Solid state disk data protection method based on USB flash disk authentication

Abstract

The invention relates to the field of computer data security, in particular to a solid state disk data protection method based on USB flash disk authentication. The method comprises the following steps: triggering a security process when an authentication USB flash disk accesses a system; establishing a secure channel between the USB flash disk and the solid state disk controller, and carrying out bidirectional information exchange and verification; authentication information matching is carried out in the devices of the two parties; only when both the two-way verification are successful, the controller unlocks the secure storage area; if verification fails, the safe area is kept to be locked. According to the method, a dynamic check code is adopted to improve authentication security, user identity authentication is introduced to enhance access control, a protection measure is dynamically triggered by monitoring a read-write operation sequence in real time and identifying an abnormal mode, and an encrypted auditing log is recorded at the same time. According to the method, a data protection system combining equipment and user dual authentication, dynamic security monitoring and complete audit tracking is realized.

Description

Technical Field

[0001] This invention relates to the field of computer data security, and more specifically, to a method for protecting solid-state drive data based on USB flash drive authentication. Background Technology

[0002] Solid-state drive (SSD) data protection technology is an important branch of computer information security. In recent years, domestic and international technological developments in this field have mainly focused on hardware encryption, access control, and authentication. Initially, software cryptography was the primary method of protection, which later evolved into hardware chip-based encryption technologies, such as the TCGOpal standard. The current trend is to combine physical storage devices with biometric authentication methods to build a deeper level of security. In this process, solutions utilizing external storage devices such as USB flash drives for key management and authentication have also been explored, demonstrating a technological evolution from single authentication to composite authentication, and from static verification to dynamic interaction.

[0003] Current technologies using USB flash drives as key carriers for access control of solid-state drives (SSDs) have several significant drawbacks. First, most solutions employ a one-way authentication mechanism, verifying only the legitimacy of the USB flash drive, while the USB flash drive cannot verify the authenticity of the SSD. This creates opportunities for man-in-the-middle attacks launched by impersonating the host device. Second, the authentication information stored on the USB flash drive is mostly static data, such as fixed keys or digital certificates. Once copied or intercepted, this data can be used for repeated attacks, posing a high security risk. Furthermore, current technologies lack continuous monitoring and dynamic response capabilities for abnormal access behavior, failing to effectively prevent subsequent abnormal operations after initial authentication. Additionally, existing solutions typically grant full data access after successful authentication, lacking fine-grained permission control based on user identity, and their auditing functions are inadequate, making them insufficient for the protection needs of high-security environments.

[0004] Therefore, this paper proposes a solid-state drive (SSD) data protection method based on USB flash drive authentication to address the aforementioned issues in existing technologies. The main solutions include: improving the security of the authentication process between the USB flash drive and the SSD to avoid the risks associated with one-way authentication; preventing the copying and reuse of authentication information to enhance the system's resistance to attacks; maintaining effective monitoring and protection of data access behavior after initial authentication; and achieving more refined access control and security auditing. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art, embodiments of the present invention provide a solid-state drive data protection method based on USB flash drive authentication to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a solid-state drive data protection method based on USB flash drive authentication, comprising the following steps: S1: When the authentication USB flash drive is connected to a computer system with a protected solid-state drive, the system is triggered to enter the secure access control process. S2: Establish a secure communication channel between the authentication USB flash drive and the solid-state drive controller. Through this secure communication channel, the solid-state drive controller obtains the first authentication information stored in the authentication USB flash drive. At the same time, the authentication USB flash drive obtains the second authentication information from the solid-state drive controller. S3: In the solid-state drive controller, the first authentication information obtained is matched and verified with the first benchmark authentication information pre-stored in the solid-state drive. At the same time, in the authentication USB flash drive, the second authentication information obtained is matched and verified with the second benchmark authentication information pre-stored in the USB flash drive. S4: Only when the first authentication information matches the first benchmark authentication information and the second authentication information matches the second benchmark authentication information, it is determined that the two-way authentication is successful, and the solid-state drive controller performs the unlocking operation of the secure storage area, so that the computer system can recognize and read and write the secure storage area. S5: If any authentication information fails to match during the two-way authentication process, the solid-state drive controller maintains the hidden and locked state of the secure storage area, exposing only the public storage area for access by the computer system.

[0007] Furthermore, in step S2, both the first authentication information and the second authentication information contain dynamically generated checksums; the dynamically generated checksums are calculated using the following formula: in H represents the dynamic checksum, and H represents the cryptographic hash function. This represents the device's unique identifier, and T represents the current system timestamp. The value represents a random salt value; the dynamic checksum is updated in each authentication process to ensure that the verification data used for each authentication is unique.

