Patent Description:
Currently, a file encryption solution is usually used to store a file in a mainstream electronic device storage system. A common file encryption solution is a per file per key (per file per key) encryption solution. Different files are encrypted by using different keys and stored in a memory. In addition, the key for encrypting the file may also be encrypted by another key. For example, a key A is used to encrypt a file, and another key a is used to encrypt the key A. The key a may be referred to as a classkey.

Encrypted storage of the file needs to be implemented by using a processor, a storage controller, and a memory of an electronic device. A running mode of the processor includes a rich execution environment (REE) mode and a trusted execution environment (TEE) mode. To ensure system security, only a processor in the TEE mode can obtain and use the classkey. When writing a file, the processor needs to first switch to the TEE mode, encrypt, by using the classkey, the key A configured for the file to obtain a ciphertext B, and configure the key A in the storage controller. Then, the processor switches to the REE mode, and then sends an instruction to the storage controller to instruct the storage controller to encrypt the file by using the key A and store the encrypted file and the ciphertext B in the memory.

During file reading, the processor in the REE mode needs to first obtain the ciphertext B from the memory through the storage controller, and switch to the TEE mode. The processor in the TEE mode uses the classkey to decrypt the ciphertext B to obtain the key A, and configures the key A in the storage controller. Then, the processor switches to the REE mode, and then sends an instruction to the storage controller to instruct the storage controller to obtain the to-be-read file from the memory, and decrypts the obtained file by using the key A, to obtain the decrypted file.

However, in a process of using the electronic device, a large quantity of files usually need to be read and written. Consequently, the processor needs to frequently switch from the REE mode to the TEE mode, encrypt the key A by using the classkey, or decrypt the ciphertext B by using the classkey, and then switch from the TEE mode to the REE mode.

Repeated switching between the REE mode and the TEE mode occupies a relatively large quantity of processing resources of the processor, and affects efficiency of processing another task by the processor. Consequently, processing performance of the processor is affected to some extent.

Chinese patent application <CIT> discloses a data protection method comprising the steps that a client application receives to-be-encrypted data transmitted by a a mobile equipment or a third application, and transmits the to-be-encrypted to a trustable application. The trustable application is used for the encryption of the to-be-encrypted data through employing a secret key stored in a trustable storage of a trustable execution environment, and enables the encrypted data to be transmitted to the client application. The client application enables the encrypted data to be transmitted to the corresponding mobile equipment or third side application.

Chinese patent application <CIT> discloses data encryption and decryption methods comprising class keys that are decrypted according to a main key pre-stored in a trusted execution environment by a trusted application. <CIT> discloses a further method for protecting information stored on a computing device. US patent document <CIT> constitutes relevant prio art.

This application provides a storage controller, and a file processing method, apparatus, and system, to improve file processing efficiency while ensuring security.

According to a first aspect, the embodiments of this application provide a storage controller, including: a controller, a keystore, a key generator, a file cryptography device, and a data memory interface. The keystore is configured to store at least one classkey. The controller is configured to: receive indication information of a to-be-processed file and indication information of a random number that are sent by a processor; then, obtain the to-be-processed file based on the indication information of the to-be-processed file; obtain the random number based on the indication information of the random number; and obtain a first classkey from the at least one classkey stored in the keystore. The key generator is configured to calculate a file key based on the random number and the first classkey that are obtained by the controller. The file cryptography device is configured to process the to-be-processed file by using the file key calculated by the key generator to obtain a processed file. The data memory interface is configured to write the processed file into a data memory, or read the to-be-processed file from the data memory.

In the storage controller provided in the foregoing solution, the keystore stores at least one classkey, and the key generator may generate the file key based on the first classkey in the at least one classkey and the random number provided by the processor. In this way, the storage controller may automatically generate, based on the random number provided by the processor, the file key used for file encryption or decryption processing. The processor does not need to switch to a TEE mode for processing when reading or writing a file. This helps reduce a performance loss caused to the processor by reading or writing the encrypted file on a premise of ensuring security, and improves processing efficiency.

Based on the first aspect, in a possible implementation, when processing the to-be-processed file by using the file key calculated by the key generator to obtain a processed file, the file cryptography device may be specifically configured to encrypt the to-be-processed file by using the file key to obtain the processed file. The data memory interface is specifically configured to write the processed file into the data memory.

