WO2020093290A1 - 一种存储控制器、文件处理方法、装置及系统 - Google Patents

一种存储控制器、文件处理方法、装置及系统 Download PDF

Info

Publication number
WO2020093290A1
WO2020093290A1 PCT/CN2018/114445 CN2018114445W WO2020093290A1 WO 2020093290 A1 WO2020093290 A1 WO 2020093290A1 CN 2018114445 W CN2018114445 W CN 2018114445W WO 2020093290 A1 WO2020093290 A1 WO 2020093290A1
Authority
WO
WIPO (PCT)
Prior art keywords
file
processed
indication information
random number
storage controller
Prior art date
Application number
PCT/CN2018/114445
Other languages
English (en)
French (fr)
Inventor
潘时林
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18939551.0A priority Critical patent/EP3848837A4/en
Priority to CN201880082681.7A priority patent/CN111512308A/zh
Priority to PCT/CN2018/114445 priority patent/WO2020093290A1/zh
Publication of WO2020093290A1 publication Critical patent/WO2020093290A1/zh
Priority to US17/231,869 priority patent/US20210232509A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G06F12/1408—Protection against unauthorised use of memory or access to memory by using cryptography
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/10—Providing a specific technical effect
    • G06F2212/1052—Security improvement

Definitions

  • the present application relates to the technical field of file storage control, in particular to a storage controller, file processing method, device and system.
  • file encryption schemes are mostly used in mainstream electronic device storage systems to store files.
  • the more common file encryption scheme is a file-per-key encryption scheme.
  • Different files are encrypted and stored in memory by different keys.
  • the key of the encrypted file will also be encrypted by another key. For example, there is a key A for encrypting the file, and another key a for encrypting the key A, where the key a can be called It is the class key.
  • the encrypted storage of files needs to be realized by the processor, storage controller and memory of the electronic device.
  • the operating mode of the processor includes a rich operating system (rich execution environment, REE) mode and a trusted execution environment (trust execution environment (TEE) mode.
  • REE rich operating system
  • TEE trusted execution environment
  • the processor in TEE mode can obtain and use the group key.
  • the processor needs to first switch to the TEE mode, use the group key to encrypt the key A configured for the file to obtain the ciphertext B, and configure the key A in the storage controller.
  • the processor switches to the REE mode, and then sends an instruction to the storage controller to instruct the storage controller to encrypt the file using the key A, and stores the encrypted file and ciphertext B in the memory.
  • the processor in REE mode When reading a file, the processor in REE mode needs to first obtain the ciphertext B from the memory through the storage controller and switch to TEE mode.
  • the processor in the TEE mode uses the group key to decrypt the ciphertext B to obtain the key A, and configures the key A in the storage controller. After that, the processor switches to REE mode, and then sends an instruction to the storage controller to instruct the storage controller to obtain the file to be read from the memory, and decrypts the obtained file using the key A to obtain the decrypted file .
  • the repeated switching between the REE mode and the TEE mode occupies more processing resources of the processor, affects the efficiency of the processor in processing other tasks, and thus causes a certain loss to the processing performance of the processor.
  • the present application provides a storage controller, file processing method, device, and system to improve file processing efficiency while ensuring security.
  • an embodiment of the present application provides a storage controller, including: a controller, a keystore, a key derivator, a file encryption and decryption device, and a data storage interface; wherein, the keystore is used to store at least one group The key classkey; the controller is used to receive the indication information of the file to be processed and the indication information of the random number sent by the processor; then, obtain the file to be processed according to the indication information of the file to be processed, and according to the indication information of the random number Obtain a random number; and obtain the first group key from at least one group key stored in the keystore; a key derivator, used to calculate and obtain a file key based on the random number obtained by the controller and the first group key ; File encryption and decryption device, which is used to process the file to be processed by using the file key calculated by the key derivator to obtain the processed file; the data storage interface is used to write the processed file to the data storage; or, from The data memory reads the file to be processed
  • the keystore stores at least one group key
  • the key derivator can generate the first group key in the at least one group key and the random number provided by the processor File key.
  • the storage controller can generate the file key for file encryption or decryption processing according to the random number provided by the processor, and the processor no longer needs to switch to the TEE mode for processing when reading and writing files.
  • the file encryption and decryption device uses the file key calculated by the key derivator to process the file to be processed, it may be specifically used to:
  • the processed file is encrypted to obtain the processed file;
  • the data storage interface is specifically used to write the processed file to the data storage.
  • the indication information of the file to be processed includes the address information of the file to be processed in the running memory; the controller, according to the indication information of the file to be processed, obtains the The file is specifically used to read the file to be processed from the running memory through the system interface according to the address information.
  • the file encryption and decryption device when processing the file to be processed using the file key, is specifically used to: decrypt the file to be processed using the file key to obtain the processed The file; the data storage interface, specifically used to read the file to be processed from the data storage.
  • the indication information of the file to be processed includes the address information of the file to be processed in the data storage; the controller, according to the indication information of the file to be processed, obtains the When the file is used, it is specifically used to control the data storage interface to read the file to be processed from the data storage according to the address information.
  • the indication information of the random number includes a random number; the controller, when acquiring the random number according to the indication information of the random number, is specifically used to: the indication information of acquiring the random number includes Random number.
  • the indication information of the random number includes the address information of the random number in the running memory; the controller, when acquiring the random number according to the indication information of the random number, is specifically used to: The above address information reads the random number from the running memory through the system interface.
  • the indication information of the random number is determined by the processor according to the random number in the running memory; the controller receives the indication information and randomness of the file to be processed sent by the processor Before the indication information of the number, it is also used to: receive the second indication information sent by the processor, control the data storage interface to read the metadata of the file to be processed from the data storage according to the second indication information, and process the pending The file of the file is written into the running memory; the metadata of the file to be processed includes a random number.
  • the controller is further configured to: receive the first indication information sent by the processor, and control the data storage interface to use the random number as the element of the file to be processed according to the first indication information Data is written to data memory.
  • the controller when acquiring the first group key from at least one group key stored in the key library, is specifically used to: receive the first group sent by the processor Key instruction information; the first group key instruction information is used to indicate the storage location of the first group key in the keystore; according to the first group key instruction information, the first group key is obtained from the keystore key.
  • an embodiment of the present application provides a file processing method, including: a storage controller receiving indication information of a file to be processed and indication information of a random number sent by a processor; thereafter, the storage controller according to the file to be processed Instruct the information to obtain the file to be processed, obtain the random number according to the instruction information of the random number, and obtain the first group key from at least one group key stored in advance; based on the obtained random number and the first group key, store The controller calculates and obtains the file key; after that, the storage controller uses the calculated file key to process the file to be processed to obtain the processed file.
  • the indication information of the file to be processed includes the address information of the file to be processed in the running memory; the storage controller is acquiring the file to be processed according to the indication information of the file to be processed When file, you can read the file to be processed from the operation memory according to the address information.
  • the storage controller when the storage controller uses the file key to process the file to be processed to obtain the processed file, it may use the file key to decrypt the file to be processed to obtain the processed
  • the storage controller may read the file to be processed from the data storage according to the instruction information of the file to be processed.
  • the indication information of the file to be processed includes the address information of the file to be processed in the data storage; the storage controller may read the file to be processed from the data storage, Read the file to be processed from the data storage according to the address information.
  • the indication information of the random number includes a random number; when the storage controller acquires the random number according to the indication information of the random number, the storage controller may acquire the random number from the indication information of the random number.
  • the indication information of the random number includes the address information of the random number in the running memory; when the storage controller obtains the random number according to the indication information of the random number, it can Random numbers are read from the operating memory.
  • the indication information of the random number is determined by the processor according to the random number in the running memory; the storage controller receives the indication information and randomness of the file to be processed sent by the processor Before the indication information of the number, it can also receive the second indication information sent by the processor, read the metadata of the file to be processed from the data storage according to the second indication information, and write the file to be processed into the running memory; wherein, The metadata of the file to be processed includes random numbers.
  • the storage controller may also receive the first indication information sent by the processor, and control the data storage interface to use the random number as metadata of the file to be processed according to the first indication information Write to data memory.
  • the storage controller may receive the indication information of the first group key sent by the processor
  • the indication information of the first group key is used to indicate the storage location of the first group key; the storage controller obtains the first group key from at least one group key stored in advance according to the indication information of the first group key .
  • an embodiment of the present application provides a file processing apparatus, including a processor and a storage controller as provided in any one of the above-mentioned first aspects; wherein, the processor is used to send a file to be processed to the storage controller Instructions and instructions for random numbers.
  • the processor before sending the indication information of the file to be processed and the indication information of the random number to the storage controller, the processor is further used to: generate a random number for the file to be processed.