[0008] Furthermore, in step S4, after the two-way authentication is successful, a user identity authentication step is further included: calling the user authentication module integrated in the authentication USB flash drive, receiving the user authentication information input by the user, and comparing the user authentication information with the authorized user information pre-stored in the authentication USB flash drive; only when the user authentication information and the authorized user information are successfully matched, the authentication USB flash drive sends a final unlock command to the solid-state drive controller.

[0009] Furthermore, the user authentication information includes at least one of biometric information, password, or digital certificate; the user authentication process is performed in a secure environment isolated from the computer operating system.

[0010] Furthermore, the secure storage area is created within the solid-state drive through logical partitioning, and its storage address space is not visible to the host operating system when it is not unlocked; the unlocking operation includes making the logical block address of the secure storage area visible to the host operating system and loading the corresponding data decryption key into the memory of the solid-state drive controller.

[0011] Furthermore, after step S4, an access behavior monitoring step is also included: during the access of the secure storage area, the read and write operation sequence of the secure storage area is monitored in real time; when an operation sequence that matches the predefined abnormal access pattern is detected, the solid-state drive controller automatically triggers the relocking and hiding operation of the secure storage area and records the security event log.

[0012] Furthermore, the abnormal access patterns are identified using the following risk quantification formula: in This represents the current real-time access risk value, where n represents the total number of operation events detected within the monitoring time window. This represents the preset weight coefficient for the i-th operation event type. This represents the frequency of occurrence of the i-th type of operation event per unit time. This represents an additional risk score based on matching predefined complex rules; when When the preset security threshold is exceeded, it is determined to be an abnormal access mode.

[0013] Furthermore, it also includes a security audit step: after each authentication attempt or secure storage area access operation, at least one of the solid-state drive controller or the authentication USB flash drive generates a security audit record containing a timestamp, operation type, and authentication result, and stores the security audit record in an independent log area that cannot be arbitrarily tampered with.

[0014] Furthermore, in step S2, the establishment of the secure communication channel adopts a secure key exchange protocol based on an asymmetric encryption algorithm to ensure the confidentiality and integrity of the communication data between the authentication USB flash drive and the solid-state drive controller.

[0015] Furthermore, it also includes authentication failure handling steps: when the number of consecutive authentication failures exceeds a preset threshold, the solid-state drive controller activates a security protection mechanism, which includes at least one of the following measures: permanently locking the secure storage area, clearing the encryption key in the secure storage area, or initiating a data erasure process.

[0016] The technical effects and advantages of this invention are as follows: Compared to existing technologies, this invention establishes a bidirectional dynamic authentication mechanism between the authentication USB flash drive and the solid-state drive (SSD) controller, achieving mutual identity verification between the two. Specifically, during the authentication process, the SSD controller verifies the first authentication information from the USB flash drive, while the USB flash drive also verifies the second authentication information from the SSD controller. Both verification information includes a dynamically generated checksum based on a timestamp and device identifier. This ensures that the verification data used in each authentication process is unique and time-sensitive, effectively preventing attacks by intercepting and replaying authentication data, thus improving the security of the initial authentication phase. Its advantages include preventing unauthorized access from counterfeit USB flash drives and blocking spoofed host attacks targeting the SSD. Furthermore, the dynamically changing checksum prevents the reuse of intercepted communication in subsequent authentication processes, thereby enhancing the overall security of the system.

[0017] Compared to existing technologies, this invention achieves continuous protection of the data lifecycle by introducing a hierarchical security protection system based on two-way authentication. This system specifically includes initiating user-level identity authentication after successful device-level authentication, implementing real-time operational behavior monitoring during data access, and recording security audit logs throughout the entire process. This approach forms a defense-in-depth strategy, where the user authentication module runs in an isolated environment to ensure user credential security; the behavior monitoring module analyzes read / write operation sequences to identify preset abnormal patterns; and the audit module encrypts and records all critical operations. This constructs a multi-layered security protection closed loop from device access and user verification to operation monitoring, enabling timely detection and response to abnormal access behavior after authentication, preventing potential data leakage through a dynamic locking mechanism, and providing a reliable basis for tracing security incidents through a complete audit trail, meeting the needs of application scenarios with high data security requirements. Attached Figure Description

[0018] Figure 1 This is a system composition framework diagram of the present invention.