Based on the first aspect, in a possible implementation, the indication information of the to-be-processed file includes address information of the to-be-processed file in a runtime memory. When obtaining the to-be-processed file based on the indication information of the to-be-processed file, the controller is specifically configured to read the to-be-processed file from the runtime memory through a system interface based on the address information.

Based on the first aspect, in a possible implementation, when processing the to-be-processed file by using the file key, the file cryptography device is specifically configured to encrypt the to-be-processed file by using the file key to obtain the processed file. The data memory interface is specifically configured to read the to-be-processed file from the data memory.

Based on the first aspect, in a possible implementation, the indication information of the to-be-processed file includes address information of the to-be-processed file in the data memory. When obtaining the to-be-processed file based on the indication information of the to-be-processed file, the controller is specifically configured to control the data memory interface to read the to-be-processed file from the data memory based on the address information.

Based on the first aspect, in a possible implementation, the indication information of the random number includes the random number. When obtaining the random number based on the indication information of the random number, the controller is specifically configured to obtain the random number included in the indication information of the random number.

Based on the first aspect, in a possible implementation, the indication information of the random number includes address information of the random number in the runtime memory. When obtaining the random number based on the indication information of the random number, the controller is specifically configured to read the random number from the runtime memory through the system interface based on the address information.

Based on the first aspect, in a possible implementation, the indication information of the random number is determined by the processor based on the random number in the runtime memory. Before receiving the indication information of the to-be-processed file and the indication information of the random number that are sent by the processor, the controller is further configured to: receive second indication information sent by the processor; control, based on the second indication information, the data memory interface to read metadata of the to-be-processed file from the data memory; and write the to-be-processed file into the runtime memory through the system interface, where the metadata of the to-be-processed file includes the random number.

Based on the first aspect, in a possible implementation, the controller is further configured to: receive first indication information sent by the processor; and control, based on the first indication information, the data memory interface to write the random number into the data memory as metadata of the to-be-processed file.

Based on the first aspect, in a possible implementation, when obtaining the first classkey from the at least one classkey stored in the keystore, the controller is specifically configured to: receive indication information of the first classkey sent by the processor, where the indication information of the first classkey is used to indicate a storage location of the first classkey in the keystore; and obtain the first classkey from the keystore based on the indication information of the first classkey.

According to a second aspect, the embodiments of this application provide a file processing method, including: receiving, by a storage controller, indication information of a to-be-processed file and indication information of a random number that are sent by a processor; then, obtaining, by the storage controller, the to-be-processed file based on the indication information of the to-be-processed file, obtaining the random number based on the indication information of the random number, and obtaining a first classkey from at least one pre-stored classkey; calculating, by the storage controller, a file key based on the obtained random number and the first classkey; and then, processing, by the storage controller, the to-be-processed file by using the calculated file key to obtain a processed file.

Based on the second aspect, in a possible implementation, the indication information of the to-be-processed file includes address information of the to-be-processed file in a runtime memory. When obtaining the to-be-processed file based on the indication information of the to-be-processed file, the storage controller may read the to-be-processed file from the runtime memory based on the address information.

Based on the second aspect, in a possible implementation, when processing the to-be-processed file by using the file key to obtain a processed file, the storage controller may decrypt the to-be-processed file by using the file key to obtain the processed file. When obtaining the to-be-processed file based on the indication information of the to-be-processed file, the storage controller may read the to-be-processed file from a data memory based on the indication information of the to-be-processed file.

Based on the second aspect, in a possible implementation, the indication information of the to-be-processed file includes address information of the to-be-processed file in the data memory. When reading the to-be-processed file from the data memory, the storage controller may read the to-be-processed file from the data memory based on the address information.

Based on the second aspect, in a possible implementation, the indication information of the random number includes the random number. When obtaining the random number based on the indication information of the random number, the storage controller may obtain the random number from the indication information of the random number.

Based on the second aspect, in a possible implementation, the indication information of the random number includes address information of the random number in the runtime memory. When obtaining the random number based on the indication information of the random number, the storage controller may read the random number from the runtime memory based on the address information.

Based on the second aspect, in a possible implementation, the indication information of the random number is determined by the processor based on the random number in the runtime memory. Before receiving the indication information of the to-be-processed file and the indication information of the random number that are sent by the processor, the storage controller may further receive second indication information sent by the processor; read metadata of the to-be-processed file from the data memory based on the second indication information; and write the to-be-processed file into the runtime memory, where the metadata of the to-be-processed file includes the random number.