  • the processor after generating a random number for the file to be processed, is also used to: send first indication information to the storage controller; the first indication information is used to instruct the storage controller to use the random number as metadata of the file to be processed Write to data memory.
  • the processor before sending the indication information of the file to be processed and the indication information of the random number to the storage controller, the processor is further configured to: send a second indication to the storage controller Information; the second instruction information is used to instruct the storage controller to write the metadata of the file to be processed into the running memory; query the running memory, and determine the random number from the metadata of the file to be processed.
  • the device further includes: a memory controller corresponding to the running memory; wherein, the memory controller and the storage controller are connected through a system interface; the memory controller is used to run from The memory reads the file to be processed, and sends the file to the storage controller through the system interface; or, receives the processed file from the storage controller through the system interface, and writes the processed file into the operating memory.
  • an embodiment of the present application provides a file processing system, including the file processing apparatus as provided in any one of the above third aspects, and a data storage; wherein the data storage is connected to a storage controller in the file processing apparatus .
  • FIG. 1 is a schematic diagram of a file processing system architecture provided by an embodiment of the present application
  • FIG. 2 is a schematic diagram of a process for a processor to store a group key in a key store provided by an embodiment of this application;
  • FIG. 3 is a schematic flowchart of a file writing method according to an embodiment of this application.
  • FIG. 5 is a second schematic flowchart of a file writing method according to an embodiment of the present application.
  • FIG. 1 is a schematic structural diagram of a file processing system according to an embodiment of the present application, and is located in an electronic device.
  • the electronic device includes but is not limited to a terminal or a server. Terminals include but are not limited to mobile phones, laptop computers, tablet computers, desktop computers or wearable devices.
  • the file processing system includes a file processing device 100, an operation memory 200 and a data storage 300. Among them, the file processing apparatus 100 is connected to the operation memory 200 and the data memory 300, respectively.
  • connection in various embodiments of the present application is used to indicate electrical connection, including but not limited to direct connection through wires and indirect connection through third-party devices.
  • the running memory 200 may be a volatile memory during power-off, for example, a dynamic random access memory (dynamic random access memory, DRAM), which is often used as a system memory, which is mainly used by the file processing apparatus 100 from Read and write data quickly.
  • the data storage 300 may be a non-volatile volatile memory, such as universal flash memory (universal flash storage (UFS), embedded multimedia card (embedded multi-media card, eMMC), non-volatile memory host controller interface specification ( Non-volatile memory, NVMe) memory, etc.
  • the file processing apparatus 100 may be a system on chip (SOC) or a system including multiple chips.
  • the file processing apparatus 100 includes a processor 101, a memory controller 102, and a storage controller 103.
  • the processor 101 is connected to the memory controller 102 and the storage controller 103, respectively.
  • the memory controller 102 is connected to the running memory 200
  • the memory controller 103 is connected to the data memory 300.
  • the memory controller 102 and the storage controller 103 may also be connected through a system interface 104.
  • the processor 101 can control the storage controller 103 to read the file from the data storage 300, and send the read file to the memory controller 102 through the system interface 104, and then the memory controller 102 writes the file to the running memory 200.
  • the processor 101 may also control the storage controller 103 to obtain the file to be written in the operation memory 200 from the memory controller 102 through the system interface 104, and write the file to be written into the data storage 300.
  • the system interface 104 is a system bus or other bus.
  • the memory controller 102 is required to read or write files in the running memory 200.
  • the expressions “write file to run memory 200” and “read file from run memory 200” in the embodiments of the present application may include “write file to run memory 200 through memory controller 102” and “pass The meaning of "the memory controller 102 reads a file from the operating memory 200" will not be described in detail below.
  • the storage controller 103 When the processor 101 controls the storage controller 103 to read the file from the data storage 300 as an encrypted storage file, the storage controller 103 also needs to decrypt the read file to obtain the decrypted file, and then decrypt the decrypted file. The file is written to the run memory 200. Similarly, when the processor 101 controls the storage controller 103 to write the file into the data storage 300 as a file that needs to be encrypted and stored, the storage controller 103 also needs to perform an encryption process to obtain the encrypted file , And then write the encrypted file to the data storage 300.
  • an embodiment of the present application provides a storage controller, which stores files to be processed
  • the embodiments of the present application provide a feasible storage controller structure, as shown in FIG. 1.
  • the storage controller 103 includes a controller 1031, a key store 1032, a key derivator 1033, a file encryption and decryption device 1034, and a data storage interface 1035.
  • the keystore 1032 is connected to the processor 101 and is used to store at least one group key classkey. In the embodiment of the present application, at least one class key stored in the key store 1032 may be directly written into the key store 1032 before the storage controller 103 leaves the factory, or may be pre-stored by the processor 101 In the keystore 1032.
  • the processor 101 acquires at least one group key using a key generation algorithm and stores the acquired at least one group key in a keystore in a file system initialization phase, such as when the terminal device restarts or after system settings are restored, etc. 1032.
  • the key generation process is prior art, and will not be repeated in this application.
  • FIG. 2 exemplarily shows a process in which the processor 101 stores the group key in the keystore 1032.
  • the processor 101 includes two modes of TEE and REE.
  • the processor 101 is usually in the REE mode by default during the file system initialization phase.
  • the processor 101 obtains the ciphertext classkey1x of classkey1 and the ciphertext classkey2x of classkey2 from the data storage 300 and / or other storage media by running its internal file encryption module.
  • the processor 101 switches to the TEE mode, decrypts classkey1x and classkey2x by running a key management (key) module, so as to obtain classkey1 and classkey2, and stores the obtained classkey1 and classkey2 in the keystore 1032.
  • key management key
  • classkey1 is used to encrypt or decrypt file keys of user files.
  • the ciphertext of classkey1 classkey1x is fixed by classkey1 Generated after the parameter is encrypted, for example, classkey2 is used to encrypt or decrypt the file key of the system file.
  • the ciphertext of classkey2 classkey2x is the unique hardware key (hardware unique key, HUK) and user password (such as The personal identification code (persional identification number, pin) is generated after encryption. Based on this, as shown in FIG.
  • the processor 101 in the TEE mode may also write the storage location information of classkey1 and classkey2 in the keystore 1032 corresponding to the group key identifier Operation memory 200.
  • the processor 101 in the TEE mode stores the complete content of classkey1 in the storage location 1 of the keystore 1032, and stores the complete content of classkey2 in the storage location 2 of the keystore 1032, and then writes correspondingly in the operation memory 200
  • Instruction information 1 of classkey1 and storage location 1, and instruction information 2 of classkey2 and storage location 2, where classkey1 and classkey2 written in the operation memory 200 are group key identifiers.
  • the processor 101 can switch to the REE mode, and can still obtain the storage location information in the keystore 1032 corresponding to classkey1 and classkey2 from the running memory 200, respectively.
  • the processor 101 in the REE mode can send a read and write instruction to the storage controller 103 by running the file encryption module to read and write files from the data storage 300.
  • the embodiment of the present application provides the following three specific embodiments to further illustrate the storage controller 103 provided by the embodiment of the present application:
  • the process of encrypting and storing the file A in the data storage 300 may be as shown in FIG. 3, and mainly includes the following steps: S301: the processor 101 is File A generates a random number Ra. S302: The processor 101 sends the indication information of the random number Ra and the indication information of the file A to the storage controller 103.
  • the indication information of the random number Ra may include both the random number Ra and the address information of the random number Ra in the running memory 200.
  • the instruction information of the file A may include the address information of the file A in the running memory 200, for example, the start address of the file A and the data length of the file A.
  • multiple key sets may be stored in the key store 1032.
  • the processor 101 may also determine the group key a corresponding to the file A according to the type of the file A, and then determine the indication information of the group key a according to the correspondence between the group key identifier acquired in advance and the storage location information, and The instruction information of the group key a is sent to the storage controller 103.
  • the controller 1031 in the storage controller 103 receives the instruction information of the file A and the instruction information of the random number Ra sent by the processor 101, obtains the file A according to the instruction information of the file A, and obtains the random number according to the instruction information of the random number Ra Ra, and obtain the group key a from at least one group key stored in the keystore 1032.
  • the storage controller 103 can be connected to the operation controller 102 through the system interface 104, and thus can read and write to the operation memory 200.
  • the controller 1031 may determine the address information of the file A in the operation memory 200 according to the instruction information of the file A, and then obtain the file from the operation memory 200 through the system interface 104 A.
  • the indication information of the random number Ra includes the random number Ra, so that the controller 1031 can obtain the random number Ra from the indication information of the random number Ra.
  • the indication information of the random number Ra includes the address information of the random number Ra in the running memory 200, and after receiving the indication information of the random number Ra, the controller 1031 may use the indication of the random number Ra The information determines the address information of the random number Ra in the running memory 200, and then obtains the random number Ra from the running memory 200 through the system interface 104.
  • only one group key a may be stored in the key store 1032, and the controller 1031 may acquire the group key a in the key store 1032 by default.
  • multiple key sets may be stored in the keystore 1032.
  • the controller 1031 can receive the instruction information of the group key a sent by the processor 101, determine the storage location of the group key a in the keystore 1032 according to the instruction information of the group key a, and then obtain the group from the keystore 1032 Key a.
  • the key derivator 1033 calculates and obtains the file key RA according to the random number Ra and the group key a.
  • the key derivator 1033 may calculate and obtain the file key RA according to a preset derivation model.
  • the derivation model may be a key derivation function (KDF). It can be understood that, in the case where the encryption security requirement is not high, a simpler derived model can also be used to speed up the processing speed, which is not limited in this application.
