WO2017041603A1 - 数据加密方法、装置及移动终端、计算机存储介质 - Google Patents

数据加密方法、装置及移动终端、计算机存储介质 Download PDF

Info

Publication number
WO2017041603A1
WO2017041603A1 PCT/CN2016/093519 CN2016093519W WO2017041603A1 WO 2017041603 A1 WO2017041603 A1 WO 2017041603A1 CN 2016093519 W CN2016093519 W CN 2016093519W WO 2017041603 A1 WO2017041603 A1 WO 2017041603A1
Authority
WO
WIPO (PCT)
Prior art keywords
encrypted
ciphertext
key
disk
user
Prior art date
Application number
PCT/CN2016/093519
Other languages
English (en)
French (fr)
Inventor
王华山
孙奥
Original Assignee
深圳市中兴微电子技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市中兴微电子技术有限公司 filed Critical 深圳市中兴微电子技术有限公司
Publication of WO2017041603A1 publication Critical patent/WO2017041603A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G06F21/80—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in storage media based on magnetic or optical technology, e.g. disks with sectors

Definitions

  • the present invention relates to data encryption technologies, and in particular, to a high-level data encryption method and apparatus, and a mobile terminal and a computer storage medium.
  • the existing mobile terminal data encryption method can protect private data on the mobile terminal to a certain extent, but at the same time, there are certain vulnerabilities and shortcomings: for example, 1) the data disk key is still stored in the partition of the encrypted file, so it is easy Being decrypted, resulting in insufficient data security; 2) In the data encryption process, the encrypted data needs to be transferred to the memory and then read by the encryption engine for encryption, then encrypted and then written back to the memory, and finally the encrypted data is written to the storage device. The cumbersome efficiency is low, the speed is slow and the efficiency is low.
  • the existing data encryption method not only has insufficient security, but also has low encryption efficiency, which affects the user experience and increases system power consumption.
  • embodiments of the present invention are expected to provide a data encryption method, apparatus, and mobile terminal, which can improve the efficiency and security of data encryption.
  • An embodiment of the present invention provides a data encryption method, where the method includes:
  • the data entering the storage device is encrypted by the disk key.
  • the determining the encrypted ciphertext according to the encrypted information comprises: determining the encrypted ciphertext by using a hash (HASH) algorithm according to the encrypted information input by the user and the random salt value.
  • HASH hash
  • the generating the disk key comprises: deriving a disk key according to the HUK value.
  • the method further includes:
  • the method further includes:
  • the data of the storage device is decrypted by the disk key.
  • the determining, according to the decryption information, the decryption of the ciphertext comprises: determining, according to the decryption information input by the user and the random salt value, the HASH algorithm to determine the decrypted ciphertext.
  • the method further includes: using the same random salt value for the same encrypted information and the decrypted information, and different random salt values for different encrypted information and decrypted information.
  • the embodiment of the invention further provides a data encryption device, the device comprising: a secret key management module and an encryption engine module, wherein
  • the key management module is configured to receive the encrypted information input by the user, determine the encrypted ciphertext according to the encrypted information, generate a disk secret key, and encrypt the disk secret key according to the encrypted ciphertext;
  • the encryption engine module is configured to encrypt data entering the storage device by using the disk key.
  • the key management module is further configured to: according to the encrypted information input by the user. And the random salt value, through the HASH algorithm, to determine the encrypted ciphertext.
  • the key management module is further configured to: derive a disk key according to the HUK value.
  • the device further includes a secure storage module configured to store the encrypted ciphertext and the encrypted secret key.
  • the key management module is further configured to: receive decryption information input by the user, and determine decryption ciphertext according to the decryption information;
  • the encryption engine module is further configured to decrypt data of the storage device by using the disk key.
  • the key management module is further configured to: according to the decryption information input by the user and the random salt value, encrypt the HASH algorithm to determine the decrypted ciphertext.
  • the key management module is further configured to use the same random salt value for the same encryption information and decryption information, and different random salt values for different encryption information and decryption information.
  • the embodiment of the invention further provides a mobile terminal, wherein the mobile terminal comprises the above data encryption device.
  • the embodiment of the present invention further provides a computer storage medium.
  • the computer storage medium provided by the embodiment of the present invention stores a computer program, and the computer program is used to execute the data encryption method.
  • the encrypted information input by the user is received, the encrypted ciphertext is determined according to the encrypted information, the disk secret key is generated, and the disk secret key is encrypted according to the encrypted ciphertext;
  • the disk key encrypts the data entering the storage device.
  • the encrypted data is not repeatedly transferred between the memory and the storage device, and the data via the memory channel can be directly encrypted, which greatly simplifies the encryption process and steps, and improves the efficiency and reduces the system power consumption.
  • the disk key generation and encryption process is separated from the use process, thereby Improve the security of the entire terminal device data.
  • FIG. 1 is a schematic flowchart of a data encryption method according to an embodiment of the present invention.
  • FIG. 2 is a schematic flowchart of a data encryption method according to Embodiment 2 of the present invention.
  • FIG. 3 is a schematic flowchart of a third data encryption method according to an embodiment of the present invention.
  • FIG. 4 is a schematic flowchart of a data decryption method according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a data encryption apparatus according to an embodiment of the present invention.
  • the encrypted information input by the user is received first, and the encrypted ciphertext is determined according to the encrypted information; and then the disk secret key is encrypted according to the encrypted ciphertext; and then the disk key is used to enter
  • the data of the storage device is encrypted.
  • the data entering the storage device is data that enters the storage device between the storage device and the system bus.
  • the data encryption method in the embodiment of the present invention relates to a Trusted Execution Environment (TEE) and a Rich Execution Environment (REE, such as Android), wherein the encrypted ciphertext is determined and the disk key is generated.
  • TEE Trusted Execution Environment
  • REE Rich Execution Environment
  • the process of encrypting the disk key is performed in the TEE, and the process of encrypting the data entering the storage device is performed in the REE.
  • the key to encrypt the data comes from the TEE system, which is managed by TEE.
  • the TEE system can be constructed based on the TrustZone technology, and is parallel with the main OS on the device (such as REE in Android).
  • TEE and the main OS are two isolated environments. The two communicate through a well-defined fixed interface.
  • the REE environment and the applications running on it cannot access the resources that touch the TEE environment.
  • the letter's procedures ensure the security and reliability of the TEE environment while also preventing malware attacks.
  • the encrypted data does not need to be repeatedly transferred between the memory and the storage device, and the data via the memory channel can be directly encrypted, and the encryption process does not require the CPU to participate, which greatly simplifies the encryption process and steps.
  • the efficiency is reduced to reduce system power consumption.
  • the disk key is generated and stored in the security environment TEE, REE and third-party applications can not be touched, and the security is greatly improved, thereby improving the security of the entire terminal device data.
  • FIG. 1 is a schematic flowchart of a data encryption method according to an embodiment of the present invention. As shown in FIG. 1 , the data encryption method in this embodiment includes the following steps:
  • Step 101 Receive encrypted information input by a user, and determine an encrypted ciphertext according to the encrypted information.
  • the determining the encrypted ciphertext according to the encrypted information includes: determining, according to the encrypted information and the random salt value input by the user, the encrypted ciphertext by using a HASH algorithm; and storing the encrypted ciphertext;
  • the encrypted information input by the user is the password information input by the user.
  • the user first receives the encrypted information input by the user, that is, the password set by the user, and then receives the input from the user.
  • the random salt value is added to the encrypted information for confusion.
  • the length of the random salt value can be as long as the output data length of the HASH.
  • the same encrypted information is added to the same salt value, and different encrypted information is added to different salt values to ensure the use of non-fixed salt values.
  • the encrypted ciphertext is generated by the HASH algorithm (such as SHA, MD5, etc.), and the encrypted ciphertext is the HASH value.