Based on the second aspect, in a possible implementation, the storage controller may further receive first indication information sent by the processor; and control, based on the first indication information, the data memory interface to write the random number into the data memory as metadata of the to-be-processed file.

Based on the second aspect, in a possible implementation, when obtaining the first classkey from at least one pre-stored classkey, the storage controller may receive indication information of the first classkey sent by the processor. The indication information of the first classkey is used to indicate a storage location of the first classkey. The storage controller obtains the first classkey from the at least one pre-stored classkey based on the indication information of the first classkey.

According to a third aspect, the embodiments of this application provide a file processing apparatus, including a processor and the storage controller according to any one of the first aspect. The processor is configured to send indication information of a to-be-processed file and indication information of a random number to the storage controller.

Based on the third aspect, in a possible implementation, before sending the indication information of the to-be-processed file and the indication information of the random number to the storage controller, the processor is further configured to generate the random number for the to-be-processed file. After generating the random number for the to-be-processed file, the processor is further configured to send first indication information to the storage controller. The first indication information is used to indicate the storage controller to write the random number into a data memory as metadata of the to-be-processed file.

Based on the third aspect, in a possible implementation, before sending the indication information of the to-be-processed file and the indication information of the random number to the storage controller, the processor is further configured to: send second indication information to the storage controller, where the second indication information is used to indicate the storage controller to write metadata of the to-be-processed file into a runtime memory; query the runtime memory; and determine the random number from the metadata of the to-be-processed file.

Based on the third aspect, in a possible implementation, the apparatus further includes a memory controller corresponding to a runtime memory. The memory controller is connected to the storage controller through a system interface. The memory controller is configured to: read the to-be-processed file from the runtime memory, and send the to-be-processed file to the storage controller through the system interface; or receive a processed file from the storage controller through the system interface, and write the processed file into the runtime memory.

According to a fourth aspect, the embodiments of this application provide a file processing system, including the file processing apparatus according to any one of the third aspect and a data memory. The data memory is connected to a storage controller in the file processing apparatus.

The following further describes the present invention in detail with reference to the accompanying drawings.

<FIG> is a schematic architectural diagram of a file processing system according to the embodiments of this application. The file processing system is located in an electronic device, and the electronic device includes but is not limited to a terminal or a server. The terminal includes but is not limited to a mobile phone, a laptop computer, a tablet computer, a desktop computer, or a wearable device. As shown in <FIG>, the file processing system includes a file processing apparatus <NUM>, a runtime memory <NUM>, and a data memory <NUM>. The file processing apparatus <NUM> is connected to the runtime memory <NUM> and the data memory <NUM>. It should be noted that, unless otherwise specified, the term "connection" in the embodiments of this application is used to indicate an electrical connection, including but not limited to a direct connection through a wire and an indirect connection through a third-party component.

In the embodiments of this application, the runtime memory <NUM> may be a volatile memory, for example, may be a dynamic random access memory (DRAM), is usually used as a system memory, and is mainly used by the file processing apparatus <NUM> to quickly read data from the runtime memory <NUM> or write data into the runtime memory <NUM>. The data memory <NUM> may be a non-volatile memory, such as a universal flash storage (UFS), an embedded multimedia card (eMMC), or a non-volatile memory express (NVMe) storage.

In the embodiments of this application, the file processing apparatus <NUM> may be a system on chip (SOC) or a system including a plurality of chips. As shown in <FIG>, the file processing apparatus <NUM> includes a processor <NUM>, a memory controller <NUM>, and a storage controller <NUM>. The processor <NUM> is connected to the memory controller <NUM> and the storage controller <NUM>. The memory controller <NUM> is connected to the runtime memory <NUM>, and the storage controller <NUM> is connected to the data memory <NUM>. In a possible implementation, the memory controller <NUM> and the storage controller <NUM> may be further connected through a system interface <NUM>. The processor <NUM> may control the storage controller <NUM> to read a file from the data memory <NUM>, and send the read file to the memory controller <NUM> through the system interface <NUM>, so that the memory controller <NUM> writes the file into the runtime memory <NUM>. The processor <NUM> may further control the storage controller <NUM> to obtain, from the memory controller <NUM> through the system interface <NUM>, a to-be-written file in the runtime memory <NUM>, and write the to-be-written file into the data memory <NUM>. For example, the system interface <NUM> is a system bus or another bus.