  • S305 The file encryption and decryption device 1034 encrypts the file A using the file key RA to obtain the encrypted file AX.
  • S306 The data storage interface 1035 writes the file AX to the data storage 300.
  • the processor 101 may also send the destination address information of the file A in the data storage 300 to the storage controller 103.
  • the data storage interface 1035 writes the file AX to the data storage 300
  • the file A The destination address information in the data memory 300 writes the file AX to the location specified by the processor 101 in the data memory 300.
  • S307 The processor 101 sends the first instruction information to the controller 1031 in the storage controller 103.
  • Metadata is data used to record file attribute information, such as file storage address information, file format, etc.
  • the random number Ra generated by the processor 101 for the file A is also stored as the metadata of the file A.
  • the processor 101 may construct a data block including all metadata of the file A, and send the first indication information to the controller 1031, where the first indication information includes the address information of the data block According to the address information of the data block in the first instruction information, the storage controller 103 obtains the data block constructed by all the metadata of the file A from the operation memory 200 through the system interface 104 and stores the data block in the data storage 300 in.
  • the controller 1031 also writes the identifier of the group key a that will be assigned to the file A according to the first instruction information into the data storage 300 as metadata.
  • the processor 101 can generally perform block processing on the file in the running memory 200 to divide the file A into multiple data blocks. Therefore, in the embodiment of the present application, the address information of the file A may also include the address information of the multiple data blocks divided by the file A, that is, the start address of each data block and the data length of each data block.
  • the storage controller 103 may sequentially encrypt and store the multiple data blocks according to the address information of the multiple data blocks. This process is similar to the process shown in FIG. 3, and details are not described in this embodiment of the present application.
  • the processor 101 will also send the initial vector i corresponding to the file A and the index information of the initial vector i to the storage controller 103 to improve the security of the file block encryption.
  • the embodiments of the present application also provide a specific implementation manner of S305.
  • the storage controller 103 according to the embodiment of the present application provides a process of encrypting the file A in blocks according to the initial vector i.
  • the plain text [j] is any data block included in the file A that needs to be encrypted.
  • the controller 1031 in the storage controller 103 obtains the initial vector i provided by the processor 101 and the index information of the vector key; the controller 1031 obtains from the key store 1032 according to the index information of the vector key The vector key corresponding to the initial vector i, and the vector key is used to encrypt the initial vector.
  • the controller 1031 can encrypt the initial vector i through the AES encryption (AES-ENC) algorithm, and further process the encrypted initial vector i according to a [j] to obtain the processing After the initial vector i '.
  • j is the address parameter determined according to the address information of file A
  • a [j] is another parameter generated according to j
  • the specific implementation can refer to AES ciphertext stealing based on XOR-encrypt-xor (XEX) (Ciphertext Stealing, CTS) Adjustable encryption mode (AES-XEX-ciphertext stealing, AES-XTS), which will not be described in detail in the embodiments of the present application.
  • XEX XOR-encrypt-xor
  • the controller 1031 obtains the random number Ra according to the instruction information of the random number Ra, and obtains the group key a from the key store 1032.
  • the key derivator 1033 calculates the file key RA through the KDF algorithm based on the random number Ra and the group key a.
  • the file encryption / decryption device 1034 encrypts the plain text [j] based on the file key RA and the processed initial vector i '. According to AES, the file encryption and decryption device 1034 can initially encrypt the plaintext [j] through the AES-ENC algorithm, and then, according to the processed initial vector i ', further encrypt the initially encrypted plaintext [j] to obtain the ciphertext [j].
  • the file A written in the data storage 300 by the technical solution provided in the first embodiment can be read by the method shown in FIG. 4 and mainly includes the following steps: S501: Processing The controller 101 acquires the second instruction information and sends it to the controller 1031 of the storage controller 103. In the embodiment of the present application, the processor 101 may obtain the address information of the metadata of the file A in the data storage 300, and send the address information of the metadata of the file A in the data storage 300 to the controller through the second indication information 1031. S502: In the embodiment of the present application, the controller 1031 may obtain the address information of the metadata of the file A in the data storage 300 according to the second address information, and control the data storage interface 1035 to read the metadata of the file A from the data storage 300 data.
  • the second instruction information further includes the destination address of the metadata of the file A in the operation controller 200
  • the storage controller 103 may use the destination of the metadata of the file A in the operation controller 200 Address
  • the metadata of file A is written to the operation controller 200 through the system interface 104.
  • the processor 101 may then read the metadata of the file A from the running memory 200 according to the destination address of the metadata of the file A in the running memory 200.
  • the processor 101 determines the address information and random number Ra of the file AX in the data storage 300 from the metadata of the file A, and sends the instruction information of the file AX and the instruction of the random number Ra to the controller 1031 of the storage controller 103 information.
  • the indication information of the file AX includes the address information of the file AX in the data storage 300, and the implementation of the indication information of the random number Ra is similar to the first embodiment, and will not be described in detail.
  • the processor may also determine the identifier of the group key a corresponding to the file A according to the metadata of the file A, and then determine the group secret according to the correspondence between the group key identifier and the storage location The instruction information of the key a is sent to the controller 1031.
  • the controller 1031 obtains the file AX according to the instruction information of the file AX, obtains the random number Ra according to the instruction information of the random number Ra, and obtains the group key a from the key store 1032.
  • the controller 1031 can obtain the address information of the file AX in the data storage 300 according to the instruction information of the file AX, and then control the data storage interface 1035 to access the data storage according to the address information of the file AX in the data storage 300 Read file AX in 300.
  • the controller 1031 may also receive the indication information of the group key a sent by the processor 101, and obtain the group key a according to the indication information of the group key a.
  • S505 The key derivator 1033 calculates and obtains the file key RA according to the random number Ra and the group key a.
  • S506 The file encryption and decryption device 1034 decrypts the file AX using the file key RA to obtain the decrypted file A.
  • S507 The controller 1031 writes the decrypted file A to the running memory 200 through the system interface 104.
  • the processor 101 may also send the destination address information of the file A in the operation memory 200 to the controller 1031.
  • the controller 1031 may pass the system according to the destination address information of the file A in the operation memory 200.
  • the interface 104 writes the decrypted file A into the run memory 200. After that, the processor 101 can read the file A from the running memory 200.
  • the address information of the file AX may include the address information of multiple data blocks, and the controller 1031 may control the data memory according to the address information of the multiple data blocks
  • the interface 1035 reads multiple data blocks from the data storage 300. The subsequent process is similar to that shown in FIG. 5 and will not be repeated here.
  • the processor 101 also sends the initial vector i corresponding to the file A and the index information of the initial vector i to the storage controller 103 to decrypt the file AX stored in blocks.
  • the ciphertext [j] is any encrypted data block included in the file AX, and the storage controller 103 decrypts the ciphertext [j] according to the initial vector i.
  • the process of encrypting the plaintext [j] by the initial vector i is similar, the difference is that the file encryption and decryption device 1034 decrypts the ciphertext [j] according to the file key RA and the processed initial vector i ′.
  • the file encryption and decryption device 1034 can initially decrypt the ciphertext through the AES decryption (AES-DEC) algorithm [j], and then, according to the processed initial vector i, further decrypt the preliminary decrypted ciphertext [j] To obtain plain text [j].
  • AES-DEC AES decryption
  • the processor 101 may obtain the file through S501 and S502 in FIG. 5 A's metadata. After that, the steps shown in S302 to S306 are executed.
  • the indication information of the file A may be determined according to the processing logic of the file system running inside the processor 101. For example, if the file system stores the file A again in an alternative manner, the indication information of the file A may be the address information of the current file A in the running memory 200.
  • the storage controller 103 encrypts the file A to obtain AX And write AX to the data memory 300.
  • the indication information of the file A may be the address information of the update data of the file A in the operation memory 200, and in S303 to S306, the storage controller 103 encrypts the update data of the file A Process and write the updated data after the encryption process to the data memory 300.
  • the storage controller 103 when the storage controller 103 provided by the embodiment of the present application is used to read or write files to the data storage 300, the storage controller 103 uses its internal key derivation 1033 and key store 1032 Obtain the file key required to encrypt or decrypt the file. This process does not require the processor 101 to switch from the REE mode to the TEE mode, thereby reducing the resources of the processor 101 occupied by reading and writing encrypted stored files. Conducive to improving the efficiency of document processing under the premise of ensuring security.
  • the functions of the processor 101 may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software When implemented using software, it can be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application are generated in whole or in part.
  • the computer may be a general-purpose computer, a dedicated computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be from a website site, computer, server or data center Transmit to another website, computer, server or data center via wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device including a server, a data center, and the like integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)), or the like.
  • a magnetic medium for example, a floppy disk, a hard disk, a magnetic tape
  • an optical medium for example, a DVD
  • a semiconductor medium for example, a solid state disk (SSD)
  • the memory controller 103 in the above embodiment may include at least one of a logic circuit, a transistor, an analog circuit, or an algorithm circuit to implement a corresponding memory control function.
  • each component shown in FIG. 1 in the memory controller 103 may be a circuit module, including circuits for processing or operations, including but not limited to logic circuits, transistors, analog circuits, or algorithm circuits. At least one.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Software Systems (AREA)
  • Mathematical Physics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)