  • the encrypted ciphertext is used to encrypt the disk secret key and verify the decryption information input by the user in the subsequent decryption process, and then store the encrypted ciphertext, and the encrypted information input by the user is not saved. In this way, even if the unlawful user obtains the HASH value in the system, the reverse cracking difficulty is extremely great.
  • Step 102 Generate a disk key, and encrypt the disk key according to the encrypted ciphertext
  • the generating a disk key includes: according to HUK (Hardware Unique) The Key) value derives a disk key; wherein the disk key is used to encrypt and decrypt data.
  • the HUK value is the trusted root of the hardware device, and is uniquely identified for each hardware device and is programmed into the non-volatile memory at the chip factory stage.
  • the method further includes: storing the encrypted ciphertext.
  • the disk key is derived according to the HUK value of the device itself, thereby ensuring the uniqueness of the disk key of each device, and encrypting and saving the disk key by using the ciphertext.
  • Step 103 Encrypt data entering the storage device by using the disk key.
  • the secret key generated in the TEE environment is obtained, and the data entering the storage device between the storage device and the system bus is directly encrypted and decrypted in real time, and the data is not required to be transferred to the memory. .
  • it can store the key information in the key register in the REE environment.
  • the method when the user needs to decrypt the encrypted data, the method further includes: receiving decryption information input by the user, determining, according to the decryption information, decrypting the ciphertext; determining whether the decrypted ciphertext is The stored encrypted ciphertext is the same.
  • the decryption fails, prompting the user to have a password error; when the decrypted ciphertext is the same as the stored encrypted ciphertext, the decryption is performed by the decryption
  • the ciphertext decrypts the disk key to obtain the disk key; and decrypts the data of the storage device by using the disk key.
  • the determining, according to the decryption information, the decryption of the ciphertext comprises: determining, by the HASH algorithm, the decryption ciphertext according to the decryption information input by the user and the random salt value.
  • the same encrypted information and the decrypted information use the same random salt value, and different encrypted information and decrypted information use different random salt values. This use of non-fixed salt values further increases the difficulty of brute force cracking.
  • the user when the user needs to decrypt the data, the user receives the decryption information input, that is, the password input by the user, and uses the corresponding salt value to receive the decrypted information input by the user. Confusion is performed, and the decrypted ciphertext is encrypted by using the same HASH algorithm as the encryption process, wherein the decrypted ciphertext is a HASH value, and then the decrypted ciphertext (HASH value) is determined to be encrypted with the encryption stored in the system.
  • the decryption information input that is, the password input by the user
  • Confusion is performed, and the decrypted ciphertext is encrypted by using the same HASH algorithm as the encryption process, wherein the decrypted ciphertext is a HASH value, and then the decrypted ciphertext (HASH value) is determined to be encrypted with the encryption stored in the system.
  • the decryption fails, prompting the user to have a password error; when the decrypted ciphertext is the same as the encrypted ciphertext stored in the system, After the verification is passed, the disk secret key is decrypted by decrypting the ciphertext to obtain the disk secret key, thereby verifying the user password.
  • the encrypted information input by the user is an encrypted password set by the user; in the process of decrypting the data, the decrypted information input by the user is a decrypted password input by the user.
  • the data encryption method in the second embodiment of the present invention is a process in which a user first enables a disk encryption function on a terminal, and the TEE environment includes a user password setting.
  • the key encryption method first requires the user to set the encryption information, and then encrypts the encrypted ciphertext according to the encrypted information input by the user and the random salt value, and uses the ciphertext to discriminate the disk secret derived from the HUK value of the device.
  • the key is encrypted, and the encrypted key is saved, and the encrypted ciphertext is saved.
  • the REE side acquires the disk key and encrypts the disk data according to the disk key.
  • the data encryption method in the second embodiment of the present invention includes the following steps:
  • Step 201 The user turns on the disk encryption function.
  • the user can enable the disk encryption function in the "Settings" option;
  • Step 202 Ask the user to set a password
  • the user can set a password by popping up a password box on the interface;
  • Step 203 Receive a password input by the user, add a random salt value to the user password, and perform a HASH operation to obtain a HASH value;
  • the HASH value is an encrypted ciphertext.
  • Step 204 Save the HASH value.
  • Step 205 Encrypt the disk key by using the HASH value.
  • Step 206 Save the encrypted key
  • Step 207 notify the REE environment to encrypt the data.
  • Step 208 Obtain a disk key from the TEE environment through a fixed interface, and encrypt data entering the storage device.
  • FIG. 3 is a schematic flowchart of a data encryption method according to Embodiment 3 of the present invention.
  • the data encryption method according to Embodiment 3 of the present invention is a process for writing real-time encryption of disk data. After the REE obtains the disk key, it will save it to the key register for subsequent data encryption and decryption.
  • the disk write data is encrypted in real time, and the disk data entering the storage device between the storage device and the system bus is directly encrypted, thereby reducing the process of data reciprocating the memory and improving the process.
  • the data encryption method according to the third embodiment of the present invention includes the following steps:
  • Step 301 The CPU writes the disk data.
  • Step 302 The REE obtains the disk key from the TEE through the fixed interface, and saves it to its own secret key register; the disk key is used for the subsequent encryption process;
  • Step 303 Encrypt the disk data to be written to the storage device between the storage device and the system bus by using the disk key.
  • Step 304 Send the encrypted data to the storage device for storage.
  • the data decryption method in the embodiment of the present invention is a process for real-time decryption of read disk data. After the REE obtains the disk key, it will save it to the key register for subsequent data encryption and decryption. During the normal use process, the disk read data is decrypted in real time, and the disk data of the storage device between the storage device and the system bus is directly decrypted, thereby reducing the process of data reciprocating the memory. The decryption speed and efficiency are improved.
  • the data decryption method in the fourth embodiment of the present invention includes the following steps:
  • Step 401 The CPU performs a read operation on the disk data.
  • Step 402 The REE obtains the disk key from the TEE through the fixed interface, and saves it to its own secret key register; the disk key is used for the subsequent decryption process;
  • Step 403 Decrypt the disk data between the storage device and the system bus and the storage device to be read by the disk key.
  • Step 404 Send the decrypted data to the CPU. System bus.
  • FIG. 5 is a schematic structural diagram of a data encryption device according to an embodiment of the present invention.
  • the device includes: a key management module 51 and an encryption engine module 52, where The device involves TEE and REE, the key management module 51 is located in the TEE, and the encryption engine module 52 is located in the REE.
  • the key management module 51 in the TEE has the functions of secret key derivation, secret key encryption and decryption, decryption information verification, etc.
  • the encryption engine module 52 in the REE adopts the In-Line architecture mode, that is, the existing intelligent mobile terminal hardware solution architecture.
  • the cryptographic engine module 52 is built in between the storage device and the system bus and is independently owned by the storage manager.
  • the encryption engine module 52 and the key management module 51 directly connect to the communication, from the key
  • the management module 51 obtains key information, and the encryption engine module 52 can store the key information in its own key register during normal operation.
  • the secret key used by the encryption engine module 52 is controlled by the TEE system, and the TEE provides key storage management and the like.
  • the key management module 51 is configured to receive the encrypted information input by the user, and determine the encrypted ciphertext according to the encrypted information;
  • the key management module 51 is further configured to: determine the encrypted ciphertext by using a HASH algorithm according to the encrypted information input by the user and the random salt value.
  • the apparatus also includes a secure storage module 53 configured to store the encrypted ciphertext and the encrypted secret key.
  • the security storage module 53 is located in the TEE environment and configured to save sensitive information such as a disk key and a HUK value.
  • the interface of the secure storage module 53 is directly
  • the connection key management module 51 can only be read by the key management module 51.
  • the HUK value is the trusted root of the hardware device, and is uniquely identified for each hardware device and is programmed into the non-volatile memory at the chip factory stage.
  • the encrypted information input by the user is the password information input by the user.
