage slot of the key parameter corresponding to the key are determined, where the encrypted disk contains a plurality of storage slots and the first storage slot is a fixed password. Provides disk encryption protection methods, including storing password key parameters that encrypt the disk based on it.

According to the second aspect, an encryption unit configured to encrypt the disk of the target device, generate a key corresponding to the disk, and obtain an encrypted disk, and whether or not the target device is provided with a security chip. Based on the detection and the detection result, the encryption method of the key and the storage slot of the key parameter corresponding to the key are determined, where the encrypted disk contains a plurality of storage slots and the first storage slot contains the storage slot. Provided is a disk encryption protection device comprising:, a definitive unit configured to store password key parameters that encrypt a disk based on a fixed password.

According to a third aspect, it includes at least one processor and a memory communicatively connected to at least one processor, wherein the memory stores instructions that can be executed by at least one processor and the instructions are at least. Provided is an electronic device that, by being executed by one processor, causes at least one processor to perform the method according to any one of the first aspects.

According to a fourth aspect, it is a non-temporary computer-readable storage medium in which computer instructions are stored, wherein the computer instructions are used to cause a computer to perform the method according to any one of the first aspects. Provide a non-temporary computer-readable storage medium.

According to a fifth aspect, a computer program, which, when executed by a processor, provides a computer program that causes the computer to perform the method according to any one of the first aspects.

According to the technique of the present invention, by determining the detection result of different target devices regarding the security chip, the disk is protected by using different encryption methods, the security of the encrypted disk is enhanced, and the first storage is also performed. The slot stores password key parameters that encrypt the disk based on a fixed password, and the fixed password encryption method can be adapted to the installation of a conventional Linux® system.

It should be understood that the content described herein is not intended to limit the key or important features of the embodiments of the present disclosure and is not intended to limit the scope of the present disclosure. Is. Other features of the present disclosure are readily understood by the following description.

The drawings are used to better understand the proposed invention and do not constitute a limitation to the present invention.
It is an exemplary system architecture diagram to which one embodiment of the present disclosure is applicable. It is a flowchart of one Example of the disk encryption protection method by this disclosure. It is a schematic diagram which shows one application scene of the disk encryption protection method by this disclosure. It is a flowchart of another embodiment of the disk encryption protection method by this disclosure. It is a schematic block diagram of the Example of the disk encryption protection device by this disclosure. It is a schematic block diagram of the computer system applied to realize the electronic device / terminal apparatus or server of the embodiment of this disclosure.

Hereinafter, exemplary embodiments of the invention are described in the context of the drawings and include various details of the embodiments of the invention to aid understanding, which should be merely exemplary. be. Accordingly, one of ordinary skill in the art should be aware that various modifications and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and simplicity, the following description omits description of known functions and structures.

FIG. 1 shows an exemplary system architecture 100 to which the disk encryption protection method and apparatus according to the present application can be applied.

As shown in FIG. 1, the system architecture 100 can include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used to provide the mediation of a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 can include various connection types such as, for example, wired, wireless communication links, or fiber optic cables.

The terminal devices 101, 102, 103 may be hardware devices or software that interact and process data by supporting network connectivity. When the terminal devices 101, 102, 103 are hardware, they may be various electronic devices that support functions such as information interaction, network connection, and information processing, such as smartphones, tablet computers, e-book readers, and laptops. Includes, but is not limited to, computers, desktop computers, in-vehicle computers, and the like. When the terminal devices 101, 102, and 103 are software, they can be attached to the above-mentioned electronic device. For example, it may be implemented as multiple software or software modules to provide distributed services, or it may be implemented as a single software or software module. There are no specific restrictions here.

The server 105 may be a server that provides various services, for example, a background processing server that performs disk encryption on the terminal devices 101, 102, and 103. The background processing server performs disk encryption on the terminal device and stores the key encryption method and the key parameter corresponding to the key based on the detection result of whether the target device has a security chip. Can be confirmed. As an example, the server 105 may be a cloud server.

The server may be hardware or software. When the server is hardware, it may be realized as a distributed server cluster consisting of a plurality of servers, or it may be realized as a single server. When the server is software, it may be implemented as multiple software or software modules (eg, software or software modules for providing distributed services), or as a single software or software module. There are no specific restrictions here.