Abstract

一种存储控制器（103）包括：控制器（1031）、密钥库（1032）、密钥派生器（1033）、文件加解密装置（1034）、数据存储器接口（1035）。密钥库（1032），用于存储组密钥；控制器（1031），用于接收处理器（101）发送的待处理的文件的指示信息和随机数的指示信息，根据待处理的文件的指示信息获取待处理的文件，根据随机数的指示信息获取随机数，以及从密钥库（1032）存储的组密钥中获取第一组密钥；密钥派生器（1033），用于根据由控制器（1031）获取的随机数和第一组密钥计算获得文件密钥；文件加解密装置（1034），用于采用密钥派生器（1033）计算获得的文件密钥对待处理的文件进行处理得到处理后的文件；数据存储器接口（1035），用于向数据存储器（300）写入处理后的文件；或，从数据存储器（300）读取待处理的文件。

Description

一种存储控制器、文件处理方法、装置及系统 技术领域
本申请涉及文件存储控制技术领域，尤其涉及一种存储控制器、文件处理方法、装置及系统。
背景技术
当前，主流的电子设备存储系统中多采用文件加密方案存储文件。比较常见的文件加密方案为一个文件一个密钥(per file per key)的加密方案，不同的文件被不同的密钥加密保存于存储器中。此外，加密文件的密钥也会被另一密钥进行加密，例如，存在一密钥A用于加密文件，还存在另一密钥a用于加密密钥A，其中，密钥a可以称为组密钥(class key)。
文件的加密存储需要通过电子设备的处理器、存储控制器和存储器实现。其中，处理器的运行模式包括富操作系统运行环境(rich execution environment，REE)模式和可信执行环境(trust execute environment，TEE)模式。为了系统安全，通常只有TEE模式下的处理器可以获取并使用组密钥。在进行文件写入时，处理器需要先切换至TEE模式，使用组密钥对为文件配置的密钥A进行加密获得密文B，以及将密钥A配置于存储控制器中。之后，处理器切换至REE模式，再向存储控制器发送指令以指示存储控制器使用密钥A对文件进行加密，并将加密后的文件和密文B存储于存储器中。
在文件读取时，REE模式下的处理器需要先通过存储控制器从存储器中获取密文B，并切换至TEE模式。TEE模式下的处理器使用组密钥解密密文B从而获得密钥A，并将密钥A配置于存储控制器中。之后，处理器切换至REE模式，再向存储控制器发送指令以指示存储控制器从存储器中获取待读取的文件，并使用密钥A对所获取的文件进行解密，从而获取解密后的文件。
然而，在电子设备的使用过程中往往需要对大量的文件进行读写，致使处理器需要较为频繁地从REE模式切换至TEE模式，对密钥A使用组密钥进行加密，或对密文B使用组密钥进行解密，之后，再从TEE切换至REE模式。
REE模式与TEE模式之间的反复切换占用了处理器较多的处理资源，影响处理器处理其它任务的效率，从而对处理器的处理性能造成了一定的损失。
发明内容
本申请提供一种存储控制器、文件处理方法、装置及系统，用以在保证安全性前提下提高文件处理效率。
第一方面，本申请实施例提供一种存储控制器，包括：控制器、密钥库、密钥派生器、文件加解密装置、数据存储器接口；其中，密钥库，用于存储至少一个组密钥classkey；控制器，用于接收处理器发送的待处理的文件的指示信息和随机数的指示信息；之后，根据待处理的文件的指示信息获取待处理的文件，根据随机数的指示信息获取随机数；并从密钥库存储的至少一个组密钥中获取第一组密钥；密钥派生器，用于根据由控制器获取的随机数和第一组密钥计算获得文件密钥；文件加解密装置，用于采用密钥派生器计算获得的文件密钥对待处理的文件进行处理得到处理后的文件；数据存储器接口，用于向数据存 储器写入处理后的文件；或，从数据存储器读取待处理的文件。
在以上方案所提供的存储控制器中，密钥库存储至少一个组密钥，而密钥派生器又可以根据至少一个组密钥中的第一组密钥和处理器所提供的随机数产生文件密钥。使得，存储控制器可以根据处理器所提供的随机数自行产生用于文件加密或解密处理的文件密钥，不再需要处理器在读写文件时切换至TEE模式做处理，在保证安全性的前提下，有利于降低读写加密存储的文件对处理器带来的性能损失，提高处理效率。
基于第一方面，在一种可能的实现方式中，文件加解密装置，在采用密钥派生器计算获得的文件密钥对待处理的文件进行处理时，可以具体用于：采用上述文件密钥对待处理的文件进行加密处理得到处理后的文件；数据存储器接口，具体用于：向数据存储器写入处理后的文件。
基于第一方面，在一种可能的实现方式中，待处理的文件的指示信息包括待处理的文件在运行存储器中的地址信息；控制器，在根据待处理的文件的指示信息获取待处理的文件时，具体用于：根据地址信息，通过系统接口从运行存储器中读取待处理的文件。
基于第一方面，在一种可能的实现方式中，文件加解密装置，在采用文件密钥对待处理的文件进行处理时，具体用于：采用文件密钥对待处理的文件进行解密处理得到处理后的文件；数据存储器接口，具体用于：从数据存储器读取待处理的文件。
基于第一方面，在一种可能的实现方式中，待处理的文件的指示信息包括待处理的文件在数据存储器中的地址信息；控制器，在根据待处理的文件的指示信息获取待处理的文件时，具体用于：根据地址信息，控制数据存储器接口从数据存储器中读取待处理的文件。
基于第一方面，在一种可能的实现方式中，随机数的指示信息包括随机数；控制器，在根据随机数的指示信息获取随机数时，具体用于：获取随机数的指示信息中包括的随机数。
基于第一方面，在一种可能的实现方式中，随机数的指示信息包括随机数在运行存储器中的地址信息；控制器，在根据随机数的指示信息获取随机数时，具体用于：根据上述地址信息，通过系统接口从运行存储器中读取随机数。
基于第一方面，在一种可能的实现方式中，随机数的指示信息是处理器根据运行存储器中的随机数确定的；控制器，在接收处理器发送的待处理的文件的指示信息和随机数的指示信息之前，还用于：接收处理器发送的第二指示信息，根据第二指示信息控制数据存储器接口从数据存储器中读取待处理的文件的元数据，并通过系统接口将待处理的文件写入运行存储器；其中，待处理的文件的元数据包括随机数。
基于第一方面，在一种可能的实现方式中，控制器还用于：接收处理器发送的第一指示信息，并根据第一指示信息控制数据存储器接口将随机数作为待处理的文件的元数据写入数据存储器。
基于第一方面，在一种可能的实现方式中，控制器，在从密钥库存储的至少一个组密钥中获取第一组密钥时，具体用于：接收处理器发送的第一组密钥的指示信息；第一组密钥的指示信息用于指示第一组密钥在密钥库中的存储位置；根据第一组密钥的指示信息从密钥库中获取第一组密钥。
第二方面，本申请实施例提供一种文件处理方法，包括：存储控制器接收处理器发送的待处理的文件的指示信息和随机数的指示信息；之后，存储控制器根据待处理的文件的指示信息获取待处理的文件，根据随机数的指示信息获取随机数，以及从预先存储的至少 一个组密钥中获取第一组密钥；基于所获取的随机数和第一组密钥，存储控制器计算获得文件密钥；之后，存储控制器采用计算获得的文件密钥对待处理的文件进行处理得到处理后的文件。
基于第二方面，在一种可能的实现方式中，待处理的文件的指示信息包括待处理的文件在运行存储器中的地址信息；存储控制器在根据待处理的文件的指示信息获取待处理的文件时，可以根据地址信息从运行存储器中读取待处理的文件。
基于第二方面，在一种可能的实现方式中，存储控制器在采用文件密钥对待处理的文件进行处理得到处理后的文件时，可以采用文件密钥对待处理的文件进行解密处理得到处理后的文件；存储控制器在根据待处理的文件的指示信息获取待处理的文件时，可以根据待处理的文件的指示信息从数据存储器读取待处理的文件。
基于第二方面，在一种可能的实现方式中，待处理的文件的指示信息包括待处理的文件在数据存储器中的地址信息；存储控制器在从数据存储器读取待处理的文件时，可以根据地址信息从数据存储器中读取待处理的文件。
基于第二方面，在一种可能的实现方式中，随机数的指示信息包括随机数；存储控制器在根据随机数的指示信息获取随机数时，可以从随机数的指示信息中获取随机数。
基于第二方面，在一种可能的实现方式中，随机数的指示信息包括随机数在运行存储器中的地址信息；存储控制器在根据随机数的指示信息获取随机数时，可以根据地址信息从运行存储器中读取随机数。
基于第二方面，在一种可能的实现方式中，随机数的指示信息是处理器根据运行存储器中的随机数确定的；存储控制器在接收处理器发送的待处理的文件的指示信息和随机数的指示信息之前，还可以接收处理器发送的第二指示信息，根据第二指示信息从数据存储器中读取待处理的文件的元数据，并将待处理的文件写入运行存储器；其中，待处理的文件的元数据包括随机数。
基于第二方面，在一种可能的实现方式中，存储控制器还可以接收处理器发送的第一指示信息，并根据第一指示信息控制数据存储器接口将随机数作为待处理的文件的元数据写入数据存储器。
基于第二方面，在一种可能的实现方式中，存储控制器在从预先存储的至少一个组密钥中获取第一组密钥时，可以接收处理器发送的第一组密钥的指示信息；该第一组密钥的指示信息用于指示第一组密钥的存储位置；存储控制器根据第一组密钥的指示信息从预先存储的至少一个组密钥中获取第一组密钥。
第三方面，本申请实施例提供一种文件处理装置，包括处理器和如上述第一方面中任一项所提供的存储控制器；其中，处理器用于向存储控制器发送待处理的文件的指示信息和随机数的指示信息。
基于第三方面，在一种可能的实现方式中，处理器，在向存储控制器发送待处理的文件的指示信息和随机数的指示信息之前，还用于：为待处理的文件生成随机数；处理器，在为待处理的文件生成随机数之后，还用于：向存储控制器发送第一指示信息；第一指示信息用于指示存储控制器将随机数作为待处理的文件的元数据写入数据存储器。
基于第三方面，在一种可能的实现方式中，处理器，在向存储控制器发送待处理的文件的指示信息和随机数的指示信息之前，还用于：向存储控制器发送第二指示信息；第二指示信息用于指示存储控制器将待处理的文件的元数据写入运行存储器；查询运行存储 器，从待处理的文件的元数据中确定随机数。
基于第三方面，在一种可能的实现方式中，该装置还包括：与运行存储器对应的内存控制器；其中，内存控制器与存储控制器通过系统接口连接；内存控制器，用于从运行存储器读取待处理的文件，并通过系统接口将待处理的文件发送给存储控制器；或，通过系统接口从存储控制器接收处理后的文件，并将处理后的文件写入运行存储器。