  • the key management module 51 first receives the encrypted information input by the user, that is, the password set by the user. Then, the random salt value is added to the encrypted information input by the user for confusion, and the length of the random salt value can be as long as the output data length of the HASH.
  • the key management module 51 adds the same salt value to the same encrypted information, and different encrypted information is added to different salt values to ensure the use of non-fixed salt values.
  • the encrypted ciphertext is generated by the HASH algorithm (such as SHA, MD5, etc.), and the encrypted ciphertext is the HASH value.
  • the encrypted ciphertext is used to encrypt the disk secret key and verify the decryption information input by the user in the subsequent decryption process, and then store the encrypted ciphertext, and the encrypted information input by the user is not saved. In this way, even if the unlawful user obtains the HASH value in the system, the reverse cracking difficulty is extremely great.
  • the key management module 51 is further configured to generate a disk key, and encrypt the disk key according to the encrypted ciphertext;
  • the key management module 51 is further configured to: derive a disk key according to the HUK value.
  • the disk key is used to encrypt and decrypt data.
  • the secure storage module 53 is further configured to store the encrypted ciphertext.
  • the key management module 51 derives a disk key according to the HUK value of the device itself, thereby ensuring the uniqueness of the disk key of each device, and using the ciphertext to perform the disk key. Encrypt and then save.
  • the encryption engine module 52 is configured to encrypt data entering the storage device by using the disk key.
  • the encryption engine module 52 acquires a key management module in a TEE environment.
  • the generated key of 51 directly encrypts and decrypts the data entering the storage device between the storage device and the system bus in real time, and does not need to carry the data to the memory. In the process of encrypting, it can store the key information in the key register in the REE environment.
  • the key management module 51 when the user needs to decrypt the encrypted data, is further configured to: receive decryption information input by the user, and determine decryption ciphertext according to the decryption information;
  • the decryption fails, prompting the user to have a password error;
  • the decrypted ciphertext is encrypted with the stored encryption
  • the decryption ciphertext is used to decrypt the disk secret key to obtain the disk key;
  • the key management module 51 is further configured to: according to the decryption information input by the user and the random salt value, encrypt the HASH algorithm to determine the decrypted ciphertext.
  • the secret key management module 51 uses the same random salt value for the same encrypted information and decryption information, and different encrypted salt values are used for different encrypted information and decrypted information.
  • the key management module 51 receives the decryption information input by the user, that is, the password input by the user, and uses the corresponding salt value to perform the decryption information input by the user. Confusing, simultaneously encrypting and decrypting the ciphertext using the same HASH algorithm as the encryption process, wherein the decrypted ciphertext is a HASH value, and then determining the decrypted ciphertext (HASH value) and the encrypted ciphertext saved in the system Whether the (HASH value) is the same, when the decrypted ciphertext is different from the stored encrypted ciphertext, the decryption fails, prompting the user to have a password error; when the decrypted ciphertext is the same as the encrypted ciphertext stored in the system, the verification is considered
  • the decryption of the disk key by the decrypted ciphertext obtains the disk key, thereby verifying the user password.
  • the encryption engine module 52 is further configured to: take out the storage device by using the disk key The data is decrypted.
  • the encrypted information input by the user is an encrypted password set by the user; in the process of decrypting the data, the decrypted information input by the user is a decrypted password input by the user.
  • the embodiment of the invention further provides a mobile terminal, wherein the mobile terminal comprises the data encryption device of FIG.
  • the secret key is stored in the trusted execution environment TEE and encrypted by the encrypted information input by the user, and the REE environment and its third-party application cannot be obtained, and the security is greatly improved.
  • the security of the entire terminal device data is improved; the encryption engine module adopts the In-Line architecture to be built between the storage device and the system bus, thereby reducing the data handling process, thereby greatly improving the encryption speed and efficiency, and reducing the system power consumption.
  • the disk key is inevitably different depending on the HUK value of each device, and it is extremely difficult to crack it even if the same encryption and decryption system and algorithm are used.
  • the security of existing data encryption is improved; on the other hand, the efficiency and speed of data encryption are greatly improved, the number of data handling is reduced, the power consumption is reduced, and the CPU is liberated; and the real-time data encryption service can be provided for the terminal device. It can meet the user's need for privacy protection of data and can prevent the risk of privacy being leaked even if the mobile phone is lost or stolen.
  • the implementation functions of the respective processing modules in the data encryption apparatus shown in FIG. 5 can be understood by referring to the related description of the foregoing data encryption method. It should be understood by those skilled in the art that the functions of the processing modules in the data encryption apparatus shown in FIG. 3 can be implemented by a program running on a processor, or can be implemented by a specific logic circuit, for example, by a central processing unit ( CPU, Central Processing Unit), Microprocessor Unit (MPU), Digital Signal Processor (DSP), or Field Programmable Gate Array (FPGA).
  • CPU Central Processing Unit
  • MPU Microprocessor Unit
  • DSP Digital Signal Processor
  • FPGA Field Programmable Gate Array
  • the device for tracking the service signaling may also be stored in a computer readable storage if it is implemented in the form of a software function module and is sold or used as a standalone product. In the medium. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium, including a plurality of instructions.
  • a computer device (which may be a personal computer, server, or network device, etc.) is caused to perform all or part of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read only memory (ROM), a magnetic disk, or an optical disk.
  • program codes such as a USB flash drive, a mobile hard disk, a read only memory (ROM), a magnetic disk, or an optical disk.
  • an embodiment of the present invention further provides a computer storage medium, wherein a computer program is stored, and the computer program is used to execute the data encryption method of the embodiment of the present invention.
  • the disclosed method and apparatus may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the modules is only a logical function division.
  • there may be another division manner for example, multiple modules or components may be combined, or Can be integrated into another system, or some features can be ignored or not executed.
  • the communication connections between the various components shown or discussed may be indirect coupling or communication connections through some interfaces, devices or modules, and may be electrical, mechanical or otherwise.
  • the modules described above as separate components may or may not be physically separated.
  • the components displayed as modules may or may not be physical modules, that is, may be located in one place or distributed to multiple network modules; Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional module in each embodiment of the present invention may be integrated into one processing module, or each module may be separately used as one module, or two or more modules may be integrated into one module;
  • the module can be implemented in the form of hardware or in the form of hardware plus software function modules.
  • the foregoing may be completed by a program instruction related hardware, where the foregoing program may be stored in a computer readable storage medium, the program executing the steps including the above method embodiment when executed; and the foregoing storage medium includes: a mobile storage device A medium that can store program code, such as a read-only memory (ROM), a magnetic disk, or an optical disk.
  • ROM read-only memory
  • the above-described integrated module of the embodiment of the present invention may be stored in a computer readable storage medium if it is implemented in the form of a software function module and sold or used as a stand-alone product.
  • the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium, including a plurality of instructions.
  • a computer device (which may be a personal computer, server, or network device, etc.) is caused to perform all or part of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes various media that can store program codes, such as a mobile storage device, a ROM, a magnetic disk, or an optical disk.
  • the technical solution of the embodiment of the present invention receives the encrypted information input by the user, determines the encrypted ciphertext according to the encrypted information, generates a disk secret key, and encrypts the disk secret key according to the encrypted ciphertext;
  • the secret key encrypts the data entering the storage device.
  • the encrypted data is not repeatedly transferred between the memory and the storage device, and the data via the memory channel can be directly encrypted, which greatly simplifies the encryption process and steps, and improves the efficiency.
  • the rate reduces system power consumption.
  • the disk key generation and encryption process is separated from the use process, thereby improving the security of the entire terminal device data.