The disk encryption protection method according to the embodiment of the present disclosure may be executed by the server, may be executed by the terminal device, or may be executed by the server and the terminal device in cooperation with each other. Correspondingly, each part (for example, each unit, subunit, module, submodule) included in the information processing device may be provided in the server or in the terminal device, respectively, and the server and the terminal device, respectively. It may be provided in.

It should be understood that the number of terminal devices, networks, and servers in FIG. 1 is merely exemplary. It can be equipped with any number of terminal devices, networks, and servers as needed. If the electronic device on which the disk encryption protection method is performed does not need to transfer data to another electronic device, the system architecture is such that the electronic device on which the disk encryption protection method is performed (eg, a server or terminal device). ) Only can be included.

Subsequently referring to FIG. 2, a flow 200 of an embodiment of the disk encryption protection method is shown, including the following steps.

In step 201, the disk of the target device is encrypted, a key corresponding to the disk is generated, and an encrypted disk is obtained.

In this embodiment, the execution subject of the disk encryption protection method (for example, the terminal device or the server in FIG. 1) can encrypt the disk of the target device, generate the key corresponding to the disk, and obtain the encrypted disk. ..

As an example, the executing entity can encrypt the disk of the target device based on the LUKS (Linux (registered trademark) Unified Key Set, Linux (registered trademark) unified key setting) technology, and the AES (Advanced Encryption Standard) can be encrypted. , Advanced encryption standard) Includes, but is not limited to, encryption algorithms, Cast encryption algorithms, and Serpent encryption algorithms. Linux Unified Key Setup is the standard for Linux® hard disk encryption. By providing a standard disk format, LUKS technology can not only facilitate compatibility between versions, but also provide security controls for passwords of multiple users.

The target device may be any terminal device provided with a magnetic disk, and by way of example, the target device may be the desktop computer, the in-vehicle computer, or the like in FIG.

The execution subject of this step may be a terminal device or a server. When the terminal device has a disk encryption function, the execution subject of this step may be a terminal device having a disk encryption function. When the server has a disk encryption function, the execution subject of this step may be a server having a disk encryption function.

In step 202, it is detected whether or not the target device is provided with a security chip, and based on the detection result, the key encryption method and the storage slot of the key parameter corresponding to the key are determined.

In this embodiment, the execution subject detects whether or not the target device is provided with a security chip, and determines the key encryption method and the storage slot of the key parameter corresponding to the key based on the detection result. Can be done.

Here, the encrypted disk includes a plurality of storage slots, and for example, the encrypted partition inside the encrypted disk obtained by encrypting based on the LUKS technology is composed of parts such as a volume header and an encrypted data area. The volume header can be provided with eight slots (key slots) by default, and each slot can store the key parameters of the key obtained based on a different encryption method. The key and its corresponding key parameters can consider the encrypted disk as the decryption key, and any key can be used to open the encrypted disk obtained by encryption based on the LUKS technology.

In this embodiment, the first storage slot stores a password key parameter that encrypts a disk based on a fixed password, and the fixed password encryption method is suitable for installation of a conventional Linux® system. can do. As an example, the conventional Linux® system may be an Ubuntu system. When installing the Ubuntu system, when encrypting the disk on which the Ubuntu system is installed, you manually enter a fixed password and the password key parameters are stored in the first storage slot by default.

In this embodiment, the key can be encrypted using any encryption method. Includes, but is not limited to, white box encryption, black box encryption, binding of keys to system state, and the like. The encryption method that binds the key to the system state is any part of the preset system such as BIOS (Basic Input Output System), GRUB (Grand Unified Bootloader), kernel or initialization mirroring. It is used to indicate that the key cannot be obtained if the state of the key changes, further guaranteeing the security of the key.

As an example, for a target device provided with a security chip, the execution subject can bind the key to the system state and store the key and the system state of the preset system in association with the security chip. Is stored in the second storage slot of the encrypted disk. For target devices without a security chip, the key employs white box protection, the password and ciphertext are stored in the LUKS header, and the key parameters are stored in the third storage slot of the encrypted disk.