第四方面，本申请实施例提供一种文件处理系统，包括如上述第三方面中任一项所提供的文件处理装置，以及数据存储器；其中，数据存储器与文件处理装置中的存储控制器连接。
附图说明
图1为本申请实施例提供的一种文件处理系统架构示意图；
图2为本申请实施例提供的一种处理器在密钥库中存储组密钥的过程示意图；
图3为本申请实施例提供的一种文件写入方法流程示意图之一；
图4为本申请实施例所提供的一种根据初始向量对数据块加解密处理的过程；
图5为本申请实施例提供的一种文件写入方法流程示意图之二。
具体实施方式
下面将结合附图对本发明作进一步地详细描述。
图1为本申请实施例提供的一种文件处理系统架构示意图，位于电子设备内，该电子设备包括但不限于终端或服务器。终端包括但不限于手机、膝上电脑、平板电脑、台式电脑或可穿戴设备。文件处理系统如图1所示，包括文件处理装置100、运行存储器200和数据存储器300。其中，文件处理装置100分别与运行存储器200和数据存储器300连接。需要说明的是，如无特别说明，本申请的各个实施例中的“连接”一词用来表示电性连接，包括但不限于通过导线直接相连和通过第三方器件间接相连。
在本申请实施例中，运行存储器200可以是掉电易失性存储器，例如可以为动态随机存取存储器(dynamic random access memory，DRAM)，常被作为系统内存，主要用于文件处理装置100从中快速读写数据。数据存储器300可以为非掉电易失性存储器，如通用闪存存储器(universal flash storage，UFS)、嵌入式多媒体卡(embedded multi-media card，eMMC)、非易失性内存主机控制器接口规范(non-volatile memory express，NVMe)存储器等。
在本申请实施例中，文件处理装置100可以为片上系统(system on chip，SOC)或包括多个芯片的系统。如图1所示，文件处理装置100包括处理器101、内存控制器102和存储控制器103，处理器101分别与内存控制器102和存储控制器103连接。其中，内存控制器102与运行存储器200连接，存储控制器103与数据存储器300连接。在一种可能的实现方式中，内存控制器102与存储控制器103之间还可以通过系统接口104连接。处理器101可以控制存储控制器103从数据存储器300中读取文件，并通过系统接口104，将读取的文件发送给内存控制器102，进而由内存控制器102将文件写入运行存储器200。处理器101还可以控制存储控制器103通过系统接口104，从内存控制器102获取运行存储器200中的待写入的文件，并将待写入的文件写入数据存储器300中。例如，系统接口 104是个系统总线或其他总线。
可以理解，对运行存储器200中的文件进行读取或写入皆需要通过内存控制器102实现。为了简化表述，本申请实施例中“将文件写入运行存储器200”和“从运行存储器200读取文件”的表述皆可以包括“通过内存控制器102将文件写入运行存储器200”和“通过内存控制器102从运行存储器200读取文件”的含义，以下不再赘述。
在处理器101控制存储控制器103从数据存储器300中读取的文件为加密存储的文件时，还需要存储控制器103对读取的文件进行解密处理获得解密后的文件，再将解密后的文件写入运行存储器200。与之类似的，在处理器101控制存储控制器103向数据存储器300中写入的文件为需要加密存储的文件时，还需要存储控制器103对待写入的文件进行加密处理获得加密后的文件，再将加密后的文件通过写入数据存储器300。
为了解决现有技术中存在的读写加密存储的文件对处理器的TEE模式做切换造成的性能损失的问题，本申请实施例提供了一种存储控制器，该存储控制器在对待处理的文件进行加密处理或解密处理时，可以使用预先存储的组密钥获取文件密钥，并利用所获取的文件密钥对待处理的文件进行加密或解密处理，从而可以省去处理器由REE模式切换至TEE模式，并使用组密钥计算文件密钥以及将文件密钥配置于存储控制器的过程，进而可以减少读写加密存储的文件所占用的处理器资源，有利于在保证安全性前提下提高文件处理效率。
基于以上构思，本申请实施例提供了一种可行的存储控制器结构，如图1所示。存储控制器103包括控制器1031、密钥库1032、密钥派生器1033、文件加解密装置1034、数据存储器接口1035。其中，密钥库1032，与处理器101相连，用于存储至少一个组密钥classkey。在本申请实施例中密钥库1032所存储的至少一个组密钥(class key)可以是在存储控制器103出厂前被直接写入密钥库1032的，也可以是由处理器101预先存储于密钥库1032中的。例如，处理器101在文件系统初始化阶段，如终端设备重启、系统设置还原之后等情况下，以密钥生成算法获取至少一个组密钥并将所获取的至少一个组密钥存储于密钥库1032中。密钥生成过程是现有技术，本申请不做赘述。
图2以classkey1和classkey2为例，示例性地示出了处理器101在密钥库1032中存储组密钥的过程。如图2所示，处理器101包括TEE和REE两种模式。处理器101在文件系统初始化阶段，通常默认处于REE模式。在REE模式下，处理器101通过运行其内部的文件加密模块，从数据存储器300和/或其它存储介质中获取classkey1的密文classkey1x和classkey2的密文classkey2x。之后，处理器101切换至TEE模式，通过运行密钥管理(key master)模块对classkey1x和classkey2x进行解密处理，从而获取classkey1和classkey2，并将获取的classkey1和classkey2存储于密钥库1032中。
一般，不同的组密钥会被用于对不同的文件密钥进行加密或解密，例如，classkey1被用于对用户文件的文件密钥进行加密或解密处理，classkey1的密文classkey1x是classkey1经固定参数加密后生成的，又例如，classkey2被用于对系统文件的文件密钥进行加密或解密处理，classkey2的密文classkey2x是classkey2经硬件唯一密钥(hardware unique key，HUK)和用户密码(如个人身份识别码(persional indentification number，pin))加密后生成的。基于此，如图2所示，TEE模式下的处理器101在解密classkey2x以获取classkey2时，还需要通过运行警卫(gate keeper)模块获取用户密码，以及从芯片熔丝(eFuse)中获取HUK。其中，eFuse是SOC中的常见元件，通常在SOC出厂时便烧录有该SOC独一 无二的HUK。
在本申请实施例中，TEE模式下的处理器101在将classkey1和classkey2存储于密钥库1032后，还可以将classkey1和classkey2在密钥库1032中存储位置信息与组密钥标识对应写入运行存储器200。例如，TEE模式下的处理器101在密钥库1032的存储位置1存储了classkey1的完整内容，在密钥库1032的存储位置2存储了classkey2的完整内容，则在运行存储器200中对应写入classkey1和存储位置1的指示信息1，以及，classkey2和存储位置2的指示信息2，其中，在运行存储器200中写入的classkey1和classkey2为组密钥标识。之后，处理器101便可以切换至REE模式，依旧可以从运行存储器200中获取classkey1和classkey2分别对应的在密钥库1032中存储位置信息。
经过以上配置之后，REE模式下的处理器101便可以通过运行文件加密模块向存储控制器103发送读写指令以从数据存储器300中读写文件。基于图1所示的存储控制器103，本申请实施例提供以下三个具体实施例以对本申请实施例所提供的存储控制器103进一步进行说明：
实施例1
假设待处理的文件A为处理器101在运行存储器200中首次生成的文件，则文件A加密存储于数据存储器300中的流程可以如图3所示，主要包括以下步骤：S301：处理器101为文件A生成随机数Ra。S302：处理器101向存储控制器103发送随机数Ra的指示信息和文件A的指示信息。其中，随机数Ra的指示信息既可以包括随机数Ra，也可以包括随机数Ra在运行存储器200中的地址信息。文件A的指示信息可以包括文件A在运行存储器200中的地址信息，例如，文件A的起始地址以及文件A的数据长度。在一种可能的实现方式中，密钥库1032中可以存储有多个组密钥。处理器101还可以根据文件A的类型确定文件A对应的组密钥a，进而根据预先获取的组密钥标识与存储位置信息之间的对应关系，确定组密钥a的指示信息，并将组密钥a的指示信息发送给存储控制器103。
S303：存储控制器103中的控制器1031接收处理器101发送的文件A的指示信息和随机数Ra的指示信息，根据文件A的指示信息获取文件A，根据随机数Ra的指示信息获取随机数Ra，以及，从密钥库1032所存储的至少一个组密钥中获取组密钥a。如图1所示，存储控制器103可以通过系统接口104与运行控制器102连接，进而可以实现对运行存储器200的读写。在本申请实施例中，控制器1031在接收到文件A的指示信息后，可以根据文件A的指示信息确定文件A在运行存储器200的地址信息，进而通过系统接口104从运行存储器200中获取文件A。
对于随机数Ra，在一种可能的实现方式中，随机数Ra的指示信息包括随机数Ra，以便控制器1031可以从随机数Ra的指示信息中获取随机数Ra。在另一种可能的实现方式中，随机数Ra的指示信息包括随机数Ra在运行存储器200中的地址信息，控制器1031在接收到随机数Ra的指示信息后，可以根据随机数Ra的指示信息确定随机数Ra在运行存储器200的地址信息，进而通过系统接口104从运行存储器200中获取随机数Ra。
在本申请实施例的一种可能的实现方式中，密钥库1032中可以只存储有一个组密钥a，则控制器1031可以默认获取密钥库1032中的组密钥a。在另一种可能的实现方式中，密钥库1032中可以存储有多个组密钥。控制器1031可以接收处理器101发送的组密钥a的指示信息，根据组密钥a的指示信息确定组密钥a在密钥库1032中的存储位置，进而从密 钥库1032中获取组密钥a。
S304：密钥派生器1033根据随机数Ra和组密钥a计算获得文件密钥RA。在本申请实施例中，密钥派生器1033可以根据预设的派生模型计算获得文件密钥RA。其中，派生模型可以是密钥导出函数(key derivation function，KDF)。可以理解，在加密安全性要求不高的情况下，也可以采用更为简单的派生模型以加快处理速度，本申请对此不作限定。