Abstract

一种数据加密方法，包括：接收用户输入的加密信息，根据所述加密信息，确定加密密文（101）；生成磁盘秘钥，并根据所述加密密文，对磁盘秘钥进行加密（102）；通过所述磁盘秘钥，对进入存储设备的数据进行加密（103）。还公开了一种数据加密装置及一种移动终端。

Description

数据加密方法、装置及移动终端、计算机存储介质 技术领域
本发明涉及数据加密技术，尤其涉及一种高级别数据加密方法、装置及移动终端、计算机存储介质。
背景技术
随着智能移动终端的普及，移动终端的存储设备上上存储了越来越多的私人数据，如账户信息、联系人信息、照片等。一旦移动终端因丢失或被盗被其他人获得，会给用户造成较大损失。因此，在移动终端广泛使用的今天，对移动终端中存储的数据进行加密变得非常必要。
现有的移动终端数据加密方法一定程度上能够保护移动终端上的私人数据，但同时也都存在一定的漏洞和缺点：如，1)数据磁盘秘钥仍然保存在被加密文件的分区，因而容易被获取破解，导致数据不够安全；2)数据加密过程中需要将加密数据需要先搬运至内存然后由加密引擎读取进行加密，加密后再写回内存，最后将加密数据写到存储设备，过程繁琐效率低下，速度慢效率低。
可见，现有的数据加密方法不仅安全性不够高，而且加密效率较低，影响了用户体验，增加系统功耗。
发明内容
有鉴于此，本发明实施例期望提供一种数据加密方法、装置及移动终端，能够提高数据加密的效率和安全性。
为达到上述目的，本发明的技术方案是这样实现的：
本发明实施例提供了一种数据加密方法，所述方法包括：
接收用户输入的加密信息，根据所述加密信息，确定加密密文；
生成磁盘秘钥，并根据所述加密密文，对磁盘秘钥进行加密；
通过所述磁盘秘钥，对进入存储设备的数据进行加密。
上述方案中，所述根据加密信息确定加密密文包括：根据用户输入的加密信息和随机盐值，通过哈希(HASH)算法，确定加密密文。
上述方案中，所述生成磁盘秘钥包括：根据HUK值派生磁盘秘钥。
上述方案中，所述方法还包括：
存储所述加密密文以及所述加密后的秘钥。
上述方案中，所述方法还包括：
接收用户输入的解密信息，根据所述解密信息，确定解密密文；
当所述解密密文与存储的加密密文相同时，通过所述解密密文，对所述磁盘秘钥进行解密，获得所述磁盘秘钥；
通过所述磁盘秘钥，对取出存储设备的数据进行解密。
上述方案中，所述根据解密信息确定解密密文包括：根据用户输入的解密信息和随机盐值，通过HASH算法加密，确定解密密文。
上述方案中，所述方法还包括：相同的加密信息和解密信息使用相同的随机盐值，不同的加密信息和解密信息使用不同的随机盐值。
本发明实施例还提供了一种数据加密装置，所述装置包括：秘钥管理模块、加密引擎模块，其中，
所述秘钥管理模块，配置为接接收用户输入的加密信息，根据所述加密信息，确定加密密文；生成磁盘秘钥，并根据所述加密密文，对磁盘秘钥进行加密；
所述加密引擎模块，配置为通过所述磁盘秘钥，对进入存储设备的数据进行加密。
上述方案中，所述秘钥管理模块还配置为：根据用户输入的加密信息 和随机盐值，通过HASH算法，确定加密密文。
上述方案中，所述秘钥管理模块还配置为：根据HUK值派生磁盘秘钥。
上述方案中，所述装置还包括安全存储模块，配置为存储所述加密密文以及所述加密后的秘钥。
上述方案中，所述秘钥管理模块还配置为：接收用户输入的解密信息，根据所述解密信息，确定解密密文；
当所述解密密文与存储的加密密文相同时，通过所述解密密文，对所述磁盘秘钥进行解密，获得所述磁盘秘钥；
所述加密引擎模块，还配置为通过所述磁盘秘钥，对取出存储设备的数据进行解密。
上述方案中，所述秘钥管理模块还配置为：根据用户输入的解密信息和随机盐值，通过HASH算法加密，确定解密密文。
上述方案中，所述秘钥管理模块还配置为：相同的加密信息和解密信息使用相同的随机盐值，不同的加密信息和解密信息使用不同的随机盐值。
本发明实施例还提供了一种移动终端，所述移动终端包括上述数据加密装置。
本发明实施例还提供了一种计算机存储介质，本发明实施例提供的计算机存储介质存储有计算机程序，该计算机程序用于执行上述数据加密方法。
本发明实施例的技术方案中，接收用户输入的加密信息，根据所述加密信息，确定加密密文；生成磁盘秘钥，并根据所述加密密文，对磁盘秘钥进行加密；通过所述磁盘秘钥，对进入存储设备的数据进行加密。如此，无需将被加密数据反复在内存和存储设备之间反复搬运，能够直接对经由存储器通道的数据进行加密，大大简化了加密流程和步骤，同时提高了效率降低系统功耗。同时，磁盘秘钥生成和加密过程与使用过程分离，从而 提高了整个终端设备数据的安全性。
附图说明
图1为本发明实施例一数据加密方法流程示意图；
图2为本发明实施例二数据加密方法流程示意图；
图3为本发明实施例三数据加密方法流程示意图；
图4为本发明实施例数据解密方法流程示意图；
图5为本发明实施例数据加密装置结构示意图。
具体实施方式
本发明实施例中，先接收用户输入的加密信息，根据所述加密信息，确定加密密文；再根据所述加密密文，对磁盘秘钥进行加密；之后通过所述磁盘秘钥，对进入存储设备的数据进行加密。其中，所述进入存储设备的数据为经过存储设备和系统总线之间的、进入存储设备的数据。
本发明实施例所述数据加密方法涉及可信执行环境(TEE，Trusted Execution Environment)和常规操作系统环境(REE，Rich Execution Environment)(如Android等)，其中，确定加密密文以及生成磁盘秘钥、对磁盘密钥进行加密的过程在TEE中执行，对进入存储设备的数据进行加密的过程在REE中执行。从而实现对经过存储设备和系统总线之间的、进入存储设备的数据进行加密。对数据进行加密的秘钥来源于TEE系统，由TEE为其提供秘钥保存管理。
本发明实施例中，TEE系统可基于TrustZone技术构建，与设备上的主OS(如Android中的REE)是平行关系。TEE和主OS(如REE)是两个隔离的环境，两者通过规范好的固定接口进行通信，REE环境及其上运行的应用程序无法访问触及到TEE环境的资源，TEE上仅运行安全可信的程序，从而确保了TEE环境的安全可靠性同时也可防止恶意软件的攻击。
相对于传统的数据加密方法，无需将被加密数据反复在内存和存储设备之间反复搬运，能够直接对经由存储器通道的数据进行加密，加密过程不需要CPU参与，大大简化了加密流程和步骤，同时提高了效率降低系统功耗。同时，磁盘秘钥生成和保存在安全环境TEE中，REE及第三方应用无法触及到，安全性大大提高，从而提高了整个终端设备数据的安全性。
下面结合附图及具体实施例，对本发明技术方案的实施作进一步的详细描述。图1为本发明实施例一数据加密方法流程示意图，如图1所示，本实施例数据加密方法包括以下步骤：
步骤101：接收用户输入的加密信息，根据所述加密信息，确定加密密文；
其中，所述根据所述加密信息，确定加密密文包括：根据用户输入的加密信息和随机盐值，通过HASH算法，确定加密密文；并将所述加密密文进行存储；
其中，所述用户输入的加密信息即用户输入的密码信息，具体的，在用户设置用户密码的过程中，首先接收用户输入的加密信息，即用户设置的密码，然后在接收到的用户输入的加密信息中加入随机盐值进行混淆，随机盐值的长度可以和HASH的输出数据长度一样长。这里，相同的加密信息加入相同的盐值，不同的加密信息加入不同盐值，确保使用非固定盐值。在用户用输入的加密信息中加入盐值后经HASH算法(如SHA、MD5等)加密生成加密密文，所述加密密文即为即HASH值。所述加密密文用来对磁盘秘钥进行加密及后续解密过程中对用户输入的解密信息进行验证，然后将所述加密密文进行存储，而用户输入的加密信息不进行保存。这样即使不法用户获得系统中HASH值其反向破解难度也是极大的。
步骤102：生成磁盘秘钥，并根据所述加密密文，对磁盘秘钥进行加密；