[0019] Figure 2 This is the main workflow diagram of the present invention.

[0020] Figure 3 This is a flowchart of the access behavior monitoring process of the present invention.

[0021] Figure 4 This is a flowchart of the authentication failure handling process for this invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] As attached Figures 1 to 4 The following is a method for protecting solid-state drive data based on USB flash drive authentication, and its specific implementation details are as follows: Example 1: Secure Access Process Based on Two-Way Dynamic Authentication This embodiment details the specific implementation of the bidirectional dynamic authentication mechanism of the present invention. When a user connects a dedicated authentication USB drive to the computer system, the system initiates a complete secure access process, which includes three main stages: device authentication, user verification, and audit logging.

[0024] During the device authentication phase, the system first performs a physical connection check. When the authentication USB drive is inserted into the USB port, the host operating system recognizes the device and loads the corresponding driver, while simultaneously sending a secure access request signal to the SSD controller. At this point, the SSD controller initializes the security protocol stack, preparing to establish a secure communication channel with the authentication USB drive. This channel employs a key exchange protocol based on elliptic curve cryptography, ensuring the confidentiality and integrity of all subsequent communication data by exchanging digital certificates and generating session keys. Specifically, the SSD controller generates a temporary key pair and sends the public key along with the digital certificate to the authentication USB drive; after verifying the certificate's validity, the authentication USB drive uses the public key to encrypt its own generated session key and returns it to the controller, thus establishing an end-to-end encrypted channel.

[0025] After the secure channel is established, the system enters the two-way dynamic authentication phase. The core of this phase is the generation and verification process of the dynamic checksum. The solid-state drive controller first combines the following parameters: the hardware identifier of the authentication USB drive, the current timestamp obtained from the secure clock (accurate to milliseconds), and a randomly generated 256-bit salt value. These parameters are used to calculate the dynamic checksum portion of the second authentication information using the following formula: in This represents the dynamic checksum for this session, where H stands for the SHA-256 hash function. This represents the unique hardware identifier of the authentication USB chip, where T represents the current system timestamp. This represents the random salt value generated by the solid-state drive controller. Simultaneously, the authentication USB drive also uses the same formula to calculate the first authentication information, whose parameters include: the solid-state drive controller's serial number, the timestamp obtained during synchronization, and its own randomly generated salt value.

[0026] The two-way authentication process is performed synchronously in the encrypted channel. The SSD controller sends the calculated second authentication information (including a dynamic checksum, timestamp, and salt value) to the authentication USB drive, while simultaneously receiving the first authentication information from the USB drive. Using a pre-stored USB drive hardware identifier and the received parameters, the controller recalculates the expected checksum value using the same formula and compares it with the checksum in the received first authentication information. The authentication USB drive synchronously performs the same authentication process, verifying the received second authentication information using a pre-stored controller serial number. This process ensures mutual authentication between the two devices, and due to the timestamp and random salt value, the checksum generated for each session is unique.

[0027] Once two-way device authentication is successful, the system enters the user authentication phase. The authentication USB drive activates its built-in secure execution environment, which runs independently of the host operating system. The user submits authentication information via a biometric sensor (such as a fingerprint reader) connected to the USB drive or a virtual input interface. The security chip within the USB drive compares the collected biometric template or entered password with pre-stored authorized user information. This process is entirely completed within the isolated environment of the USB drive; the host system can only obtain the verification result and cannot access the original authentication data. Only after user authentication is also successful will the authentication USB drive send the final unlock command to the solid-state drive controller.

[0028] Finally, the system performs the unlocking operation of the secure storage area and generates an audit log. Upon receiving the unlock command, the SSD controller first maps the logical block address of the secure storage area to the host's visible address space, and then loads the data decryption key from the encrypted storage area into the controller's secure memory. Simultaneously, the controller and the authenticated USB drive generate security audit logs, including timestamps, operation type, authentication results, and device identifiers. These logs are encrypted and stored separately in the SSD's dedicated log area and the USB drive's secure storage area. If verification fails at any stage of this process, the system immediately terminates the process, records the failure event, and activates security protection mechanisms, including permanent locking or data erasure, if the number of consecutive failures exceeds a threshold (e.g., 5 times).

[0029] Example 2: Continuous Protection Process Integrating Real-Time Behavior Monitoring This embodiment details the specific implementation of the multi-layered security protection system of this invention, focusing on the continuous monitoring and protection mechanism of the secure storage area after unlocking. The process includes four main stages: behavior monitoring, risk assessment, dynamic response, and audit analysis.