S305：文件加解密装置1034采用文件密钥RA对文件A进行加密处理，得到加密后的文件AX。S306：数据存储器接口1035将文件AX写入数据存储器300。在一种可能的实现方式中，处理器101还会向存储控制器103发送文件A在数据存储器300中的目的地址信息，数据存储器接口1035将文件AX写入数据存储器300时，可以根据文件A在数据存储器300中的目的地址信息将文件AX写入数据存储器300中处理器101指定的位置。
S307：处理器101向存储控制器103中的控制器1031发送第一指示信息。S308:控制器1031根据第一指示信息控制数据存储器接口1035将随机数Ra作为文件A的元数据写入数据存储器300。
元数据(metadata)是用来记录文件属性信息的数据，如文件的存储地址信息、文件格式等。在本申请实施例中，处理器101为文件A生成的随机数Ra也被作为文件A的元数据存储。在一种可能的实现方式中，处理器101可以构建一个包括文件A所有的元数据的数据块，并向控制器1031发送第一指示信息，第一指示信息中包括了该数据块的地址信息，存储控制器103根据第一指示信息中该数据块的地址信息，通过系统接口104从运行存储器200中获取文件A所有的元数据所构建的数据块，并将该数据块存储于数据存储器300中。在一种可能的实现方式中，控制器1031根据第一指示信息将为文件A分配的组密钥a的标识也作为元数据写入数据存储器300。
对于数据量较大的文件，处理器101通常可以在运行存储器200中对文件进行分块处理，将文件A分为多个数据块。因此在本申请实施例中文件A的地址信息也可以包括文件A所分为的多个数据块的地址信息，即每个数据块的起始地址以及每个数据块的数据长度。存储控制器103可以根据多个数据块的地址信息依次对多个数据块进行加密存储，该过程与图3所示过程类似，本申请实施例不再赘述。在一种可能的实现方式中，处理器101还会向存储控制器103发送文件A对应的初始向量i，以及初始向量i的索引信息，以提高文件分块加密的安全性。
基于文件分块加密，本申请实施例还提供一种S305的具体实现方式。结合图1，图4示出了本申请实施例所提供的存储控制器103根据初始向量i对文件A分块加密处理的过程。其中，明文[j]为文件A所包括的任一需要加密的数据块。如图4所示，存储控制器103中的控制器1031获取处理器101提供的初始向量i，以及向量密钥的索引信息；控制器1031根据向量密钥的索引信息从密钥库1032中获取初始向量i对应的向量密钥，并采用该向量密钥，对初始向量进行加密处理。根据高级加密标准(advanced encryption standard，AES)，控制器1031可以通过AES加密(AES encryption，AES-ENC)算法加密初始向量i，并根据a[j]进一步处理加密后的初始向量i，获得处理后的初始向量i’。其中，j是根据文件A的地址信息确定的地址参数，a[j]是根据j生成的另一个参数，具体实现可以参考AES基于异或加密(xor-encrypt-xor，XEX)的密文窃取(Ciphertext Stealing,CTS)可调加密模式(AES-XEX-ciphertext stealing，AES-XTS)，本申请实施例不多作赘述。
以及，控制器1031根据随机数Ra的指示信息获取随机数Ra，并从密钥库1032中获 取组密钥a。密钥派生器1033根据随机数Ra和组密钥a，通过KDF算法计算得到文件密钥RA。文件加解密装置1034根据文件密钥RA和处理后的初始向量i’，对明文[j]进行加密处理。根据AES，文件加解密装置1034可以通过AES-ENC算法初步加密明文[j]，之后，根据处理后的初始向量i’，进一步加密初步加密后的明文[j]，获得密文[j]。
实施例二
在读取数据存储器300中的文件时，对于通过实施例一所提供的技术方案写入数据存储器300的文件A，可通过如图4所示的方法读取，主要包括以下步骤：S501：处理器101获取第二指示信息，并发送给存储控制器103的控制器1031。在本申请实施例中，处理器101可以获取文件A的元数据的在数据存储器300中的地址信息，并通过第二指示信息将文件A的元数据在数据存储器300的地址信息发送给控制器1031。S502：在本申请实施例中，控制器1031可以根据第二地址信息获取获取文件A的元数据在数据存储器300中的地址信息，控制数据存储器接口1035从数据存储器300中读取文件A的元数据。
在一种可能的实现方式中，第二指示信息中还包括文件A的元数据在运行控制器200中的目的地址，存储控制器103可以根据文件A的元数据在运行控制器200中的目的地址，通过系统接口104将文件A的元数据写入运行控制器200。处理器101继而可以根据文件A的元数据在运行存储器200中的目的地址，从运行存储器200中读取文件A的元数据。
S503：处理器101从文件A的元数据中确定文件AX在数据存储器300中的地址信息和随机数Ra，并向存储控制器103的控制器1031发送文件AX的指示信息和随机数Ra的指示信息。其中，文件AX的指示信息包括文件AX在数据存储器300中的地址信息，随机数Ra的指示信息的实现方式与实施例一类似，不再赘述。在一种可能的实现方式中，处理器还可以根据文件A的元数据确定文件A对应的组密钥a的标识，进而根据组密钥的标识与存储位置之间的对应关系，确定组密钥a的指示信息，并发送给控制器1031。
S504：控制器1031根据文件AX的指示信息获取文件AX，根据随机数Ra的指示信息获取随机数Ra，从密钥库1032中获取组密钥a。在本申请实施例中，控制器1031可以根据文件AX的指示信息，获取文件AX在数据存储器300中的地址信息，进而控制数据存储器接口1035根据文件AX在数据存储器300中的地址信息从数据存储器300中读取文件AX。在一种可能的实现方式中，控制器1031还可以接收处理器101发送的组密钥a的指示信息，根据组密钥a的指示信息中获取组密钥a。
S505：密钥派生器1033根据随机数Ra和组密钥a计算获得文件密钥RA。S506：文件加解密装置1034采用文件密钥RA对文件AX进行解密处理，得到解密后的文件A。S507：控制器1031通过系统接口104将解密后的文件A写入运行存储器200。
在一种可能的实现方式中，处理器101还会向控制器1031发送文件A在运行存储器200中的目的地址信息，控制器1031可以根据文件A在运行存储器200中的目的地址信息，通过系统接口104将解密后的文件A写入运行存储器200。之后，处理器101便可以从运行存储器200中读取文件A。
可以理解，在文件AX分为多个数据块存储于数据存储器300时，文件AX的地址信息可以包括多个数据块的地址信息，控制器1031可以根据多个数据块的地址信息，控制数据存储器接口1035从数据存储器300中读取多个数据块，后续过程与图5所示类似，不再赘述。
在一种可能的实现方式中，处理器101还会向存储控制器103发送文件A对应的初始向量i，以及初始向量i的索引信息，以解密分块存储的文件AX。
如图4所示，密文[j]为文件AX所包括的任一经过加密的数据块，存储控制器103根据初始向量i对密文[j]解密处理的过程与上述存储控制器103根据初始向量i加密明文[j]的过程类似，区别在于，文件加解密装置1034根据文件密钥RA和处理后的初始向量i’，对密文[j]进行解密处理。根据AES，文件加解密装置1034可以通过AES解密(AES deciphering，AES-DEC)算法初步解密密文[j]，之后，根据处理后的初始向量i，进一步解密初步解密后的密文[j]，获得明文[j]。
实施例三
在再次存储曾经被存储于数据存储器300中的文件时，如再次存储通过实施例二所提供的技术方案从数据存储器300读取的文件A，处理器101可通过图5中S501和S502获取文件A的元数据。之后，执行S302至S306所示步骤。
可以理解，在实施例三的S302中，文件A的指示信息可以根据处理器101内部运行的文件系统的处理逻辑而定。例如，文件系统采用替换的方式再次存储文件A，则文件A的指示信息可以是当前文件A在运行存储器200中的地址信息，在S303至S306中，存储控制器103对文件A进行加密获得AX，并将AX写入数据存储器300。若采用更新的方式再次存储文件A，则文件A的指示信息可以是文件A的更新数据在运行存储器200中的地址信息，在S303至S306中，存储控制器103对文件A的更新数据进行加密处理并将加密处理后的更新数据写入数据存储器300。
通过以上实施例可见，在采用本申请实施例所提供的存储控制器103向数据存储器300读取或写入文件时，存储控制器103通过其内部的密钥派生器1033和密钥库1032自行获取对文件进行加密或解密处理时所需要的文件密钥，该过程不需要处理器101从REE模式切换至TEE模式，从而减少了读写加密存储的文件所占用的处理器101的资源，有利于在保证安全性前提下提高文件处理效率。
在上述实施例中，处理器101的功能可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。
以上实施例的存储控制器103可包括逻辑电路、晶体管、模拟电路、或算法电路中的至少一种以实现对应存储控制功能。例如，存储控制器103中的如图1所示的每个部件可 以是一个电路模块，包括用于处理或运算的电路，具体包括但不限于逻辑电路、晶体管、模拟电路、或算法电路中的至少一种。
尽管在此结合各实施例对本申请进行了描述，然而，在实施所要求保护的本发明过程中，本领域技术人员通过查看所述附图、公开内容、以及所附权利要求书，可理解并实现所述公开实施例的其他变化。在权利要求中，“包括”(comprising)一词不排除其他组成部分或步骤，“一”或“一个”不排除多个的情况。单个处理器或其他单元可以实现权利要求中列举的若干项功能。相互不同的从属权利要求中记载了某些措施，但这并不表示这些措施不能组合起来产生良好的效果。
尽管结合具体特征及其实施例对本发明进行了描述，显而易见的，在不脱离本发明的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本发明的示例性说明，且视为已覆盖本发明范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (25)