本发明实施例中，所述生成磁盘秘钥包括：根据HUK(Hardware Unique  Key)值派生磁盘秘钥；其中，所述磁盘秘钥用于对数据进行加密和解密。HUK值为硬件设备的可信根，作为每个硬件设备独一无二的标识，在芯片工厂阶段被烧写进非易失性存储器中。
本发明实施例中，所述方法还包括：存储所述加密后的密文。
本发明实施例中，根据设备本身的HUK值派生出磁盘秘钥，从而可确保每台设备磁盘秘钥的独一无二性，并利用上述密文对所述磁盘秘钥进行加密然后进行保存。
步骤103：通过所述磁盘秘钥，对进入存储设备的数据进行加密。
本发明实施例中，获取TEE环境中生成的秘钥，直接对REE环境中的、经过存储设备和系统总线之间的、进入存储设备的数据进行实时加解密，无需再将数据其搬运至内存。在进行加密的过程中其可以将秘钥信息存储在REE环境中的秘钥寄存器中。
本发明实施例中，当用户需要对加密后的数据进行解密时，所述方法还包括：接收用户输入的解密信息，根据所述解密信息，确定解密密文；判断所述解密密文是否与存储的加密密文相同，当所述解密密文与存储的加密密文不相同时，解密失败，提示用户密码错误；当所述解密密文与存储的加密密文相同时，通过所述解密密文，对所述磁盘秘钥进行解密，获得所述磁盘秘钥；通过所述磁盘秘钥，对取出存储设备的数据进行解密。
其中，所述根据解密信息确定解密密文包括：根据用户输入的解密信息和随机盐值，通过HASH算法加密，确定解密密文。
在生成加密密文和解密密文的过程中，相同的加密信息和解密信息使用相同的随机盐值，不同的加密信息和解密信息使用不同的随机盐值。这样使用非固定盐值进一步增加暴力破解难度。
具体的，当用户用需要对数据进行解密时，接收用户输入的解密信息，即用户输入的密码，将接收到的用户输入的解密信息使用相应的盐值对其 进行混淆，同时使用和加密过程相同的HASH算法对其加密得到解密密文，其中，所述解密密文即为HASH值，然后判断所述解密密文(HASH值)与系统中保存的加密密文(HASH值)是否相同，当所述解密密文与存储的加密密文不相同时，解密失败，提示用户密码错误；当所述解密密文与系统中保存的加密密文相同时，认为验证通过，通过所述解密密文对磁盘秘钥解密获取磁盘秘钥，从而实现对用户密码进行验证。
在数据加密的过程中，用户输入的加密信息为用户设置的加密密码；在数据解密的过程中，用户输入的解密信息为用户输入的解密密码。
图2为本发明实施例二数据加密方法流程示意图，如图2所示，本发明实施例二所述数据加密方法为用户在终端上首次开启磁盘加密功能的过程，TEE环境中包括用户密码设置、秘钥派生等步骤，所述数据加密方法首先要求用户设置加密信息，然后根据用户输入的加密信息和随机盐值加密得到加密密文，利用该密文对由设备HUK值派生出的磁盘秘钥进行加密，并保存加密后的秘钥，同时保存所述加密密文。然后REE侧获取所述磁盘秘钥，并根据所述磁盘秘钥对磁盘数据进行加密。具体的，本发明实施例二所述数据加密方法包括以下步骤：
步骤201：用户在开启磁盘加密功能；
其中，用户可以在“设置”选项中开启磁盘加密功能；
步骤202：提用户设置密码；
其中，可以通过界面弹出密码框的方式提升用户设置密码；
步骤203：接收用户输入的密码，对用户密码加入随机盐值，并进行HASH运算得到HASH值；
其中，所述HASH值即为加密密文。
步骤204：保存所述HASH值；
步骤205：通过所述HASH值对磁盘秘钥进行加密；
步骤206：保存所述加密后的秘钥；
步骤207：通知REE环境对数据进行加密；
步骤208：通过固定接口从TEE环境获取磁盘秘钥，对进入存储设备的数据进行加密。
图3为本发明实施例三数据加密方法流程示意图，如图3所示，本发明实施例三所述数据加密方法为写磁盘数据的实时加密的过程。REE在获取磁盘秘钥后会将其保存到秘钥寄存器中供后续数据加解密。在进行在正常使用过程中，会实时对磁盘写入数据进行加密，通过直接对经过存储设备和系统总线之间的、进入存储设备的磁盘数据进行加密，减少了数据往复搬运内存的过程，提高了加密速度和效率；具体的，本发明实施例三所述数据加密方法包括以下步骤：
步骤301：CPU对磁盘数据进行写操作；
步骤302：REE通过固定接口从TEE获取磁盘秘钥，并保存到自身的秘钥寄存器中；所述磁盘秘钥用于后续加密过程；
步骤303：通过所述磁盘秘钥对经过存储设备和系统总线之间的、要写入存储设备的磁盘数据要进行加密。
步骤304：将加密后数据发送给存储设备进行存储。
图4为本发明实施例数据解密方法流程示意图，如图4所示，本发明实施例所述数据解密方法为读磁盘数据的实时解密的过程。REE在获取磁盘秘钥后会将其保存到秘钥寄存器中供后续数据加解密。在进行在正常使用过程中，会实时对磁盘读出数据进行解密，通过直接对经过存储设备和系统总线之间的、读出存储设备的磁盘数据进行解密，减少了数据往复搬运内存的过程，提高了解密速度和效率；具体的，本发明实施例四所述数据解密方法包括以下步骤：
步骤401：CPU对磁盘数据进行读操作；
步骤402：REE通过固定接口从TEE获取磁盘秘钥，并保存到自身的秘钥寄存器中；所述磁盘秘钥用于后续解密过程；
步骤403：通过所述磁盘秘钥对经过存储设备和系统总线之间的、要读出存储设备的磁盘数据要进行解密。
步骤404：将解密后数据发送给CPU。系统总线。
本发明实施例还提供了一种数据加密装置，图5为本发明实施例数据加密装置结构示意图，如图5所示，所述装置包括：秘钥管理模块51、加密引擎模块52，其中，所述装置涉及TEE和REE，秘钥管理模块51位于TEE中，对加密引擎模块52位于REE中。TEE中的秘钥管理模块51具有秘钥派生，秘钥加密解密，解密信息验证等功能；REE中的加密引擎模块52采用In-Line的架构方式，即在现有的智能移动终端硬件方案架构中将加密引擎模块52内置于存储设备和系统总线之间，为存储管理器独立拥有。对进出存储设备的数据进行实时加密和解密，无需再将进行加密和解密的数据搬运到内存，如图5所示，所述加密引擎模块52和秘钥管理模块51直接连接通信，从秘钥管理模块51获取密钥信息，在正常工作过程中，所述加密引擎模块52可以将秘钥信息存储在自己的秘钥寄存器中。加密引擎模块52所使用的秘钥受控于TEE系统，由TEE为其提供秘钥保存管理等。
所述秘钥管理模块51，配置为接接收用户输入的加密信息，根据所述加密信息，确定加密密文；
其中，所述秘钥管理模块51还配置为：根据用户输入的加密信息和随机盐值，通过HASH算法，确定加密密文。
所述装置还包括安全存储模块53，配置为存储所述加密密文以及所述加密后的秘钥。
本发明实施例中，所述安全存储模块53位于TEE环境中，配置为对磁盘秘钥、HUK值等敏感信息进行保存。所述安全存储模块53的接口直接 连接秘钥管理模块51，仅能被秘钥管理模块51读取。HUK值为硬件设备的可信根，作为每个硬件设备独一无二的标识，在芯片工厂阶段被烧写进非易失性存储器中。
其中，所述用户输入的加密信息即用户输入的密码信息，具体的，在用户设置密码的用户密码的过程中，所述秘钥管理模块51首先接收用户输入的加密信息，即用户设置的密码，然后在接收到的用户输入的加密信息中加入随机盐值进行混淆，随机盐值的长度可以和HASH的输出数据长度一样长。这里，所述秘钥管理模块51在相同的加密信息加入相同的盐值，不同的加密信息加入不同盐值，确保使用非固定盐值。在用户用输入的加密信息中加入盐值后经HASH算法(如SHA、MD5等)加密生成加密密文，所述加密密文即为即HASH值。所述加密密文用来对磁盘秘钥进行加密及后续解密过程中对用户输入的解密信息进行验证，然后将所述加密密文进行存储，而用户输入的加密信息不进行保存。这样即使不法用户获得系统中HASH值其反向破解难度也是极大的。
所述秘钥管理模块51，还配置为生成磁盘秘钥，并根据所述加密密文，对磁盘秘钥进行加密；