[0030] In the behavior monitoring phase, the system constructs a complete operational view through multiple data acquisition points. The monitoring module within the SSD controller starts immediately after the secure storage area is unlocked. This module, located in the controller's firmware layer, captures all input / output commands sent to the secure storage area. Specific parameters recorded include: command type (read, write, or erase), target logical block address range, data length, timestamp (accurate to microseconds), command sequence number, and the process hash identifier initiating the operation (if available). Simultaneously, the monitoring auxiliary module within the authentication USB drive records access control events related to the secure area, such as the number of unlock requests and user authentication attempts. This data is temporarily cached in the controller's secure memory and processed in segments according to time windows, each defaulting to 5 seconds, which can be adjusted according to security policies.

[0031] In the risk assessment phase, the system employs a multi-dimensional analysis model to evaluate the collected behavioral data in real time. At the end of each time window, the monitoring module preprocesses and extracts features from the operational data within the window, and then uses a risk quantification formula for comprehensive evaluation. in, This represents the real-time access risk value for the current time window, where n represents the number of different operation event types identified. This represents the preset weight coefficient for the i-th type of operation event. This indicates the frequency of occurrence of this type of event within the time window. This represents the additional risk score based on pattern matching. Weighting coefficients. The risk level of the operation is predefined, for example: reading file system metadata (weight 0.8), writing to non-contiguous addresses consecutively (weight 0.6), and regular sequential read / write (weight 0.2), etc. Pattern matching score. The scores are calculated by a dedicated behavior analysis engine that triggers corresponding bonuses by detecting predefined suspicious patterns (such as port scanning address access, buffer overflow attempts, frequent reading of specific sensitive files, etc.).

[0032] In the dynamic response phase, the system takes corresponding security measures based on the risk assessment results. The monitoring module will calculate the risk value. Compare with the preset three-level threshold: when When the value is below a minimum threshold (e.g., 30), the access behavior is considered normal, and only monitoring logs are recorded; when... When the value is between the intermediate threshold (e.g., 30-70), the system enters enhanced monitoring mode, increasing the data sampling frequency and recording detailed operation trajectories; when... When the threshold is exceeded (e.g., 70), the system immediately triggers a security protection mechanism. Specific measures of this mechanism include: immediately suspending all ongoing secure storage area access operations, forcibly clearing the decryption keys from the controller's memory, removing the logical address of the secure storage area from the host's visible address space, and generating a high-risk security event alert. Simultaneously, the system will decide whether to activate the data erasure protocol based on the risk level; for extremely high-risk situations (e.g., ... >90) may trigger the overwrite and erase of specific sensitive data areas.

[0033] During the audit analysis phase, the system records and analyzes the entire monitoring process. All monitoring data, risk assessment results, and response actions are encrypted and stored in a dedicated log area on a solid-state drive. These logs are append-only to prevent post-event tampering. The audit logs include a complete timeline: data from operational behavior collection, feature extraction, risk calculation to the final response. Security administrators can access these audit logs through a secure interface for security incident analysis and system policy optimization. Furthermore, the system supports offline analysis, allowing audit logs to be exported to a security workstation for in-depth analysis, including behavioral pattern mining, risk threshold tuning, and attack path reconstruction. The entire monitoring process forms a continuous security protection loop, preventing attackers from covertly performing malicious operations under continuous monitoring even after initial authentication, thus achieving full lifecycle protection for data access.

[0034] This embodiment constructs a complete protection system from behavior monitoring and risk assessment to dynamic response through the coordinated work of the above four links, effectively solving the security defect of traditional solutions that lack a continuous protection mechanism after initial authentication.