  1. 一种存储控制器，其特征在于，包括：控制器、密钥库、密钥派生器、文件加解密装置、数据存储器接口；
    所述密钥库，用于存储至少一个组密钥classkey；
    所述控制器，用于接收处理器发送的待处理的文件的指示信息和随机数的指示信息；根据所述待处理的文件的指示信息获取所述待处理的文件；根据所述随机数的指示信息获取所述随机数；从所述密钥库存储的至少一个组密钥中获取第一组密钥；
    所述密钥派生器，用于根据所述随机数和所述第一组密钥计算获得文件密钥；
    所述文件加解密装置，用于采用所述文件密钥对所述待处理的文件进行处理得到处理后的文件；
    所述数据存储器接口，用于向所述数据存储器写入所述处理后的文件；或，从所述数据存储器读取所述待处理的文件。
  2. 如权利要求1所述的存储控制器，其特征在于，所述文件加解密装置，在采用所述文件密钥对所述待处理的文件进行处理时，具体用于：采用所述文件密钥对所述待处理的文件进行加密处理得到所述处理后的文件；
    所述数据存储器接口，具体用于：向所述数据存储器写入所述处理后的文件。
  3. 如权利要求2所述的存储控制器，其特征在于，还包括：所述待处理的文件的指示信息包括所述待处理的文件在运行存储器中的地址信息；
    所述控制器，在根据所述待处理的文件的指示信息获取所述待处理的文件时，具体用于：根据所述地址信息，通过系统接口从所述运行存储器中读取所述待处理的文件。
  4. 如权利要求1所述的存储控制器，其特征在于，所述文件加解密装置，在采用所述文件密钥对所述待处理的文件进行处理时，具体用于：采用所述文件密钥对所述待处理的文件进行解密处理得到所述处理后的文件；
    所述数据存储器接口，具体用于：从所述数据存储器读取所述待处理的文件。
  5. 如权利要求4所述的存储控制器，其特征在于，所述待处理的文件的指示信息包括所述待处理的文件在所述数据存储器中的地址信息；
    所述控制器，在根据所述待处理的文件的指示信息获取所述待处理的文件时，具体用于：根据所述地址信息，控制所述数据存储器接口从所述数据存储器中读取所述待处理的文件。
  6. 如权利要求1至5中任一项所述的存储控制器，其特征在于，所述随机数的指示信息包括所述随机数；
    所述控制器，在根据所述随机数的指示信息获取随机数时，具体用于：获取所述随机数的指示信息中包括的所述随机数。
  7. 如权利要求1至5中任一项所述的存储控制器，其特征在于，所述随机数的指示信息包括所述随机数在所述运行存储器中的地址信息；
    所述控制器，在根据所述随机数的指示信息获取随机数时，具体用于：根据所述地址信息，通过系统接口从所述运行存储器中读取所述随机数。
  8. 如权利要求1至7中任一项所述的存储控制器，其特征在于，所述随机数的指示信息是所述处理器根据运行存储器中的随机数确定的；
    所述控制器，在接收处理器发送的待处理的文件的指示信息和随机数的指示信息之前，还用于：接收所述处理器发送的第二指示信息，根据所述第二指示信息控制所述数据存储器接口从所述数据存储器中读取所述待处理的文件的元数据，并通过系统接口将所述待处理的文件写入所述运行存储器；所述待处理的文件的元数据包括所述随机数。
  9. 如权利要求2或3所述的存储控制器，其特征在于，所述控制器还用于：接收所述处理器发送的第一指示信息，并根据所述第一指示信息控制所述数据存储器接口将所述随机数作为所述待处理的文件的元数据写入所述数据存储器。
  10. 如权利要求1至9中任一项所述的存储控制器，其特征在于，所述控制器，在从所述密钥库存储的至少一个组密钥中获取第一组密钥时，具体用于：
    接收所述处理器发送的第一组密钥的指示信息；所述第一组密钥的指示信息用于指示所述第一组密钥在所述密钥库中的存储位置；
    根据所述第一组密钥的指示信息从所述密钥库中获取所述第一组密钥。
  11. 一种文件处理方法，其特征在于，包括：
    存储控制器接收处理器发送的待处理的文件的指示信息和随机数的指示信息；
    所述存储控制器根据所述待处理的文件的指示信息获取所述待处理的文件，根据所述随机数的指示信息获取所述随机数，以及从预先存储的至少一个组密钥中获取第一组密钥；
    所述存储控制器根据所述随机数和所述第一组密钥计算获得文件密钥；
    所述存储控制器采用所述文件密钥对所述待处理的文件进行处理得到处理后的文件。
  12. 如权利要求11所述的方法，其特征在于，所述存储控制器采用所述文件密钥对所述待处理的文件进行处理得到处理后的文件，包括：所述存储控制器采用所述文件密钥对所述待处理的文件进行加密处理得到所述处理后的文件；
    所述存储控制器采用所述文件密钥对所述待处理的文件进行加密处理得到所述处理后的文件之后，还包括：所述存储控制器向数据存储器写入所述处理后的文件。
  13. 如权利要求12所述的方法，其特征在于，还包括：所述待处理的文件的指示信息包括所述待处理的文件在运行存储器中的地址信息；
    所述存储控制器根据所述待处理的文件的指示信息获取所述待处理的文件，包括：所述存储控制器根据所述地址信息，通过系统接口从运行存储器中读取所述待处理的文件。
  14. 如权利要求11所述的方法，其特征在于，所述存储控制器采用所述文件密钥对所述待处理的文件进行处理得到处理后的文件，包括：所述存储控制器采用所述文件密钥对所述待处理的文件进行解密处理得到所述处理后的文件；
    所述存储控制器根据所述待处理的文件的指示信息获取所述待处理的文件，包括：所述存储控制器根据所述待处理的文件的指示信息从所述数据存储器读取所述待处理的文件。
  15. 如权利要求14所述的方法，其特征在于，所述待处理的文件的指示信息包括所述待处理的文件在所述数据存储器中的地址信息；
    所述存储控制器从所述数据存储器读取所述待处理的文件，包括：所述存储控制器根据所述地址信息从所述数据存储器中读取所述待处理的文件。
  16. 如权利要求11至15中任一项所述的方法，其特征在于，所述随机数的指示信息 包括所述随机数；
    所述存储控制器根据所述随机数的指示信息获取所述随机数，包括：所述存储控制器获取所述随机数的指示信息中包括的所述随机数。
  17. 如权利要求11至15中任一项所述的方法，其特征在于，所述随机数的指示信息包括所述随机数在所述运行存储器中的地址信息；
    所述存储控制器根据所述随机数的指示信息获取所述随机数，包括：所述存储控制器根据所述地址信息，通过系统接口从所述运行存储器中读取所述随机数。
  18. 如权利要求11至17中任一项所述的方法，其特征在于，还包括：所述随机数的指示信息是所述处理器根据运行存储器中的随机数确定的；
    所述存储控制器接收处理器发送的待处理的文件的指示信息和随机数的指示信息之前，还包括：所述存储控制器接收所述处理器发送的第二指示信息，根据所述第二指示信息从所述数据存储器中读取所述待处理的文件的元数据，并通过系统接口将所述待处理的文件写入所述运行存储器；所述待处理的文件的元数据包括所述随机数。
  19. 如权利要求12或13所述的方法，其特征在于，所述方法还包括：所述存储控制器接收所述处理器发送的第一指示信息，并根据所述第一指示信息控制所述数据存储器接口将所述随机数作为所述待处理的文件的元数据写入所述数据存储器。
  20. 如权利要求11至19中任一项所述的方法，其特征在于，所述存储控制器从预先存储的至少一个组密钥中获取第一组密钥，包括：
    所述存储控制器接收所述处理器发送的第一组密钥的指示信息；所述第一组密钥的指示信息用于指示所述第一组密钥的存储位置；
    所述存储控制器根据所述第一组密钥的指示信息从所述预先存储的至少一个组密钥中获取所述第一组密钥。
  21. 一种文件处理装置，其特征在于，包括处理器和如权利要求1至10中任一项所述的存储控制器；
    其中，所述处理器，用于向所述存储控制器发送待处理的文件的指示信息和随机数的指示信息。
  22. 如权利要求21所述的装置，其特征在于，所述处理器，在向所述存储控制器发送待处理的文件的指示信息和随机数的指示信息之前，还用于：为所述待处理的文件生成所述随机数；
    所述处理器，在为所述待处理的文件生成所述随机数之后，还用于：向所述存储控制器发送第一指示信息；所述第一指示信息用于指示所述存储控制器将所述随机数作为所述待处理的文件的元数据写入所述数据存储器。
  23. 如权利要求21所述的装置，其特征在于，所述处理器，在向所述存储控制器发送待处理的文件的指示信息和随机数的指示信息之前，还用于：向所述存储控制器发送第二指示信息；所述第二指示信息用于指示所述存储控制器将所述待处理的文件的元数据写入运行存储器；查询所述运行存储器，从所述待处理的文件的元数据中确定所述随机数。
  24. 如权利要求21所述的装置，其特征在于，还包括：与运行存储器对应的内存控制器；所述内存控制器与所述存储控制器通过系统接口连接；
    所述内存控制器，用于从所述运行存储器读取待处理的文件，并通过所述系统接口将 所述待处理的文件发送给所述存储控制器；
    或，通过所述系统接口从所述存储控制器接收处理后的文件，并将所述处理后的文件写入所述运行存储器。
  25. 一种文件处理系统，其特征在于，包括如权利要求21至24中任一项所述的文件处理装置，以及所述数据存储器；
    所述数据存储器与所述文件处理装置中的存储控制器连接。
PCT/CN2018/114445 2018-11-07 2018-11-07 一种存储控制器、文件处理方法、装置及系统 WO2020093290A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP18939551.0A EP3848837A4 (en) 2018-11-07 2018-11-07 MEMORY CONTROL AND FILE PROCESSING METHODS, DEVICE AND SYSTEM
CN201880082681.7A CN111512308A (zh) 2018-11-07 2018-11-07 一种存储控制器、文件处理方法、装置及系统
PCT/CN2018/114445 WO2020093290A1 (zh) 2018-11-07 2018-11-07 一种存储控制器、文件处理方法、装置及系统
US17/231,869 US20210232509A1 (en) 2018-11-07 2021-04-15 Storage Controller, And File Processing Method, Apparatus, And System