Subsequently, with reference to FIG. 3, FIG. 3 is a schematic diagram showing an application scene of the disk encryption protection method according to the present embodiment. In the application scene of FIG. 3, the user tries to install the automatic driving system on the in-vehicle computer 302 of the home-use automobile 301. The in-vehicle computer 302 encrypts the disk 303 of the in-vehicle computer 302, generates a key corresponding to the disk 303, and obtains an encrypted disk. Next, the in-vehicle computer 302 detects whether or not the in-vehicle computer is provided with a security chip, and based on the detection result, determines the key encryption method and the storage slot of the key parameter corresponding to the key, and here. The encrypted disk includes a plurality of storage slots, and the first storage slot stores a password key parameter for encrypting the disk based on a fixed password.

In the method according to the above embodiment of the present disclosure, a different encryption method is used to protect the disk and enhance the security of the encrypted disk by determining whether or not the security chip is provided in different hardware. A password key parameter that encrypts the disk based on a fixed password is stored in the first storage slot, and the fixed password encryption method can be adapted to the installation of a conventional Linux (registered trademark) system. ..

Subsequently referring to FIG. 4, a schematic flow 400 of another embodiment of the disk encryption protection method according to the invention is shown, including the following steps.

In step 401, when installing the preset system on the target device, the disk of the target device is encrypted, the key corresponding to the disk is generated, and the encrypted disk is obtained.

In step 402, white box encryption is performed on the key, and the key parameter is stored in the second storage slot in response to the determination that the target device is provided with the security chip, and the target device is secured. The key parameters are stored in the third storage slot in response to the determination that the chip is not provided.

In step 403, when booting the preset system, the slot activated when decrypting the encrypted disk is detected.

In response to determining that the activated slot is the first storage slot in step 404, the decrypted disk is obtained by decrypting the encrypted disk with a fixed password and password key parameters.

In step 405, the encryption method and the first update of the first update key obtained by detecting whether or not the target device is provided with the security chip and re-encrypting the decryption disk based on the detection result. Determine the storage slot for the first update key parameter that corresponds to the key.

In this embodiment, the execution subject can execute the step 405 by the following specific method.

In step 4051, in response to the determination that the target device is provided with the security chip, the first update key and the system state of the preset system are stored in association with the security chip.

In step 4052, white box encryption is performed on the first update key in response to the determination that the target device is not provided with the security chip.

In step 4053, the fixed password is replaced with the first update key and the first update key parameter is stored in the third storage slot.

In step 406, in response to determining that the activated slot is the second storage slot, it is determined whether the key matches the key parameters in the second storage slot.

In step 407, a decrypted disc is obtained by decrypting the encrypted disc with the key and the key parameter in response to the key matching the key parameter in the second storage slot.

In step 408, the decrypted disk is encrypted, a second update key and a second update key parameter are generated, and the second update key and the system state of the preset system are stored in association with the security chip.

In step 409, the second update key parameter is stored in the third storage slot.

In step 410, before upgrading the preset system, the encrypted disk is decrypted, the slot activated at the time of decryption is detected, and it is determined whether the target device is provided with a security chip.

In step 411, in response to the determination that the activated slot is the third storage slot and the determination that the target device is equipped with a security chip, the second update key and the second A decrypted disk is obtained by decrypting the encrypted disk with the update key parameter of.

In step 412, the decrypted disk is encrypted and an upgrade key and an upgrade key parameter are generated.

In step 413, white box encryption is performed on the upgrade key, and the upgrade key parameter is stored in the second storage slot.

In addition to the contents described above, the embodiments of the present disclosure may include the same or similar features and effects as the embodiments corresponding to FIG. 2, and the description thereof will be omitted here.

As can be seen from FIG. 4, in comparison with the embodiment corresponding to FIG. 2, in the flow 400 of the disk encryption protection method in this embodiment, the flow of disk decryption in the process of installing, starting, and upgrading the preset system is described. Emphasized. It should be noted that while this example includes a complete installation, boot, and upgrade process for the preset system, examples of disk encryption protection methods may include separate installation, boot, or upgrade processes. Is. As described above, in the embodiment described in this embodiment, automatic disk decryption is realized, the degree of intelligentization is improved, and a security chip is provided on the target device in the process of installing, booting, and upgrading the preset system. If so, the key is bound to the system state, and if the system state changes, the key cannot be obtained, the security of the key is further guaranteed, and the key is migrated to the preset system boot and upgrade process. By doing this, whether or not the preset system upgrade was successful did not affect the disk decryption at the next system startup, and the degree of intelligentization was further improved.