[0035] Finally, the following points should be noted: First, in the description of this application, it should be noted that, unless otherwise specified and limited, the terms "installation", "connection", and "linkage" should be interpreted broadly, and can be mechanical or electrical connections, or internal connections between two components, or direct connections. "Up", "down", "left", "right", etc. are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may change. Secondly: The accompanying drawings of the embodiments disclosed in this invention only involve the structures involved in the embodiments disclosed in this invention. Other structures can refer to the general design. In the absence of conflict, the same embodiment and different embodiments of this invention can be combined with each other. In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for protecting solid-state drive data based on USB flash drive authentication, characterized in that, Includes the following steps: S1: When the authentication USB flash drive is connected to a computer system with a protected solid-state drive, the system is triggered to enter the secure access control process. S2: Establish a secure communication channel between the authentication USB flash drive and the solid-state drive controller. Through this secure communication channel, the solid-state drive controller obtains the first authentication information stored in the authentication USB flash drive. At the same time, the authentication USB flash drive obtains the second authentication information from the solid-state drive controller. S3: In the solid-state drive controller, the first authentication information obtained is matched and verified with the first benchmark authentication information pre-stored in the solid-state drive. At the same time, in the authentication USB flash drive, the second authentication information obtained is matched and verified with the second benchmark authentication information pre-stored in the USB flash drive. S4: Only when the first authentication information matches the first benchmark authentication information and the second authentication information matches the second benchmark authentication information, it is determined that the two-way authentication is successful, and the solid-state drive controller performs the unlocking operation of the secure storage area, so that the computer system can recognize and read and write the secure storage area. S5: If any authentication information fails to match during the two-way authentication process, the solid-state drive controller maintains the hidden and locked state of the secure storage area, exposing only the public storage area for access by the computer system.

2. The solid-state drive data protection method based on USB flash drive authentication according to claim 1, characterized in that, In step S2, both the first authentication information and the second authentication information contain dynamically generated checksums; the dynamically generated checksums are calculated using the following formula: in H represents the dynamic checksum, and H represents the cryptographic hash function. This represents the device's unique identifier, and T represents the current system timestamp. The value represents a random salt value; the dynamic checksum is updated in each authentication process to ensure that the verification data used for each authentication is unique.

3. The solid-state drive data protection method based on USB flash drive authentication according to claim 1, characterized in that, In step S4, after the two-way authentication is successful, a user identity authentication step is further included: calling the user authentication module integrated in the authentication USB flash drive, receiving the user authentication information input by the user, and comparing the user authentication information with the authorized user information pre-stored in the authentication USB flash drive; only when the user authentication information and the authorized user information are successfully matched, the authentication USB flash drive sends a final unlocking command to the solid-state drive controller.

4. The solid-state drive data protection method based on USB flash drive authentication according to claim 3, characterized in that, The user authentication information includes at least one of biometric information, password, or digital certificate; the user authentication process is performed in a secure environment isolated from the computer operating system.

5. A solid-state drive data protection method based on USB flash drive authentication according to claim 1, characterized in that, The secure storage area is created within the solid-state drive through logical partitioning, and its storage address space is not visible to the host operating system when it is not unlocked; the unlocking operation includes making the logical block address of the secure storage area visible to the host operating system and loading the corresponding data decryption key into the memory of the solid-state drive controller.

6. A solid-state drive data protection method based on USB flash drive authentication according to claim 1, characterized in that, Following step S4, an access behavior monitoring step is also included: during the access of the secure storage area, the read and write operation sequence of the secure storage area is monitored in real time; when an operation sequence that matches a predefined abnormal access pattern is detected, the solid-state drive controller automatically triggers the relocking and hiding operation of the secure storage area and records the security event log.

7. A solid-state drive data protection method based on USB flash drive authentication according to claim 6, characterized in that, The abnormal access patterns are identified using the following risk quantification formula: in This represents the current real-time access risk value, where n represents the total number of operation events detected within the monitoring time window. This represents the preset weight coefficient for the i-th operation event type. This represents the frequency of occurrence of the i-th type of operation event per unit time. This represents an additional risk score based on matching predefined complex rules; when When the preset security threshold is exceeded, it is determined to be an abnormal access mode.

8. A solid-state drive data protection method based on USB flash drive authentication according to claim 1, characterized in that, It also includes a security audit step: after each authentication attempt or secure storage area access operation, at least one of the solid-state drive controller or the authentication USB flash drive generates a security audit record containing a timestamp, operation type and authentication result, and stores the security audit record in an independent log area that cannot be arbitrarily tampered with.

9. A solid-state drive data protection method based on USB flash drive authentication according to claim 1, characterized in that, In step S2, the establishment of the secure communication channel adopts a secure key exchange protocol based on an asymmetric encryption algorithm to ensure the confidentiality and integrity of the communication data between the authentication USB flash drive and the solid-state drive controller.

10. A solid-state drive data protection method based on USB flash drive authentication according to claim 1, characterized in that, It also includes authentication failure handling steps: when the number of consecutive authentication failures exceeds a preset threshold, the solid-state drive controller activates a security protection mechanism, which includes at least one of the following measures: permanently locking the secure storage area, clearing the encryption key in the secure storage area, or initiating a data erasure process.

Images