TW202036349A - Computer system and method for virtual hard disk encryption and decryption - Google Patents

Abstract

A computer system and a method for virtual hard disk (VHD) encryption and decryption are proposed. The method is applicable to a computer system having a storage device and a process and includes the following steps. When a VHD file corresponding to a VHD is stored in the storage device, encryption is performed on the VHD file by the storage device to generate a first encrypted VHD file. Encryption is performed on the first encrypted VHD file by the processor to generate a second encrypted VHD file. When the processor receives a password, whether the password is associated with a mount command to mount the second encrypted VHD file is determined. If yes, decryption is performed on the second encrypted VHD file by the processor to decrypt and restore the second encrypted VHD file to the first encrypted VHD file. Decryption is performed on the first encrypted VHD file to decrypt and restore the first encrypted VHD file to the VHD file.

Description

Computer system and its virtual hard disk encryption and decryption method

The invention relates to an encryption and decryption technology of a virtual hard disk.

Microsoft's virtual hard disk (VHD) provides many convenient applications. It allows users to mount virtual operating systems to avoid conflicts with existing systems, and allows users to log out directly when they are not needed. Let the virtual hard disk return to the virtual hard disk file (VHD file). In addition, Microsoft provides a BitLocker (Advanced Encryption Standard, AES) encryption, so you must enter the key to mount the virtual hard drive, and the user's more private data can be fully protected. In addition, when the user exits directly without the virtual hard disk, the virtual hard disk will be directly restored to the locked state. Therefore, it is more convenient to use than the eDrive encryption for the entire physical hard disk also proposed by Microsoft.

However, the existing virtual hard disks are encrypted using pure software AES, so the virtual hard disk files can be copied to various operating systems. If it is copied inadvertently by a pirate, it only takes a moment to crack the password, and there is a risk of leakage of important information, which will lead to the theft of important information such as credit cards and banks.

The invention provides a computer system and a method for encrypting and decrypting a virtual hard disk, which can improve the security of the virtual hard disk.

In an embodiment of the present invention, the above method is applicable to a computer system having a storage device and a processor, and includes the following steps. When the virtual hard disk file corresponding to the virtual hard disk is stored in the storage device, the storage device encrypts the virtual hard disk file to generate a first encrypted virtual hard disk file, wherein the storage device is a self-encrypting hard disk. The processor encrypts the first encrypted virtual hard disk file to generate a second encrypted virtual hard disk file. When the processor receives the password, the processor determines whether the password is associated with a mounting instruction for mounting the second encrypted virtual hard disk file. If yes, the processor decrypts the second encrypted virtual hard disk file to decrypt and restore the second encrypted virtual hard disk file to the first encrypted virtual hard disk file. The storage device decrypts the first encrypted virtual hard disk file to decrypt and restore the first encrypted virtual hard disk file to a virtual hard disk file.

In an embodiment of the present invention, the aforementioned computer system includes a storage device and a processor, wherein the storage device is a self-encrypting hard disk, and the processor is coupled to the storage device. When the virtual hard disk file corresponding to the virtual hard disk is stored in the storage device, the storage device is used to encrypt the virtual hard disk file to generate a first encrypted virtual hard disk file, wherein the storage device is a self-encrypting hard disk. The processor is used for encrypting the first encrypted virtual hard disk file to generate a second encrypted virtual hard disk file. When the processor receives the password, the processor is used to determine whether the password is associated with a mounting instruction for mounting the second encrypted virtual hard disk file. If yes, the processor is used to decrypt the second encrypted virtual hard disk file to decrypt and restore the second encrypted virtual hard disk file to the first encrypted virtual hard disk file. The storage device is used for decrypting the first encrypted virtual hard disk file to decrypt and restore the first encrypted virtual hard disk file to a virtual hard disk file.

In order to make the above-mentioned features and advantages of the present invention more comprehensible, the following specific embodiments are described in detail in conjunction with the accompanying drawings.

The traditional eDrive technology is to encrypt the entire hard drive, that is, when the computer system is turned on, the entire hard drive is already unlocked, and the pirate can directly copy unprotected data in the unlocked state. On the other hand, traditional BitLocker uses AES encryption through software, so it consumes processor resources when accessing, and there is no way to limit the location where files are accessed. The concept of the present invention is mainly to import an encryption mechanism of a self-encrypting drive (SED) to encrypt files. Since different hard drives generate different keys, it means that this file can only be accessed on this hard drive. Even if the pirate copies the file elsewhere and cracks the password of the bit lock, the pirate can only see the garbled data without the key of the hard disk, thus avoiding the risk of file data being cracked.