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2018/114445 WO2020093290A1 (zh) 2018-11-07 2018-11-07 一种存储控制器、文件处理方法、装置及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/231,869 Continuation US20210232509A1 (en) 2018-11-07 2021-04-15 Storage Controller, And File Processing Method, Apparatus, And System

Publications (1)

Publication Number Publication Date
WO2020093290A1 true WO2020093290A1 (zh) 2020-05-14

Family

ID=70612400

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/114445 WO2020093290A1 (zh) 2018-11-07 2018-11-07 一种存储控制器、文件处理方法、装置及系统

Country Status (4)

Country Link
US (1) US20210232509A1 (zh)
EP (1) EP3848837A4 (zh)
CN (1) CN111512308A (zh)
WO (1) WO2020093290A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113596031B (zh) * 2021-07-29 2023-08-25 深圳市共进电子股份有限公司 电缆调制解调器、信息保护方法和可读存储介质
US11620393B1 (en) * 2022-05-14 2023-04-04 Aswath Premaradj System and method for facilitating distributed peer to peer storage of data

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105825135A (zh) * 2016-03-18 2016-08-03 深圳芯启航科技有限公司 一种加密芯片、加密系统、加密方法及解密方法
CN107533514A (zh) * 2015-09-30 2018-01-02 慧与发展有限责任合伙企业 存储器内容的基于密码的初始化
CN107590402A (zh) * 2017-09-26 2018-01-16 杭州中天微系统有限公司 一种存储数据加解密装置及方法
CN108259162A (zh) * 2016-12-28 2018-07-06 航天信息股份有限公司 一种密钥存储方法
CN108369626A (zh) * 2015-12-21 2018-08-03 惠普发展公司，有限责任合伙企业 密钥生成信息树

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4238854A (en) * 1977-12-05 1980-12-09 International Business Machines Corporation Cryptographic file security for single domain networks
US6249866B1 (en) * 1997-09-16 2001-06-19 Microsoft Corporation Encrypting file system and method
US7281010B2 (en) * 2000-11-15 2007-10-09 Lenovo (Singapore) Pte. Ltd. Trusted computing platform with dual key trees to support multiple public/private key systems
US8433901B2 (en) * 2010-04-07 2013-04-30 Apple Inc. System and method for wiping encrypted data on a device having file-level content protection
CN105812332A (zh) * 2014-12-31 2016-07-27 北京握奇智能科技有限公司 数据保护方法
US20170337390A1 (en) * 2016-05-18 2017-11-23 Qualcomm Incorporated Data protection at factory reset
CN106997439B (zh) * 2017-04-01 2020-06-19 北京元心科技有限公司 基于TrustZone的数据加解密方法、装置及终端设备
CN108599930B (zh) * 2018-04-02 2021-05-14 湖南国科微电子股份有限公司 固件加解密系统与方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107533514A (zh) * 2015-09-30 2018-01-02 慧与发展有限责任合伙企业 存储器内容的基于密码的初始化
CN108369626A (zh) * 2015-12-21 2018-08-03 惠普发展公司，有限责任合伙企业 密钥生成信息树
CN105825135A (zh) * 2016-03-18 2016-08-03 深圳芯启航科技有限公司 一种加密芯片、加密系统、加密方法及解密方法
CN108259162A (zh) * 2016-12-28 2018-07-06 航天信息股份有限公司 一种密钥存储方法
CN107590402A (zh) * 2017-09-26 2018-01-16 杭州中天微系统有限公司 一种存储数据加解密装置及方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3848837A4 *

Also Published As

Publication number Publication date
CN111512308A (zh) 2020-08-07
EP3848837A4 (en) 2021-08-25
US20210232509A1 (en) 2021-07-29
EP3848837A1 (en) 2021-07-14

Similar Documents

Publication Publication Date Title
US11809584B2 (en) File system metadata protection
US9569633B2 (en) Device, system, and method for processor-based data protection
JP2019505924A (ja) 周辺コンポーネント相互接続エクスプレス（ＰＣＩｅ）システムのためのインライン暗号エンジン（ＩＣＥ）
US20100229004A1 (en) Protection of security parameters in storage devices
WO2016146013A1 (zh) 在数字内容设备中在线写入应用密钥的方法、装置及系统
KR20150143708A (ko) 스토리지 디바이스 보조 인라인 암호화 및 암호해독
US11941108B2 (en) Authentication and control of encryption keys
WO2019114451A1 (zh) 一种基于可信执行环境的密钥烧录系统及方法
WO2021129557A1 (zh) 一种文件加密方法及相关装置
US11405202B2 (en) Key processing method and apparatus
US20210232509A1 (en) Storage Controller, And File Processing Method, Apparatus, And System
WO2019223098A1 (zh) 一种文件的读写方法及设备
JP2007108833A (ja) 複数パスワード記憶装置及びパスワード管理方法
TW202008744A (zh) 動態密碼密鑰擴展
CN114764512A (zh) 加密密钥管理
CN113449349A (zh) 平台安全机制
US20200076591A1 (en) Systems and Methods for Automated Generation and Update of Cipher Parameters
US11816228B2 (en) Metadata tweak for channel encryption differentiation
US20220123932A1 (en) Data storage device encryption
TW201447634A (zh) 保護儲存媒介資料的方法及其媒體存取裝置
US20230208821A1 (en) Method and device for protecting and managing keys
US11861374B2 (en) Batch transfer of commands and data in a secure computer system
US11995223B2 (en) Data storage device encryption
TW202036349A (zh) 電腦系統及其虛擬硬碟的加解密方法
JP2010193341A (ja) 情報処理装置及び改竄無効化回路

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18939551

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2018939551

Country of ref document: EP

Effective date: 20210408

NENP Non-entry into the national phase

Ref country code: DE