It may be understood that reading or writing a file in the runtime memory <NUM> needs to be implemented through the memory controller <NUM>. For ease of description, in the embodiments of this application, expressions of "writing the file into the runtime memory <NUM>" and "reading the file from the runtime memory <NUM>" may include meanings of "writing the file into the runtime memory <NUM> through the memory controller <NUM>" and "reading the file from the runtime memory <NUM> through the memory controller <NUM>" respectively. Details are not described below again.

When the file read, from the data memory <NUM>, by the storage controller <NUM> under control of the processor <NUM> is an encrypted stored file, the storage controller <NUM> further needs to decrypt the read file to obtain a decrypted file, and then write the decrypted file into the runtime memory <NUM>. Similarly, when the file written, into the data memory <NUM>, by the storage controller <NUM> under control of the processor <NUM> is a file that needs to be encrypted for storage, the storage controller <NUM> further needs to encrypt the to-be-written file to obtain an encrypted file, and then write the encrypted file into the data memory <NUM>.

To resolve a problem that a performance loss is caused by switching a TEE mode of a processor for reading and writing an encrypted stored file in the prior art, the embodiments of this application provide a storage controller. When encrypting or decrypting a to-be-processed file, the storage controller may obtain a file key by using a pre-stored classkey, and encrypt or decrypt the to-be-processed file by using the obtained file key. In this way, the processor does not need to switch from an REE mode to the TEE mode, and a process of calculating the file key by using the classkey and configuring the file key in the storage controller can be saved. Therefore, processor resources occupied by reading and writing an encrypted stored file can be reduced, thereby helping improve file processing efficiency on a premise of ensuring security.

Based on the foregoing concept, the embodiments of this application provide a feasible storage controller structure, as shown in <FIG>. The storage controller <NUM> includes a controller <NUM>, a keystore <NUM>, a key generator <NUM>, a file cryptography device <NUM>, and a data memory interface <NUM>. The keystore <NUM> is connected to the processor <NUM>, and is configured to store at least one classkey. In the embodiments of this application, the at least one classkey stored in the keystore <NUM> may be directly written into the keystore <NUM> before the storage controller <NUM> is delivered from a factory, or may be pre-stored in the keystore <NUM> by the processor <NUM>. For example, in a file system initialization phase, for example, after a terminal device is restarted or a system setting is restored, the processor <NUM> obtains at least one classkey by using a key generation algorithm, and stores the obtained at least one classkey in the keystore <NUM>. A key generation process pertains to the prior art, and details are not described in this application.

<FIG> shows an example of a process in which the processor <NUM> stores the classkey in the keystore <NUM> by using classkey <NUM> and classkey <NUM> as an example. As shown in <FIG>, the processor <NUM> includes two modes: TEE and REE. In a file system initialization phase, the processor <NUM> is generally in the REE mode by default. In the REE mode, the processor <NUM> obtains, from the data memory <NUM> and/or another storage medium by running a file encryption module inside the processor <NUM>, a ciphertext of the classkey <NUM>, namely classkey 1x, and a ciphertext of the classkey <NUM>, namely classkey 2x. Then, the processor <NUM> switches to the TEE mode, decrypts the classkey 1x and the classkey 2x by running a keymaster module, to obtain the classkey <NUM> and the classkey <NUM>, and stores the obtained classkey <NUM> and classkey <NUM> in the keystore <NUM>.

Usually, different classkeys are used to encrypt or decrypt different file keys. For example, the classkey <NUM> is used to encrypt or decrypt a file key of a user file, and the ciphertext of the classkey <NUM>, namely classkey 1x, is generated after the classkey <NUM> is encrypted by using a fixed parameter. For another example, the classkey <NUM> is used to encrypt or decrypt a file key of a system file, and the ciphertext of the classkey <NUM>, namely classkey 2x, is generated after the classkey <NUM> is encrypted by using a hardware unique key (HUK) and a user password (for example, a personal identification number (pin)). Based on this, as shown in <FIG>, when decrypting the classkey 2x to obtain the classkey <NUM>, the processor <NUM> in the TEE mode further needs to obtain the user password by running a gatekeepermodule, and obtain the HUK from an efuse. The eFuse is a common component in SOC, and is usually burnt with a unique HUK of the SOC when the SOC is delivered from a factory.