Further, with reference to FIG. 5, as an embodiment of the method shown in each of the above figures, the present disclosure provides an embodiment of a disk encryption protection device, wherein the embodiment of the device implements the method shown in FIG. Corresponding to the examples, in addition to the features described below, the embodiments of the apparatus include the same or corresponding features as the method embodiments shown in FIG. 2 and the same or corresponding to the method embodiments shown in FIG. Can have an effect. The device can be specifically applied to various electronic devices.

As shown in FIG. 5, the disk encryption protection device 500 of this embodiment encrypts the disk of the target device, generates a key corresponding to the disk, and obtains an encrypted disk. And, it is configured to detect whether the target device has a security chip, and based on the detection result, determine the encryption method of the key and the storage slot of the key parameter corresponding to the key. The encryption disk includes a plurality of storage slots, and the first storage slot includes a confirmation unit 502 configured to store password key parameters that encrypt the disk based on a fixed password.

In some embodiments, the determination unit 502 further performs white box encryption on the key when installing the preset system on the target device, determining that the target device is equipped with a security chip. In response, the key parameters are configured to be stored in the second storage slot.

In some embodiments, the determination unit 502 is further configured to store key parameters in a third storage slot in response to determining that the target device is not provided with a security chip.

In some embodiments, the deterministic unit 502 further detects the activated slot when decrypting the encrypted disk when booting the preset system, and the activated slot is the first storage slot. By decrypting the encrypted disk with a fixed password and password key parameters in response to the determination, the decrypted disk is obtained, and it is detected whether the target device is equipped with a security chip. Based on the detection result, the encryption method of the first update key obtained by re-encrypting the decryption disk and the storage slot of the first update key parameter corresponding to the first update key are determined. Will be done.

In some embodiments, the confirmation unit 502 further associates the first update key with the system state of the preset system to the security chip in response to determining that the target device is equipped with a security chip. In response to remembering and determining that the target device does not have a security chip, whitebox encryption is performed on the first update key, the fixed password is replaced with the first update key, and the update key. The parameters are configured to be stored in the third storage slot.

In some embodiments, the determination unit 502 further determines whether the key matches the key parameters in the second storage slot in response to determining that the activated slot is the second storage slot. Decoding the disk is obtained by decrypting the encrypted disk with the key and key parameters in response to the key matching the key parameters in the second storage slot. Encrypt, generate a second update key and a second update key parameter, store the second update key and the system state of the preset system in association with the security chip, and store the second update key parameter in the third store. It is configured to be stored in the slot.

In some embodiments, the deterministic unit 502 further decrypts the encrypted disk, detects the slot activated at the time of decryption, and provides a security chip on the target device prior to upgrading the preset system. A second update in response to determining if it is, and determining that the activated slot is the third storage slot, and that the target device has a security chip. Obtain the decrypted disk by decrypting the encrypted disk with the key and the second update key parameter, encrypt the decrypted disk, generate the upgrade key and upgrade key parameters, and white box for the upgrade key. It is configured to perform encryption and store the upgrade key parameters in the second storage slot.

Hereinafter, according to an embodiment of the present invention with reference to FIG. 6, the present invention further provides an electronic device and a readable storage medium.

As shown in FIG. 6, it is a block diagram of the electronic device 600 by the disk encryption protection method of the embodiment of this invention. Electronic devices are intended to represent various forms of digital computers such as laptop computers, desktop computers, workbench, personal digital assistants, servers, blade servers, large computers, and other suitable computers. Electronic devices can also represent various forms of mobile devices such as personal digital processing, mobile phones, smartphones, wearable devices, and other similar computing devices. The parts, their connections and relationships, and their functions set forth herein are merely examples and are intended to limit the realization of the invention as described and / or required herein. It's not something to do.

As shown in FIG. 6, the electronic device includes at least one processor 601 and a memory 602, and an interface for connecting each component including a high-speed interface and a low-speed interface. The components may be connected to each other using different buses and mounted on a common motherboard, or may be mounted in other ways as needed. The processor was executed in an electronic device, including in-memory or in-memory instructions for displaying GUI graphical information on an external input / output device (eg, a display device coupled to an interface). The command can be processed. In other embodiments, a plurality of processors and / or a plurality of buses can be used with a plurality of memories and a plurality of memories, if necessary. Similarly, multiple electronic devices may be connected and each device provides partially required operation (eg, as a server array, a set of blade servers, or a multiprocessor system). In FIG. 6, one processor 601 is taken as an example.

