Hard disk encryption management method, device and equipment and readable storage medium

Abstract

The invention discloses a hard disk encryption management method, device and equipment and a readable storage medium. The hard disk encryption management method comprises the steps that a hard disk receives a manufacturer custom command from a host; analyzing the manufacturer custom command to obtain an encrypted management command; when the encryption management command is a password setting command, if a first logic space of the hard disk is in an unencrypted state or an unlocked state, converting a first plaintext password into a first ciphertext password through an encryption algorithm; loading the first ciphertext password to an encryption engine of the hard disk, converting the first preset data into first encrypted data by the encryption engine by taking the first ciphertext password as a key, and storing the first encrypted data to a standby area corresponding to a first logic space of the hard disk; and after the first encrypted data is successfully stored, setting the first logic space of the hard disk to be in an encrypted and unlocked state, and replying a command execution result to the host. According to the method and the device, the applicability of a hard disk encryption function is greatly improved, and the password security is greatly improved.

Description

Technical Field

[0001] This application relates to the field of hard disk management technology, and in particular to a hard disk encryption management method, apparatus, device, and readable storage medium. Background Technology

[0002] In current storage device applications, while the requirements for storage capacity and performance are increasing, the importance of data security is also growing. This demand is driving the systematic development of hard drive encryption technology towards high performance and high security. Existing hard drive encryption technology has shifted from traditional software encryption to encryption methods primarily based on the hard drive's built-in encryption engine.

[0003] To standardize and enhance the security and management capabilities of hard drive encryption, the industry generally adopts the TCG Opal standard. The TCG Opal standard is a storage security specification developed by the Trusted Computing Group (TCG). It aims to provide hardware-level data encryption and security management functions for storage devices such as hard drives. This standard improves data confidentiality while maintaining system performance by automatically performing encryption and decryption operations within the device without relying on host system resources.

[0004] However, regardless of whether the TCG Opal standard or other encryption / decryption protocols are used, there are limitations to the application scenarios, and the encryption / decryption functions may fail in certain scenarios. Summary of the Invention

[0005] This application provides a hard disk encryption management method, apparatus, device, and readable storage medium, aiming to solve the technical problem that regardless of whether the TCG Opal standard or other encryption and decryption protocols are used, the application scenarios are limited and the hard disk encryption and decryption functions fail in certain scenarios.

[0006] In a first aspect, embodiments of this application provide a hard disk encryption management method, the hard disk encryption management method comprising: The hard drive receives manufacturer-defined commands from the host, which encapsulate encrypted management commands. The vendor-defined commands are parsed to obtain the encryption management commands; When the encryption management command is the password setting command, if the first logical space of the hard disk is in an unencrypted or unlocked state, the first plaintext password is converted into the first ciphertext password through an encryption algorithm. The password setting command carries the first logical space and the first plaintext password. The first ciphertext password is loaded into the encryption engine of the hard disk. The encryption engine uses the first ciphertext password as the key to convert the first preset data into the first encrypted data and saves the first encrypted data to the spare area corresponding to the first logical space of the hard disk. After the first encrypted data is successfully saved, the first logical space of the hard drive is set to an encrypted and unlocked state, and the command execution result is sent back to the host.

[0007] Optionally, after parsing the vendor-defined command to obtain the encryption management command, the process includes: When the encryption management command is the erase password command, if the first logical space of the hard disk is in a locked or unlocked state, the second plaintext password is converted into a second ciphertext password through an encryption algorithm. The erase password command carries the first logical space and the second plaintext password. If the second plaintext password matches the preset super password, then the first logical space of the hard drive is set to an unencrypted state; If the second plaintext password does not match the preset super password, the first encrypted data is read from the spare area corresponding to the first logical space of the hard disk, the second ciphertext password is loaded into the encryption engine of the hard disk, and the encryption engine uses the second ciphertext password as the key to decrypt the first encrypted data to obtain the first decrypted data. If the first decrypted data is consistent with the first preset data, then the first logical space of the hard disk is set to an unencrypted state; If the first decrypted data is inconsistent with the first preset data, then reply to the host with a password error.