In the embodiments of this application, after storing the classkey <NUM> and the classkey <NUM> in the keystore <NUM>, the processor <NUM> in the TEE mode may further write storage location information of the classkey <NUM> and the classkey <NUM> in the keystore <NUM> and classkey identifiers into the runtime memory <NUM> correspondingly. For example, if the processor <NUM> in the TEE mode stores complete content of the classkey <NUM> in a storage location <NUM> of the keystore <NUM>, and stores complete content of the classkey <NUM> in a storage location <NUM> of the keystore <NUM>, the classkey <NUM> and indication information <NUM> of the storage location <NUM>, and the classkey <NUM> and indication information <NUM> of the storage location <NUM> are correspondingly written into the runtime memory <NUM>. The classkey <NUM> and the classkey <NUM> written into the runtime memory <NUM> are the classkey identifiers. Afterwards, the processor <NUM> may switch to the REE mode, and may still obtain, from the runtime memory <NUM>, the storage location information corresponding to the classkey <NUM> and the classkey <NUM> in the keystore <NUM>.

After the foregoing configuration, the processor <NUM> in the REE mode may send a read/write instruction to the storage controller <NUM> by running the file encryption module, to read a file from the data memory <NUM> or write a file into the data memory <NUM>. Based on the storage controller <NUM> shown in <FIG>, the embodiments of this application provide the following three specific embodiments to further describe the storage controller <NUM> provided in the embodiments of this application.

Assuming that a to-be-processed file A is a file generated by the processor <NUM> for the first time in the runtime memory <NUM>, a procedure of encrypting and storing the file A in the data memory <NUM> may be shown in <FIG>, and mainly includes the following steps: S301: The processor <NUM> generates a random number Ra for the file A. S302: The processor <NUM> sends indication information of the random number Ra and indication information of the file A to the storage controller <NUM>. The indication information of the random number Ra may include not only the random number Ra, but also address information of the random number Ra in the runtime memory <NUM>. The indication information of the file A may include address information of the file A in the runtime memory <NUM>, for example, a start address of the file A and a data length of the file A. In a possible implementation, the keystore <NUM> may store a plurality of classkeys. The processor <NUM> may further determine, based on a type of the file A, a classkey a corresponding to the file A, further determine indication information of the classkey a based on a pre-obtained correspondence between a classkey identifier and storage location information, and send the indication information of the classkey a to the storage controller <NUM>.

S303: The controller <NUM> in the storage controller <NUM> receives the indication information of the file A and the indication information of the random number Ra that are sent by the processor <NUM>; obtains the file A based on the indication information of the file A; obtains the random number Ra based on the indication information of the random number Ra; and obtains the classkey a from at least one classkey stored in the keystore <NUM>. As shown in <FIG>, the storage controller <NUM> may be connected to the runtime controller <NUM> through the system interface <NUM>, so as to implement reading and writing in the runtime memory <NUM>. In the embodiments of this application, after receiving the indication information of the file A, the controller <NUM> may determine, based on the indication information of the file A, the address information of the file A in the runtime memory <NUM>, and further obtain the file A from the runtime memory <NUM> through the system interface <NUM>.

For the random number Ra, in a possible implementation, the indication information of the random number Ra includes the random number Ra, so that the controller <NUM> may obtain the random number Ra from the indication information of the random number Ra. In another possible implementation, the indication information of the random number Ra includes the address information of the random number Ra in the runtime memory <NUM>. After receiving the indication information of the random number Ra, the controller <NUM> may determine, based on the indication information of the random number Ra, the address information of the random number Ra in the runtime memory <NUM>, and further obtain the random number Ra from the runtime memory <NUM> through the system interface <NUM>.

In a possible implementation of the embodiments of this application, the keystore <NUM> may store only the classkey a, and the controller <NUM> may obtain the classkey a in the keystore <NUM> by default. In another possible implementation, the keystore <NUM> may store a plurality of classkeys. The controller <NUM> may receive the indication information that is of the classkey a and that is sent by the processor <NUM>, determine, based on the indication information of the classkey a, a storage location of the classkey a in the keystore <NUM>, and further obtain the classkey a from the keystore <NUM>.