The memory 602 is a non-temporary computer-readable storage medium according to the present invention. Here, the memory causes at least one processor to execute the disk encryption protection method according to the present invention by storing a command that can be executed by at least one processor. The non-temporary computer-readable storage medium of the present invention stores computer instructions, which are used to force a computer to perform the disk encryption protection method according to the present invention.

The memory 602, as a non-temporary computer-readable storage medium, is a program command / module (for example, the encryption unit 501 and the confirmation unit 502 shown in FIG. 5) corresponding to the disk encryption protection method in the embodiment of the present invention. It can be used to store non-temporary software programs, non-temporary computer executable programs, and modules, such as. Processor 601 performs various functional applications and data processing of the server by executing non-temporary software programs, instructions and modules stored in memory 602, i.e., disk encryption in the embodiment of the method described above. The protection method is realized.

The memory 602 can include a program storage area and a data storage area, where the program storage area can store the operating system, an application program required for at least one function, and the data storage area is a disk. It is possible to store data created by using an electronic device according to the encryption protection method. The memory 602 can also include high speed random access memory and can also include non-temporary memory such as, for example, at least one magnetic disk storage device, flash memory device, or other non-temporary solid-state storage device. In some embodiments, as one of the options, the memory 602 may include memory remotely located with respect to the processor 601 and these remote memories may be a disk encryption protection method over the network. Can be connected to electronic devices. Examples of networks above include, but are not limited to, the Internet, corporate networks, local area networks, mobile communication networks and combinations thereof.

The electronic device of the disk encryption protection method can further include an input device 603 and an output device 604. The processor 601 and the memory 602, the input device 603 and the output device 604 can be connected by a bus or other methods, and in FIG. 6, the connection by a bus is taken as an example.

The input device 603 can receive the entered number or letter message and generate a key signal input for user settings and functional control of the disk encrypted protected electronic device, eg, a touch screen, a keypad, a mouse, etc. Input devices such as trackboards, touchpads, indicator bars, one or more mouse buttons, trackballs, joysticks, etc. The output device 604 can include a display device, an auxiliary lighting device (eg, LED), a tactile feedback device (eg, a vibration motor), and the like. The display device can include, but is not limited to, a liquid crystal display (LCD), a light emitting diode (LED) display, and a plasma display. In some embodiments, the display device may be a touch screen.

Various embodiments of the systems and techniques described herein are realized in digital electronic circuit systems, integrated circuit systems, dedicated ASICs (dedicated integrated circuits), computer hardware, firmware, software, and / or combinations thereof. be able to. These various embodiments may include the following content, i.e., implemented in one or more computer programs, the one or more computer programs running on a programmable system including at least one programmable processor. And / or can be interpreted, the programmable processor may be a dedicated or general purpose programmable processor, receiving data and commands from a storage system, at least one input device, and at least one output device, and. Data and commands can be transmitted to the storage system, the at least one input device, and the at least one output device.

These computational programs (also called programs, software, software applications, or codes) include machine instructions for programmable processors and utilize programming languages for advanced processes and / or objects, and / or assembly / machine languages. And these calculators can be executed. As used herein, the terms "machine readable medium" and "computer readable medium" are any computer program product, device, and / or device for providing machine instructions and / or data to a programmable processor. (For example, a magnetic disk, an optical disk, a memory, a programmable logic device (PLD)), and includes a machine-readable medium that receives a machine command which is a machine-readable signal. The term "machine readable signal" refers to any signal for providing machine commands and / or data to a programmable processor.

In order to provide interaction with the user, the systems and techniques described herein can be implemented on a computer, which is a display device for displaying information to the user (eg, a CRT). Alternatively, it comprises an LCD (Liquid Crystal Display) monitor), a keyboard and a pointing device (eg, a mouse or trackball), and the user can provide input to the computer via the keyboard and the pointing device. Other types of devices can also be used to provide interactivity with the user. For example, the feedback provided to the user may be any form of sensing feedback (eg, visual feedback, auditory feedback, or tactile feedback), including any form (voice input, voice input, or tactile input). ) May receive input from the user.