[0008] Optionally, after parsing the vendor-defined command to obtain the encryption management command, the process includes: When the encryption management command is an unlock command, if the first logical space of the hard disk is locked, the third plaintext password is converted into a third ciphertext password through an encryption algorithm. The unlock command carries the first logical space and the third plaintext password. Read the first encrypted data from the spare area corresponding to the first logical space of the hard disk, load the third ciphertext password into the encryption engine of the hard disk, and use the third ciphertext password as the key to decrypt the first encrypted data to obtain the second decrypted data; If the second decrypted data is consistent with the first preset data, then the first logical space of the hard disk is set to the unlocked state; If the second decrypted data is inconsistent with the first preset data, the system will reply to the host with a password error and count the number of password errors.

[0009] Optionally, after counting the number of incorrect password attempts, the following is included: When the number of incorrect password attempts exceeds the preset limit, erase all data on the hard drive, set the hard drive to an unencrypted state, and restore the current state of the hard drive to the host.

[0010] Optionally, before the hard disk receives a vendor-defined command from the host, the following steps are included: The host manages multiple logical spaces on the hard drive and the user password for each logical space.

[0011] Secondly, embodiments of this application provide a hard disk encryption management device, the hard disk encryption management device comprising: The receiving module is used for the hard drive to receive manufacturer-defined commands from the host, which encapsulate encrypted management commands. The parsing module is used to parse vendor-defined commands to obtain encryption management commands; The password setting module is used to convert the first plaintext password into a first ciphertext password using an encryption algorithm when the encryption management command is the password setting command and the first logical space of the hard disk is in an unencrypted or unlocked state. The password setting command carries the first logical space and the first plaintext password. The data storage module is used to load the first ciphertext password into the encryption engine of the hard disk. The encryption engine uses the first ciphertext password as the key to convert the first preset data into the first encrypted data and saves the first encrypted data to the spare area corresponding to the first logical space of the hard disk. The status module is used to set the first logical space of the hard disk to an encrypted and unlocked state after the first encrypted data is successfully saved, and to reply to the host with the command execution result.

[0012] Optionally, the hard disk encryption management device further includes an erasure password module, used for: When the encryption management command is the erase password command, if the first logical space of the hard disk is in a locked or unlocked state, the second plaintext password is converted into a second ciphertext password through an encryption algorithm. The erase password command carries the first logical space and the second plaintext password. If the second plaintext password matches the preset super password, then the first logical space of the hard drive is set to an unencrypted state; If the second plaintext password does not match the preset super password, the first encrypted data is read from the spare area corresponding to the first logical space of the hard disk, the second ciphertext password is loaded into the encryption engine of the hard disk, and the encryption engine uses the second ciphertext password as the key to decrypt the first encrypted data to obtain the first decrypted data. If the first decrypted data is consistent with the first preset data, then the first logical space of the hard disk is set to an unencrypted state; If the first decrypted data is inconsistent with the first preset data, then reply to the host with a password error.

[0013] Optionally, the hard drive encryption management device further includes an unlocking module, used for: When the encryption management command is an unlock command, if the first logical space of the hard disk is locked, the third plaintext password is converted into a third ciphertext password through an encryption algorithm. The unlock command carries the first logical space and the third plaintext password. Read the first encrypted data from the spare area corresponding to the first logical space of the hard disk, load the third ciphertext password into the encryption engine of the hard disk, and use the third ciphertext password as the key to decrypt the first encrypted data to obtain the second decrypted data; If the second decrypted data is consistent with the first preset data, then the first logical space of the hard disk is set to the unlocked state; If the second decrypted data is inconsistent with the first preset data, the system will reply to the host with a password error and count the number of password errors.

[0014] Thirdly, embodiments of this application provide a hard disk encryption management device, which includes a processor, a memory, and a hard disk encryption management program stored in the memory and executable by the processor. When the hard disk encryption management program is executed by the processor, it implements the steps of the hard disk encryption management method described above.

[0015] Fourthly, embodiments of this application provide a readable storage medium storing a hard disk encryption management program, wherein when the hard disk encryption management program is executed by a processor, it implements the steps of the hard disk encryption management method described above.