S304: The key generator <NUM> calculates a file key RA based on the random number Ra and the classkey a. In the embodiments of this application, the key generator <NUM> may calculate the file key RA based on a preset derivation model. The derivation model may be a key derivation function (KDF). It may be understood that when a requirement on encryption security is not high, a simpler derivation model may also be used to accelerate a processing speed. This is not limited in this application.

S305: The file cryptography device <NUM> uses the file key RA to encrypt the file A, to obtain an encrypted file AX. S306: The data memory interface <NUM> writes the file AX into the data memory <NUM>. In a possible implementation, the processor <NUM> may further send destination address information of the file A in the data memory <NUM> to the storage controller <NUM>. When writing the file AX into the data memory <NUM>, the data memory interface <NUM> may write, based on the destination address information of the file A in the data memory <NUM>, the file AX into a location specified by the processor <NUM> in the data memory <NUM>.

S307: The processor <NUM> sends first indication information to the controller <NUM> in the storage controller <NUM>. S308: The controller <NUM> controls, based on the first indication information, the data memory interface <NUM> to write the random number Ra into the data memory <NUM> as metadata of the file A.

Metadata is used to record file attribute information, such as file storage address information and a file format. In the embodiments of this application, the random number Ra generated by the processor <NUM> for the file A is also stored as the metadata of the file A. In a possible implementation, the processor <NUM> may construct a data block that includes all metadata of the file A, and send the first indication information to the controller <NUM>. The first indication information includes address information of the data block. The storage controller <NUM> obtains, based on the address information of the data block in the first indication information, the data block constructed by using all the metadata of the file A from the runtime memory <NUM> through the system interface <NUM>, and stores the data block in the data memory <NUM>. In a possible implementation, the controller <NUM> also writes, based on the first indication information, the identifier of the classkey a allocated by the file A as metadata into the data memory <NUM>.

For a file with a relatively large data amount, the processor <NUM> may usually perform block partition processing on the file in the runtime memory <NUM>, and divide the file A into a plurality of data blocks. Therefore, in the embodiments of this application, the address information of the file A may also include address information of the plurality of data blocks into which the file A is divided, to be specific, a start address of each data block and a data length of each data block. The storage controller <NUM> may sequentially encrypt and store the plurality of data blocks based on the address information of the plurality of data blocks. This process is similar to the process shown in <FIG>, and details are not described in this embodiment of this application. In a possible implementation, the processor <NUM> may further send an initial vector i corresponding to the file A and index information of the initial vector i to the storage controller <NUM>, to improve security of file block encryption.

Based on the file block encryption, the embodiments of this application further provide a specific implementation of S305. With reference to <FIG>, <FIG> shows a process in which a storage controller <NUM> performs block encryption processing on a file A based on an initial vector i according to the embodiments of this application. A plaintext [j] is any data block that needs to be encrypted and that is included in the file A. As shown in <FIG>, the controller <NUM> in the storage controller <NUM> obtains the initial vector i and index information of a vector key that are provided by the processor <NUM>. The controller <NUM> obtains, from the keystore <NUM> based on the index information of the vector key, the vector key corresponding to the initial vector i, and encrypts the initial vector by using the vector key. According to an advanced encryption standard (AES), the controller <NUM> may encrypt the initial vector i by using an AES encryption (AES-ENC) algorithm, and further process the encrypted initial vector i based on a[j], to obtain a processed initial vector i'. Herein, j is an address parameter determined based on the address information of the file A, a[j] is another parameter generated based on j. For specific implementation, refer to ciphertext stealing (CTS) adjustable encryption mode based on exclusive OR encryption (xor-encrypt-xor, XEX) of the AES (AES-XEX-ciphertext stealing, AES-XTS). Details are not described in the embodiments of this application.

In addition, the controller <NUM> obtains a random number Ra based on indication information of the random number Ra, and obtains a classkey a from the keystore <NUM>. The key generator <NUM> calculates a file key RA by using a KDF algorithm based on the random number Ra and the classkey a. The file cryptography device <NUM> encrypts the plaintext [j] based on the file key RA and the processed initial vector i'. According to the AES, the file cryptography device <NUM> may preliminarily encrypt the plaintext [j] by using the AES-ENC algorithm, and then further encrypt the preliminarily encrypted plaintext [j] based on the processed initial vector i', to obtain the ciphertext [j].