The systems and techniques described herein can be a computing system that includes background components (eg, a data server), or a computing system that includes middleware components (eg, an application server), or a computing system that includes front-end components (eg,). A user computer having a graphical user interface or network browser may be mentioned, and the user may interact with embodiments of the systems and techniques described herein via the graphical user interface or network browser), or as such. It can be implemented on a computing system that includes any combination of background, middleware, or front-end components. The components of the system may be interconnected by any form or media digital data communication (eg, a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

A computer system can include a client and a server. Clients and servers are generally separated from each other and usually interact over a communication network. The client-server relationship is generated by a computer program that runs on the corresponding computer and has a client-server relationship with each other.

According to the proposed technology of the present invention, by determining different hardware, a different encryption method is used to protect the disk, increase the security of the encrypted disk, and fix it in the first storage slot. A parameter key that encrypts the disk based on the password is stored, and the fixed password encryption method can be adapted to the installation of a conventional Linux® system.

It should be understood that steps can be sorted, added, or deleted using the various forms of flow shown above. For example, each step described in the present invention may be performed in parallel, sequentially, or in a different order, as desired result of the proposed technique disclosed in the present invention. As long as is achieved, no limitation is made herein.

The specific embodiment does not constitute a limitation on the scope of protection of the present invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and alternatives can be made, depending on design requirements and other factors. Any modifications, equal substitutions, improvements, etc. made within the spirit and principles of the invention should be included in the scope of protection of the invention.

Claims (17)