其中，所述秘钥管理模块51还配置为：根据HUK值派生磁盘秘钥。其中，所述磁盘秘钥用于对数据进行加密和解密。
所述安全存储模块53还配置为存储所述加密后的密文。
本发明实施例中，所述秘钥管理模块51根据设备本身的HUK值派生出磁盘秘钥，从而可确保每台设备磁盘秘钥的独一无二性，并利用上述密文对所述磁盘秘钥进行加密然后进行保存。
所述加密引擎模块52，配置为通过所述磁盘秘钥，对进入存储设备的数据进行加密。
本发明实施例中，所述加密引擎模块52获取TEE环境中秘钥管理模块 51生成的秘钥，直接对REE环境中的、经过存储设备和系统总线之间的、进入存储设备的数据进行实时加解密，无需再将数据其搬运至内存等。在进行加密的过程中其可以将秘钥信息存储在REE环境中的秘钥寄存器中。
发明实施例中，当用户需要对加密后的数据进行解密时，所述秘钥管理模块51还配置为：接收用户输入的解密信息，根据所述解密信息，确定解密密文；
判断所述解密密文是否与存储的加密密文相同，当所述解密密文与存储的加密密文不相同时，解密失败，提示用户密码错误；当所述解密密文与存储的加密密文相同时，通过所述解密密文，对所述磁盘秘钥进行解密，获得所述磁盘秘钥；
其中，所述秘钥管理模块51还配置为：根据用户输入的解密信息和随机盐值，通过HASH算法加密，确定解密密文。
所述秘钥管理模块51在生成加密密文和解密密文的过程中，相同的加密信息和解密信息使用相同的随机盐值，不同的加密信息和解密信息使用不同的随机盐值。
具体的，当用户用需要对数据进行解密时，所述秘钥管理模块51接收用户输入的解密信息，即用户输入的密码，将接收到的用户输入的解密信息使用相应的盐值对其进行混淆，同时使用和加密过程相同的HASH算法对其加密得到解密密文，其中，所述解密密文即为HASH值，然后判断所述解密密文(HASH值)与系统中保存的加密密文(HASH值)是否相同，当所述解密密文与存储的加密密文不相同时，解密失败，提示用户密码错误；当所述解密密文与系统中保存的加密密文相同时，认为验证通过，通过所述解密密文对磁盘秘钥解密获取磁盘秘钥，从而实现对用户密码进行验证。
所述加密引擎模块52，还配置为通过所述磁盘秘钥，对取出存储设备 的数据进行解密。
在数据加密的过程中，用户输入的加密信息为用户设置的加密密码；在数据解密的过程中，用户输入的解密信息为用户输入的解密密码。
本发明实施例还提供了一种移动终端，其所述移动终端包括图5所述数据加密装置。
本发明实施例所述数据加密方法、装置及移动终端，秘钥保存在可信执行环境TEE中并经用户输入的加密信息进行加密，REE环境及其第三方应用无法获取，安全性大大提高，从而提高了整个终端设备数据的安全性；加密引擎模块采用In-Line的架构方式内置于存储设备和系统总线之间，减少了数据搬运过程从而大幅提高加密速度和效率，降低系统功耗。磁盘秘钥根据每个设备的HUK值生成必然不同，即使使用相同的加解密系统和算法也极难对其进行破解。
如此，一方面提升现有数据加密的安全性；另一方面大幅提高数据加密效率和速度，减少数据搬运次数从而降低功耗解放CPU等；并且能够为终端设备提供实时的数据加密服务。能满足用户对数据进行隐私保护的需求且即使手机丢失或被盗后仍能防范隐私不被泄露的风险。
图5中所示的数据加密装置中的各处理模块的实现功能，可参照前述数据加密方法的相关描述而理解。本领域技术人员应当理解，图3所示的数据加密装置中各处理模块的功能可通过运行于处理器上的程序而实现，也可通过具体的逻辑电路而实现，比如：可由中央处理器(CPU，Central Processing Unit)、微处理器(MPU，Micro Processor Unit)、数字信号处理器(DSP，Digital Signal Processor)、或现场可编程门阵列(FPGA，Field Programmable Gate Array)等实现。
本发明实施例上述业务信令跟踪的装置如果以软件功能模块的形式实现并作为独立的产品销售或使用时，也可以存储在一个计算机可读取存储 介质中。基于这样的理解，本发明实施例的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机、服务器、或者网络设备等)执行本发明各个实施例所述方法的全部或部分。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read Only Memory)、磁碟或者光盘等各种可以存储程序代码的介质。这样，本发明实施例不限制于任何特定的硬件和软件结合。
相应地，本发明实施例还提供一种计算机存储介质，其中存储有计算机程序，该计算机程序用于执行本发明实施例的数据加密方法。
在本发明所提供的几个实施例中，应该理解到，所揭露的方法及装置，可以通过其他的方式实现。以上所描述的装置实施例仅仅是示意性的，例如，所述模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，如：多个模块或组件可以结合，或可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的各组成部分相互之间的通信连接可以是通过一些接口，设备或模块的间接耦合或通信连接，可以是电性的、机械的或其他形式的。
上述作为分离部件说明的模块可以是、或也可以不是物理上分开的，作为模块显示的部件可以是、或也可以不是物理模块，即可以位于一个地方，也可以分布到多个网络模块上；可以根据实际的需要选择其中的部分或全部模块来实现本实施例方案的目的。
另外，在本发明各实施例中的各功能模块可以全部集成在一个处理模块中，也可以是各模块分别单独作为一个模块，也可以两个或两个以上模块集成在一个模块中；上述集成的模块既可以采用硬件的形式实现，也可以采用硬件加软件功能模块的形式实现。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步 骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于计算机可读取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述的存储介质包括：移动存储设备、只读存储器(ROM，Read-Only Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
或者，本发明实施例上述集成的模块如果以软件功能模块的形式实现并作为独立的产品销售或使用时，也可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明实施例的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机、服务器、或者网络设备等)执行本发明各个实施例所述方法的全部或部分。而前述的存储介质包括：移动存储设备、ROM、磁碟或者光盘等各种可以存储程序代码的介质。
本发明是实例中记载的数据加密方法、装置只以上述实施例为例，但不仅限于此，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。
以上所述仅为本发明的较佳实施例而已，并非用于限定本发明的保护范围。
工业实用性
本发明实施例的技术方案，接收用户输入的加密信息，根据所述加密信息，确定加密密文；生成磁盘秘钥，并根据所述加密密文，对磁盘秘钥进行加密；通过所述磁盘秘钥，对进入存储设备的数据进行加密。如此，无需将被加密数据反复在内存和存储设备之间反复搬运，能够直接对经由存储器通道的数据进行加密，大大简化了加密流程和步骤，同时提高了效 率降低系统功耗。同时，磁盘秘钥生成和加密过程与使用过程分离，从而提高了整个终端设备数据的安全性。