Part of the embodiments of the present invention will be described in detail in conjunction with the accompanying drawings. The reference symbols in the following description will be regarded as the same or similar elements when the same symbol appears in different drawings. These embodiments are only a part of the present invention, and do not disclose all the possible implementation modes of the present invention. More precisely, these embodiments are just examples of methods and computer systems within the scope of the patent application of the present invention.

FIG. 1 is a block diagram of a computer system according to an embodiment of the invention. First, Figure 1 first introduces all the components and configuration relationships of the system, and detailed functions will be disclosed in conjunction with Figure 2.

Please refer to FIG. 1, the computer system 100 includes a storage device 110 and a processor 120. The processor 120 is electrically connected or coupled to the storage device 110. In this embodiment, the computer system 100 may be a personal computer, a notebook computer, a server computer, a tablet computer, a smart phone, or a workstation.

The storage device 110 may be a hard disk built in the computer system 100 and electrically connected or coupled to the processor 110, or externally connected to the computer system and electrically connected to the processor 110 through external means such as a transmission line and a bus Hard drive. In this embodiment, the storage device 110 is a self-encrypting hard disk, which may be a solid state drive (SSD) established by the Opal security management standard, for example, but the invention is not limited here.

The processor 120 is used to control the actions between the components of the computer system 100, and it can be, for example, a central processing unit (CPU) or other programmable general-purpose or special-purpose microprocessors, Digital signal processor (DSP), programmable controller, application specific integrated circuits (ASIC), programmable logic device (PLD) or other similar devices, product Body circuit and its combination.

In addition, those skilled in the art should understand that the computer system 100 further includes a memory (not shown) separable from the storage device 110, and the memory is used to store the program code used by the processor 120 to execute the access method and Related information, which can be, for example, any type of fixed or removable random access memory (RAM), read-only memory (ROM), flash memory (flash memory) Or other similar devices, integrated circuits and combinations thereof.

2 is a flowchart of a method for encrypting and decrypting a virtual hard disk of a computer system according to an embodiment of the invention. The method of this embodiment is applicable to the computer system 100 in FIG. 1, and the detailed steps are described below in conjunction with each component in the computer system 100.

Please refer to Figure 1 and Figure 2 at the same time. First, when the virtual hard disk file corresponding to the virtual hard disk is stored in the storage device 110, the storage device 110 encrypts the virtual hard disk file to generate the first encrypted virtual hard disk file (Step S201). The processor 120 encrypts the first encrypted virtual hard disk file to generate a second encrypted virtual hard disk file (step S202). In this embodiment, when the processor 120 receives an encryption instruction that the user wants to encrypt the virtual hard disk file, the storage device 110 uses the hardware hash of the storage device 110 to use the Opal specification The self-encryption mechanism encrypts the virtual hard disk file to generate the first encrypted virtual file, and the processor 120 further encrypts the first encrypted virtual file with BitLocker to generate the second encrypted virtual file, and then provides software and Double safety protection of the hardware. The encryption method here can be AES encryption, but the present invention is not limited to this.

When the processor 120 receives the password, the processor 120 itself will determine whether the password is associated with a mounting instruction for mounting the second encrypted virtual file (step S204). When the processor 120 determines that the password is associated with the mount command for mounting the second encrypted virtual file, the processor 120 will decrypt the second encrypted virtual hard disk file to decrypt the second encrypted virtual hard disk file and restore it to the first encrypted virtual hard disk file. An encrypted virtual hard disk file (step S205). The storage device 110 decrypts the first encrypted virtual hard disk file to decrypt and restore the first encrypted virtual hard disk file to a virtual hard disk file (step S206). In this embodiment, the processor 120 will use the BitLocker key to decrypt the second encrypted virtual hard disk file to decrypt it back to the first encrypted virtual hard disk file, and the storage device 110 will use its own dedicated hardware The hash key is used to decrypt the first encrypted virtual hard disk file to decrypt it back to the virtual hard disk file. After that, the processor 120 can access the mounted virtual hard disk to obtain decrypted data.