To encrypt the disk of the target device, obtain the encrypted disk, and generate the key corresponding to the encrypted disk.
Detecting whether the target device has a security chip and
Based on the detection result, the encryption method of the key and the storage slot of the key parameter corresponding to the key are determined. The encrypted disk includes a plurality of storage slots, and the first storage slot contains the first storage slot. , The password key parameter that encrypts the disk based on the fixed password is stored, and
including,
A disk encryption protection method characterized by that. It is possible to detect whether or not a security chip is provided in the target device, and to determine the encryption method of the key and the storage slot of the key parameter corresponding to the key based on the detection result.
When installing the preset system on the target device, white box encryption is performed on the key, and
In response to the determination that the target device is provided with the security chip, the key parameters are stored in the second storage slot, and
including,
The method according to claim 1. It is possible to detect whether or not a security chip is provided in the target device, and to determine the encryption method of the key and the storage slot of the key parameter corresponding to the key based on the detection result.
Further comprising storing the key parameters in a third storage slot in response to determining that the target device is not provided with a security chip.
The method according to claim 2. It is possible to detect whether or not the target device is provided with a security chip, and to determine the encryption method of the key and the storage slot of the key parameter corresponding to the key based on the detection result.
When activating the preset system, detecting the slot activated when decrypting the encrypted disk and
Obtaining a decrypted disk by decrypting the encrypted disk with the fixed password and the password key parameter in response to determining that the activated slot is the first storage slot. ,
The encryption method of the first update key obtained by detecting whether or not the target device is provided with the security chip and re-encrypting the decryption disk based on the detection result and the first update key. To determine the storage slot for the first update key parameter that corresponds to
Including,
The method according to claim 3. The encryption method of the first update key and the first update obtained by detecting whether or not the target device is provided with the security chip and re-encrypting the decryption disk based on the detection result. Determining the storage slot for the first update key parameter that corresponds to the key is
In response to the determination that the target device is provided with the security chip, the first update key and the system state of the preset system are stored in association with the security chip.
In response to the determination that the target device does not have a security chip, white box encryption is performed on the first update key, and
Replacing the fixed password with the first update key and storing the first update key parameter in the third storage slot.
including,
The method according to claim 4. It is possible to detect whether or not the target device is provided with a security chip, and to determine the encryption method of the key and the storage slot of the key parameter corresponding to the key based on the detection result.
In response to determining that the activated slot is the second storage slot, determining whether the key matches the key parameters in the second storage slot.
Obtaining a decrypted disk by decrypting the encrypted disk with the key and the key parameter in response to the key matching the key parameter in the second storage slot.
The decryption disk is encrypted, the second update key and the second update key parameter are generated, and the system state of the second update key and the preset system is stored in association with the security chip.
To store the second update key parameter in the third storage slot,
Including,
The method according to claim 4. It is possible to detect whether or not the target device is provided with a security chip, and to determine the encryption method of the key and the storage slot of the key parameter corresponding to the key based on the detection result.
Before upgrading the preset system, decrypt the encrypted disk, detect the slot activated at the time of decryption, and determine if the target device has a security chip.
The second update key and the second update key in response to the determination that the activated slot is the third storage slot and that the target device is provided with a security chip. By decrypting the encrypted disk with the update key parameter, the decrypted disk can be obtained.
Encrypting the decrypted disk and generating the upgrade key and upgrade key parameters,
White box encryption is performed on the upgrade key, and the upgrade key parameter is stored in the second storage slot.
Including,
The method according to any one of claims 1 to 6. An encryption unit configured to encrypt the disk of the target device, generate a key corresponding to the disk, and obtain an encrypted disk.
A confirmation unit configured to detect whether or not a security chip is provided in the target device and to determine the encryption method of the key and the storage slot of the key parameter corresponding to the key based on the detection result. The encrypted disk includes a plurality of storage slots, and the first storage slot has a definite unit configured to store key parameters for encrypting the disk based on a fixed password.
including,
A disk encryption protection device characterized by that. The confirmed unit further
When installing the preset system on the target device, white box encryption is performed on the key, and in response to the determination that the target device is provided with the security chip, the key parameter is set to the second. The device according to claim 8, which is configured to store in a storage slot. The confirmed unit further
In response to determining that the target device is not provided with a security chip, the key parameters are configured to be stored in a third storage slot.
The device according to claim 9. The confirmed unit further
When the preset system is activated, the activated slot is detected when the encrypted disk is decrypted, and the activated slot is determined to be the first storage slot. By decrypting the encrypted disk with a fixed password and the password key parameter, the decrypted disk is obtained, whether or not the target device is provided with a security chip is detected, and based on the detection result, the above-mentioned 10. Claim 10 configured to determine the encryption method of the first update key obtained by re-encrypting the decryption disk and the storage slot of the first update key parameter corresponding to the first update key. The device described in. The confirmed unit further
In response to the determination that the target device is provided with the security chip, the first update key and the system state of the preset system are stored in association with the security chip, and the security chip is stored in the target device. In response to the determination that it is not provided, white box encryption is performed on the first update key, the fixed password is replaced with the first update key, and the update key parameter is changed to the third update key. 11. The device of claim 11, configured to store in a storage slot. The confirmed unit further
In response to determining that the activated slot is the second storage slot, it is determined whether the key matches the key parameters in the second storage slot, and the key is the second storage slot. By decrypting the encrypted disk with the key and the key parameters in response to matching the key parameters in the storage slot, a decrypted disk is obtained, the decrypted disk is encrypted, and a second update is performed. A key and a second update key parameter are generated, the second update key and the system state of the preset system are stored in association with the security chip, and the second update key parameter is stored in the third storage slot. 11. The apparatus of claim 11. The confirmed unit further
Prior to upgrading the preset system, the encrypted disk was decrypted, the slot activated at the time of decryption was detected, and whether the target device had a security chip was determined and activated. By the second update key and the second update key parameter in response to the determination that the slot is the third storage slot and that the target device is provided with a security chip. By decrypting the encrypted disk, a decrypted disk is obtained, the decrypted disk is encrypted, an upgrade key and an upgrade key parameter are generated, and white box encryption is performed on the upgrade key. The device according to any one of claims 8 to 13, configured to store upgrade key parameters in a second storage slot. With at least one processor
A memory communicatively connected to the at least one processor, including
The method according to any one of claims 1 to 6, wherein a command that can be executed by the at least one processor is stored in the memory, and when the command is executed by the at least one processor, the method according to any one of claims 1 to 6 is performed. Let one processor do it,
An electronic device characterized by that. A non-temporary computer-readable storage medium in which computer instructions are stored.
The computer command is used to cause the computer to perform the method according to any one of claims 1 to 6.
A non-temporary computer-readable storage medium characterized by that. It ’s a computer program,
When the computer program is executed by the processor, the method according to any one of claims 1 to 6 is executed.
Computer program.

Images