Claims (16)

  1. 一种数据加密方法，所述方法包括：
    接收用户输入的加密信息，根据所述加密信息，确定加密密文；
    生成磁盘秘钥，并根据所述加密密文，对磁盘秘钥进行加密；
    通过所述磁盘秘钥，对进入存储设备的数据进行加密。
  2. 根据权利要求1所述方法，其中，所述根据加密信息确定加密密文包括：根据用户输入的加密信息和随机盐值，通过哈希HASH算法，确定加密密文。
  3. 根据权利要求1所述方法，其中，所述生成磁盘秘钥包括：根据HUK值派生磁盘秘钥。
  4. 根据权利要求1所述方法，其中，所述方法还包括：
    存储所述加密密文以及所述加密后的秘钥。
  5. 根据权利要求1所述方法，其中，所述方法还包括：
    接收用户输入的解密信息，根据所述解密信息，确定解密密文；
    当所述解密密文与存储的加密密文相同时，通过所述解密密文，对所述磁盘秘钥进行解密，获得所述磁盘秘钥；
    通过所述磁盘秘钥，对取出存储设备的数据进行解密。
  6. 根据权利要求5所述方法，其中，所述根据解密信息确定解密密文包括：根据用户输入的解密信息和随机盐值，通过HASH算法加密，确定解密密文。
  7. 根据权利要求2或6所述方法，其中，所述方法还包括：相同的加密信息和解密信息使用相同的随机盐值，不同的加密信息和解密信息使用不同的随机盐值。
  8. 一种数据加密装置，所述装置包括：秘钥管理模块、加密引擎模块，其中，
    所述秘钥管理模块，配置为接接收用户输入的加密信息，根据所述加密信息，确定加密密文；生成磁盘秘钥，并根据所述加密密文，对磁盘秘钥进行加密；
    所述加密引擎模块，配置为通过所述磁盘秘钥，对进入存储设备的数据进行加密。
  9. 根据权利要求8所述装置，其中，所述秘钥管理模块还配置为：根据用户输入的加密信息和随机盐值，通过HASH算法，确定加密密文。
  10. 根据权利要求8所述装置，其中，所述秘钥管理模块还配置为：根据HUK值派生磁盘秘钥。
  11. 根据权利要求8所述装置，其中，所述装置还包括安全存储模块，配置为存储所述加密密文以及所述加密后的秘钥。
  12. 根据权利要求8所述装置，其中，所述秘钥管理模块还配置为：接收用户输入的解密信息，根据所述解密信息，确定解密密文；
    当所述解密密文与存储的加密密文相同时，通过所述解密密文，对所述磁盘秘钥进行解密，获得所述磁盘秘钥；
    所述加密引擎模块，还配置为通过所述磁盘秘钥，对取出存储设备的数据进行解密。
  13. 根据权利要求11所述装置，其中，所述秘钥管理模块还配置为：根据用户输入的解密信息和随机盐值，通过HASH算法加密，确定解密密文。
  14. 根据权利要求9或13所述装置，其中，所述秘钥管理模块还配置为：相同的加密信息和解密信息使用相同的随机盐值，不同的加密信息和解密信息使用不同的随机盐值。
  15. 一种移动终端，其中，所述移动终端包括权利要求8至14任一项所述数据加密装置。
  16. 一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，该计算机可执行指令配置为执行权利要求1-7任一项所述的数据加密方法。
PCT/CN2016/093519 2015-09-10 2016-08-05 数据加密方法、装置及移动终端、计算机存储介质 WO2017041603A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510574150.8A CN106529308B (zh) 2015-09-10 2015-09-10 一种数据加密方法、装置及移动终端
CN201510574150.8 2015-09-10

Publications (1)

Publication Number Publication Date
WO2017041603A1 true WO2017041603A1 (zh) 2017-03-16