In this embodiment, since the storage device 110 only performs Opal-standard encryption for the virtual hard disk, under the normal system operation of the computer system 100, the virtual hard disk file is not decrypted, so the virtual hard disk file can also be copied It remains undecrypted, further reducing the risk of being cracked. If the pirate directly copies the virtual hard disk file to a device other than the storage device 110, the virtual hard disk file cannot be decrypted by the hardware hash key dedicated to the storage device 110 itself.

For convenience and clarity, FIG. 3 is a functional flowchart of a method for decrypting a virtual hard disk of a computer system according to an embodiment of the present invention. In this embodiment, the storage device 110 will serve as the SED 340, and the processor 120 will serve as the CPU 310.

Referring to FIG. 3, in this embodiment, the CPU 310 will issue a system command to decrypt the virtual hard disk file 325 with a BitLocker key, and the virtual hard disk file 325 will send a vendor-specific command. To SED 340, and SED 340 will respond to the manufacturer's instruction with the hardware hash key to the virtual hard disk file 325 for decryption. In this way, there is no need to rely on the native file system 320 of the operating system, and there is no need to decrypt the virtual hard disk file 325 and place it in the DRAM 330 first, which causes additional worries. The user can directly execute the internal data of the mounted virtual hard disk file 325 through the operating system.

From another point of view, FIG. 4 is a schematic diagram illustrating a comparison between a method for decrypting a virtual hard disk according to an embodiment of the present invention and the prior art.

Referring to FIG. 4, in this embodiment, after the user mounts the virtual hard disk, the operating system can access the internal data of the virtual hard disk through the App 410 through the VHD file system 420 with the hardware hash key. In this way, the VHD file system 420 will no longer conflict with the file system of the native operating system. On the other hand, if the App 410 itself is used to construct a third-party file system to read encrypted files to achieve the transfer of the hardware hash key, the file can only be copied to the OS file system 440 and cannot be directly executed, because various executable programs are still Depends on the OS file system 440. However, the protection effect of this approach is not good, because it is equivalent to decrypting the encrypted file before copying to the unencrypted area. Even if the file is deleted immediately after the operation is completed, the OS file system 440 will not immediately overwrite the data, which causes Additional worries.

Incidentally, when the storage device 110 is an SSD, the virtual hard disk can be used with SSD firmware to achieve data enhancement. The current SSD is mainly a multi-level cell structure such as TLC/QLC (ie, the same potential cuts 8 levels, 16 levels), and its data retention capability is far inferior to the earlier SLC structure (same potential) Cut 2 levels). However, if the SSD uses the SLC structure to store data, the space used by the virtual hard disk file will be 3 times or 4 times the actual space, and these data can no longer be organized into a TLC/QLC structure, so the SSD firmware can Treat it separately. Assuming that the virtual hard disk is used to store important data, and if such important data does not occupy too much space, a trade-off can be achieved by trading space for data accuracy. Therefore, if the processor 120 detects that the SSD has TLC/QLC storage capabilities, the processor 120 can first perform corresponding processing on the internal data of the virtual hard disk, because the internal data of the virtual hard disk will be based on its data volume 3 times and 4 times the space for storage (that is, when storing 2MB files, the actual space occupied by the SSD will be TLC 6MB, QLC 8MB), and the file system will declare, for example, 3 times, 4 times the storage space for internal data.

In summary, the computer system and its virtual hard disk encryption and decryption method provided by the present invention uses a processor and a storage device to perform two-stage encryption on the virtual hard disk file corresponding to the virtual hard disk. The device and storage device perform two-stage decryption on the encrypted virtual hard disk file, and use a dual information protection mechanism to enhance the security of the virtual hard disk.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention. Anyone with ordinary knowledge in the technical field can make some changes and modifications without departing from the spirit and scope of the present invention. The scope of protection of the present invention shall be determined by the scope of the attached patent application.

100: computer system 110: storage device 120: processor S201～S206: steps 310: CPU 320: file system 325: Virtual Hard Disk File 330: DRAM 340: SED 410: App 420: VHD file system 430: Third-party file system 440: OS file system

FIG. 1 is a block diagram of a computer system according to an embodiment of the invention. 2 is a flowchart of a method for encrypting and decrypting a virtual hard disk of a computer system according to an embodiment of the invention. 3 is a functional flowchart of a method for encrypting and decrypting a virtual hard disk of a computer system according to an embodiment of the invention. FIG. 4 is a schematic diagram of comparison between the encryption and decryption methods of virtual hard disks according to an embodiment of the present invention and the prior art.