During file reading in the data memory <NUM>, the file A written into the data memory <NUM> by using the technical solution provided in Embodiment <NUM> may be read by using a method shown in <FIG>. The following steps are mainly included. S501: The processor <NUM> obtains second indication information, and sends the second indication information to the controller <NUM> of the storage controller <NUM>. In the embodiments of this application, the processor <NUM> may obtain address information of metadata of the file A in the data memory <NUM>, and send the address information of the metadata of the file A in the data memory <NUM> to the controller <NUM> by using the second indication information. S502: In the embodiments of this application, the controller <NUM> may obtain the address information of the metadata of the file A in the data memory <NUM> based on the second address information, and control the data memory interface <NUM> to read the metadata of the file A from the data memory <NUM>.

In a possible implementation, the second indication information further includes a destination address that is of the metadata of the file A and that is in the runtime controller <NUM>. The storage controller <NUM> may write the metadata of the file A into the runtime controller <NUM> based on the destination address that is of the metadata of the file A and that is in the runtime controller <NUM> through the system interface <NUM>. Then, the processor <NUM> may read the metadata of the file A from the runtime memory <NUM> based on the destination address of the metadata of the file A in the runtime memory <NUM>.

S503: The processor <NUM> determines, from the metadata of the file A, address information of a file AX in the data memory <NUM> and a random number Ra, and sends indication information of the file AX and indication information of the random number Ra to the controller <NUM> of the storage controller <NUM>. The indication information of the file AX includes address information of the file AX in the data memory <NUM>. An implementation of the indication information of the random number Ra is similar to that in Embodiment <NUM>, and details are not described again. In a possible implementation, the processor may further determine, based on the metadata of the file A, an identifier of a classkey a corresponding to the file A, further determine indication information of the classkey a based on a correspondence between the identifier of the classkey and a storage location, and send the indication information to the controller <NUM>.

S504: The controller <NUM> obtains the file AX based on the indication information of the file AX, obtains the random number Ra based on the indication information of the random number Ra, and obtains the classkey a from the keystore <NUM>. In the embodiments of this application, the controller <NUM> may obtain the address information of the file AX in the data memory <NUM> based on the indication information of the file AX, so as to control the data memory interface <NUM> to read the file AX from the data memory <NUM> based on the address information of the file AX in the data memory <NUM>. In a possible implementation, the controller <NUM> may further receive the indication information that is of the classkey a and that is sent by the processor <NUM>, and obtains the classkey a based on the indication information of the classkey a.

S505: The key generator <NUM> calculates a file key RA t based on the random number Ra and the classkey a. S506: The file cryptography device <NUM> uses the file key RA to decrypt the file AX, to obtain a decrypted file A. S507: The controller <NUM> writes the decrypted file A into the runtime memory <NUM> through the system interface <NUM>.

In a possible implementation, the processor <NUM> may further send destination address information of the file A in the runtime memory <NUM> to the controller <NUM>. The controller <NUM> may write the decrypted file A into the runtime memory <NUM> through the system interface <NUM> based on the destination address information of the file A in the runtime memory <NUM>. Then, the processor <NUM> may read the file A from the runtime memory <NUM>.

It may be understood that, when the file AX is divided into a plurality of data blocks and stored in the data memory <NUM>, the address information of the file AX may include address information of the plurality of data blocks. The controller <NUM> may control, based on the address information of the plurality of data blocks, the data memory interface <NUM> to read the plurality of data blocks from the data memory <NUM>. A subsequent process is similar to that shown in <FIG>, and details are not described again.

In a possible implementation, the processor <NUM> may further send an initial vector i corresponding to the file A and index information of the initial vector i to the storage controller <NUM>, to decrypt the file AX stored in blocks.

As shown in <FIG>, the ciphertext [j] is any encrypted data block included in the file AX. A process in which the storage controller <NUM> decrypts the ciphertext [j] based on the initial vector i is similar to the foregoing process in which the storage controller <NUM> encrypts the plaintext [j] based on the initial vector i. A difference lies in that the file cryptography device <NUM> decrypts the ciphertext [j] based on the file key RA and a processed initial vector i'. According to the AES, the file cryptography device <NUM> may preliminarily decrypt the ciphertext [j] by using the AES deciphering (AES-DEC) algorithm, and then further decrypt the preliminarily decrypted ciphertext [j] based on the processed initial vector i', to obtain the plaintext [j].