Family

ID=58240639

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/093519 WO2017041603A1 (zh) 2015-09-10 2016-08-05 数据加密方法、装置及移动终端、计算机存储介质

Country Status (2)

Country Link
CN (1) CN106529308B (zh)
WO (1) WO2017041603A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109936446A (zh) * 2019-01-16 2019-06-25 深圳壹账通智能科技有限公司 分布式环境下的秘钥管理方法、装置及计算机设备
CN111786780A (zh) * 2020-06-23 2020-10-16 北京思特奇信息技术股份有限公司 一种shell脚本安全使用密码的方法、系统、介质及设备
CN112926101A (zh) * 2021-03-31 2021-06-08 完美世界控股集团有限公司 磁盘分区加密方法、系统、设备，以及计算机可读介质
CN113517978A (zh) * 2021-07-16 2021-10-19 安徽伊普诺康生物技术股份有限公司 一种体外诊断设备试剂卡的安全防护与重用方法
CN113676445A (zh) * 2021-07-05 2021-11-19 国网上海能源互联网研究院有限公司 一种适用于传输配电物联网文件的方法及系统
CN115171247A (zh) * 2022-06-24 2022-10-11 广东汇泰龙科技股份有限公司 一种智能锁、存储方法、解密方法及存储介质

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109286488B (zh) * 2017-07-21 2021-09-21 展讯通信（上海）有限公司 Hdcp关键密钥保护方法
CN109840435A (zh) * 2017-11-27 2019-06-04 深圳市朗科科技股份有限公司 一种存储设备的数据保护方法
CN108574567A (zh) * 2018-03-19 2018-09-25 西安邮电大学 隐私文件保护和加密密钥管理系统及方法、信息处理终端
CN110401538B (zh) * 2018-04-24 2022-04-22 北京握奇智能科技有限公司 数据加密方法、系统以及终端
CN109815662A (zh) * 2018-12-06 2019-05-28 北京握奇智能科技有限公司 一种tee环境下的手势密码身份认证方法及系统
CN110032874A (zh) * 2019-01-31 2019-07-19 阿里巴巴集团控股有限公司 一种数据存储方法、装置及设备
CN112104450A (zh) * 2020-08-27 2020-12-18 广东技术师范大学天河学院 一种对称式数据加密方法、系统及电子设备
CN113778749B (zh) * 2021-08-16 2023-12-12 荣耀终端有限公司 数据备份方法及电子设备
WO2023133862A1 (zh) * 2022-01-14 2023-07-20 华为技术有限公司 数据处理方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1924835A (zh) * 2006-09-01 2007-03-07 西安交通大学 一种基于动态密钥的硬盘数据加密方法及其装置
WO2007056579A1 (en) * 2005-11-11 2007-05-18 Computer Associates Think, Inc. System and method for encrypting data without regard to application
CN101079008A (zh) * 2006-05-22 2007-11-28 中国软件与技术服务股份有限公司 移动存储器失泄密防护的方法和系统
CN102567233A (zh) * 2011-12-23 2012-07-11 福建升腾资讯有限公司 基于磁盘虚拟技术的usb存储设备数据保护方法
CN103955654A (zh) * 2014-04-02 2014-07-30 西北工业大学 基于虚拟文件系统的u盘安全存储方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007056579A1 (en) * 2005-11-11 2007-05-18 Computer Associates Think, Inc. System and method for encrypting data without regard to application
CN101079008A (zh) * 2006-05-22 2007-11-28 中国软件与技术服务股份有限公司 移动存储器失泄密防护的方法和系统
CN1924835A (zh) * 2006-09-01 2007-03-07 西安交通大学 一种基于动态密钥的硬盘数据加密方法及其装置
CN102567233A (zh) * 2011-12-23 2012-07-11 福建升腾资讯有限公司 基于磁盘虚拟技术的usb存储设备数据保护方法
CN103955654A (zh) * 2014-04-02 2014-07-30 西北工业大学 基于虚拟文件系统的u盘安全存储方法

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109936446A (zh) * 2019-01-16 2019-06-25 深圳壹账通智能科技有限公司 分布式环境下的秘钥管理方法、装置及计算机设备
CN111786780A (zh) * 2020-06-23 2020-10-16 北京思特奇信息技术股份有限公司 一种shell脚本安全使用密码的方法、系统、介质及设备
CN112926101A (zh) * 2021-03-31 2021-06-08 完美世界控股集团有限公司 磁盘分区加密方法、系统、设备，以及计算机可读介质
CN112926101B (zh) * 2021-03-31 2024-04-05 完美世界控股集团有限公司 磁盘分区加密方法、系统、设备，以及计算机可读介质
CN113676445A (zh) * 2021-07-05 2021-11-19 国网上海能源互联网研究院有限公司 一种适用于传输配电物联网文件的方法及系统
CN113517978A (zh) * 2021-07-16 2021-10-19 安徽伊普诺康生物技术股份有限公司 一种体外诊断设备试剂卡的安全防护与重用方法
CN115171247A (zh) * 2022-06-24 2022-10-11 广东汇泰龙科技股份有限公司 一种智能锁、存储方法、解密方法及存储介质

Also Published As

Publication number Publication date
CN106529308A (zh) 2017-03-22
CN106529308B (zh) 2020-01-31

Similar Documents

Publication Publication Date Title
WO2017041603A1 (zh) 数据加密方法、装置及移动终端、计算机存储介质
US9686248B2 (en) Secure shared key sharing systems and methods
CN104951409B (zh) 一种基于硬件的全盘加密系统及加密方法
US9735962B1 (en) Three layer key wrapping for securing encryption keys in a data storage system
US10419217B2 (en) Security information configuration method, security verification method, and related chip
KR102013841B1 (ko) 데이터의 안전한 저장을 위한 키 관리 방법 및 그 장치
US9811478B2 (en) Self-encrypting flash drive
EP2989741B1 (en) Generation of working security key based on security parameters
CN102138300B (zh) 消息认证码预计算在安全存储器中的应用
EP2711859B1 (en) Secured computing system with asynchronous authentication
WO2016146013A1 (zh) 在数字内容设备中在线写入应用密钥的方法、装置及系统
TW201723920A (zh) 硬體強制單向密碼學
CN104090853A (zh) 一种固态盘加密方法和系统
TWI570590B (zh) 與使用縮減回合編密的ｘｔｓ加密系統一起使用之動態加密金鑰
CN112560058B (zh) 基于智能密码钥匙的ssd分区加密存储系统及其实现方法
CN209803788U (zh) 一种pcie可信密码卡
US10776522B1 (en) Asymmetric protection of circuit designs
CN104901810A (zh) 一种基于国产密码算法的数据加密存储的方法
CN108920984B (zh) 一种防克隆篡改安全ssd主控芯片
CN104866784A (zh) 一种基于bios加密的安全硬盘、数据加密及解密方法
US9367700B2 (en) System and method for establishing a shared secret for communication between different security domains
CN107315966B (zh) 固态硬盘数据加密方法及系统
US9076002B2 (en) Stored authorization status for cryptographic operations
CN109255225A (zh) 基于双重身份认证的硬盘数据安全管理装置
WO2017020449A1 (zh) 一种指纹读取方法及用户设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16843541

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16843541

Country of ref document: EP

Kind code of ref document: A1