S201~S206: steps

Claims (10)

A method for encrypting and decrypting a virtual hard disk, suitable for a computer system with a storage device and a processor, includes: When the virtual hard disk file corresponding to the virtual hard disk is stored in the storage device, the storage device encrypts the virtual hard disk file to generate a first encrypted virtual hard disk file, wherein the storage device is a self-encrypting hard disk dish; The processor encrypts the first encrypted virtual hard disk file to generate a second encrypted virtual hard disk file; When the processor receives the password, the processor determines whether the password is associated with a mount command for mounting the second encrypted virtual hard disk file; When the processor determines that the password is associated with the mount instruction, the processor decrypts the second encrypted virtual hard disk file to decrypt and restore the second encrypted virtual hard disk file to the first encrypted virtual hard disk Disc file; and The storage device decrypts the first encrypted virtual hard disk file to decrypt and restore the first encrypted virtual hard disk file to the virtual hard disk file. For the method described in claim 1, wherein the step of encrypting the virtual hard disk file by the storage device to generate the first encrypted virtual hard disk file includes: The storage device uses the hardware hash associated with the storage device to encrypt the virtual hard disk file using the self-encryption mechanism specified by Opal to generate the first encrypted virtual hard disk file. For the method described in item 2 of the scope of patent application, the step of decrypting the first encrypted virtual hard disk file to decrypt and restore the first encrypted virtual hard disk file to the virtual hard disk file includes: The storage device uses the hardware hash key of the storage device to decrypt the first encrypted virtual hard disk file to decrypt and restore the first encrypted virtual hard disk file to the virtual hard disk file. According to the method described in item 1 of the scope of patent application, the step of encrypting the first encrypted virtual hard disk file by the processor to generate the second encrypted virtual hard disk file includes: The processor encrypts the first encrypted virtual hard disk file with BitLocker to generate the second encrypted virtual hard disk file. The method described in item 4 of the scope of patent application, wherein the processor decrypts the second encrypted virtual hard disk file to decrypt and restore the second encrypted virtual hard disk file to the first encrypted virtual hard disk file The steps include: The processor uses the BitLocker key to decrypt the second encrypted virtual hard disk file to decrypt and restore the second encrypted virtual hard disk file to the first encrypted virtual hard disk file. The method described in item 1 of the scope of patent application further includes: The processor sets the storage space in the storage device for storing the virtual hard disk file, wherein the storage space is larger than the data volume of the file data stored in the virtual hard disk. The method described in item 1 of the scope of patent application further includes: The processor uses the file system of the virtual hard disk to access data through an application. A computer system including: A storage device, where the storage device is a self-encrypting hard disk; and The processor is coupled to the storage device, wherein: When the virtual hard disk file corresponding to the virtual hard disk is stored in the storage device, the storage device is used to encrypt the virtual hard disk file to generate a first encrypted virtual hard disk file, wherein the storage device is self-encrypting Hard drive The processor is used for encrypting the first encrypted virtual hard disk file to generate a second encrypted virtual hard disk file; When the processor receives the password, the processor is used to determine whether the password is associated with a mount command for mounting the second encrypted virtual hard disk file; When the processor determines that the password is associated with the mount command, the processor is used to decrypt the second encrypted virtual hard disk file to decrypt and restore the second encrypted virtual hard disk file to the first encrypted virtual hard disk Disc file; and The storage device is used for decrypting the first encrypted virtual hard disk file to decrypt and restore the first encrypted virtual hard disk file to the virtual hard disk file. For example, the computer system described in item 8 of the scope of patent application, wherein the storage device uses a hardware hash associated with the storage device to encrypt the virtual hard disk file using the self-encryption mechanism specified by Opal to generate the first encryption A virtual hard disk file, and the storage device uses the storage device's hardware hash key to decrypt the first encrypted virtual hard disk file to decrypt and restore the first encrypted virtual hard disk file to the virtual hard disk file . For example, the computer system described in item 8 of the scope of patent application, wherein the processor uses BitLocker to encrypt the first encrypted virtual hard disk file to generate the second encrypted virtual hard disk file, and the processor uses the BitLocker key Decrypt the second encrypted virtual hard disk file to decrypt and restore the second encrypted virtual hard disk file to the first encrypted virtual hard disk file.

Images