When a file that has been stored in the data memory <NUM> is to be stored again, for example, the file A that is read from the data memory <NUM> by using the technical solution provided in Embodiment <NUM> is to be stored again, the processor <NUM> may obtain metadata of the file A by using S501 and S502 in <FIG>. Then, steps shown in S302 to S306 are performed.

It may be understood that, in S302 of Embodiment <NUM>, the indication information of the file A may be determined based on processing logic of a file system running inside the processor <NUM>. For example, if the file system stores the file A again in a replacement manner, the indication information of the file A may be address information of a current file A in the runtime memory <NUM>. In S303 to S306, the storage controller <NUM> encrypts the file A to obtain an AX, and writes the AX into the data memory <NUM>. If the file A is stored again in an update manner, the indication information of the file A may be address information of update data of the file A in the runtime memory <NUM>. In S303 to S306, the storage controller <NUM> encrypts the update data of the file A, and writes the encrypted update data into the data memory <NUM>.

It can be learned from the foregoing embodiments that, when the storage controller <NUM> provided in the embodiments of this application is used to read a file from or write a file to the data memory <NUM>, the storage controller <NUM> obtains, by using the internal key generator <NUM> and the keystore <NUM> of the storage controller <NUM>, a file key required for encrypting or decrypting the file. In this process, the processor <NUM> does not need to switch from an REE mode to a TEE mode, Therefore, resources of the processor <NUM> occupied by reading and writing an encrypted stored file can be reduced, thereby helping improve file processing efficiency on a premise of ensuring security.

In the foregoing embodiments, all or some functions of the processor <NUM> may be implemented by using software, hardware, firmware, or any combination thereof. When the software is used for implementation, all or some of the embodiments may be implemented in a form of computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or some of the procedures or the functions according to the embodiments of this application are generated. The computer may be a general-purpose computer, a dedicated computer, a computer network, or another programmable apparatus. The computer instructions may be stored in a computer-readable storage medium or may be transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center in a wired (for example, a coaxial cable, an optical fiber, or a digital subscriber line (DSL)) or wireless (for example, infrared, radio, or microwave) manner. The computer-readable storage medium may be any usable medium accessible by a computer, or a data storage device, such as a server or a data center, integrating one or more usable media. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, a DVD), a semiconductor medium (for example, a solid-state drive (SSD)), or the like.

The storage controller <NUM> in the foregoing embodiments may include at least one of a logic circuit, a transistor, an analog circuit, or an algorithm circuit, to implement a corresponding storage control function. For example, each component shown in <FIG> in the storage controller <NUM> may be a circuit module, including a circuit used to process or perform an operation, and specifically including but not limited to at least one of the logic circuit, the transistor, the analog circuit, or the algorithm circuit.

Although this application is described with reference to the embodiments, in a process of implementing the present invention that claims protection, a person skilled in the art may understand and implement another variation of the disclosed embodiments by viewing the accompanying drawings, disclosed content, and the appended claims. In the claims, "comprise" (comprising) does not exclude another component or another step, and "a" or "one" does not exclude a case of plurality. A single processor or another unit may implement several functions enumerated in the claims. Some measures are recorded in dependent claims that are different from each other, but this does not mean that these measures cannot be combined to produce a great effect.

Claim 1:
A storage controller, comprising: a controller (<NUM>), a keystore (<NUM>), a key generator (<NUM>), a file cryptography device (<NUM>), and a data memory interface (<NUM>), wherein
the keystore (<NUM>) is configured to store at least one classkey including a first classkey;
the controller (<NUM>) is configured to: receive indication information of a to-be-processed file, indication information of a random number and indication information of the first classkey that are sent by a processor (<NUM>), wherein the processor (<NUM>) is connected to the storage controller (<NUM>) through an electrical connection, wherein the first classkey is determined based on a type of the to-be-processed file and the indication information of the first classkey is determined based on a pre-obtained correspondence between a classkey identifier and storage location information; obtain the to-be-processed file based on the indication information of the to-be-processed file; obtain the random number based on the indication information of the random number; and obtain the first classkey from the at least one classkey stored in the keystore (<NUM>) based on the indication information of the first classkey;
the key generator (<NUM>) is configured to calculate a file key based on the random number and the first classkey;
the file cryptography device (<NUM>) is configured to process the to-be-processed file by using the file key to obtain a processed file; and
the data memory interface (<NUM>) is configured to write the processed file into a data memory (<NUM>); or read the to-be-processed file from the data memory (<NUM>).