[0016] The beneficial effects of the technical solutions provided in this application include: In this embodiment, the hard disk receives a vendor-defined command from the host, wherein the vendor-defined command encapsulates an encryption management command; the vendor-defined command is parsed to obtain the encryption management command; when the encryption management command is a password setting command, if the first logical space of the hard disk is in an unencrypted or unlocked state, the first plaintext password is converted into a first ciphertext password through an encryption algorithm, wherein the password setting command carries the first logical space and the first plaintext password; the first ciphertext password is loaded into the encryption engine of the hard disk, and the encryption engine uses the first ciphertext password as a key to convert the first preset data into first encrypted data, and saves the first encrypted data to the spare area corresponding to the first logical space of the hard disk; after the first encrypted data is successfully saved, the first logical space of the hard disk is set to an encrypted and unlocked state, and the command execution result is replied to the host. In this embodiment, the host encapsulates the encryption management commands in a vendor-defined command (Vendor Unique) according to a preset encapsulation rule agreed upon with the hard drive and sends it to the hard drive. Since the vendor-defined command is designed for transparent transmission in various interface protocols, even in scenarios where a bridging chip exists between the hard drive and a non-standard USB interface, the encryption management commands can be transmitted to the hard drive completely and without loss. This solves the problem that traditional TCG Opal standard commands may be filtered or fail to convert in bridging chip scenarios, significantly improving the applicability of the hard drive encryption function in various connection scenarios. Simultaneously, a unique encryption verification method provides multiple layers of protection; the hard drive neither stores plaintext nor ciphertext passwords, greatly enhancing password security. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating an embodiment of the hard disk encryption management method of this application; Figure 2 This is a schematic diagram of the encryption management command encapsulation format according to an embodiment of the hard disk encryption management method of this application; Figure 3 This is a schematic diagram illustrating the connection between the host and the hard disk without a bridging chip, according to an embodiment of the hard disk encryption management method of this application. Figure 4 This is a schematic diagram showing a bridging chip connection between a host and a hard drive in one embodiment of the hard drive encryption management method of this application; Figure 5 This is a schematic diagram illustrating command execution and state transitions of an embodiment of the hard disk encryption management method of this application; Figure 6 This is a schematic diagram of the functional modules of an embodiment of the hard disk encryption management device of this application; Figure 7 This is a schematic diagram of the hardware structure of the hard disk encryption management device involved in the embodiments of this application. Detailed Implementation

[0018] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0020] In a first aspect, embodiments of this application provide a hard disk encryption management method.

[0021] In one embodiment, reference is made to Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the hard disk encryption management method of this application, as shown below. Figure 1 As shown, the hard drive encryption management methods include: In step S10, the hard drive receives a vendor-defined command from the host, which encapsulates encrypted management commands.

[0022] In this embodiment, the host, according to the preset encapsulation rules agreed upon with the hard drive, encapsulates the encryption management command in a vendor-defined command (Vendor Unique) and sends it to the hard drive, referring to... Figure 2 , Figure 2 This is a schematic diagram of the encryption management command encapsulation format of an embodiment of the hard disk encryption management method of this application, as shown below. Figure 2 As shown, the opcode (OPC) of 0xF1 indicates that the command is a vendor-defined command. DW12 byte 3 is the SED Send Command identifier, which is declared as an encryption management command. DW12 byte 2 is the specific encryption management command, including SED_SET_PASSWORD (set password command), SED_ERASE_PASSWORD (erase password command), and SED_UNLOCK (unlock command), etc. Here, DW represents Double Word, that is, a 32-bit (4-byte) data unit. The basic structure of NVMe (NVM Express, Non-volatile Memory Host Controller Interface Specification) commands consists of 16 DWORDs (DW00-DW15), totaling 64 bytes. Figure 2 The use of DW12 for encryption management commands is just an example; DW13, etc., can also be used, depending on the agreement between the host and the hard drive.

[0023] Reference Figure 3 ,Figure 3 This is a schematic diagram illustrating the connection between the host and the hard drive without a bridging chip, according to an embodiment of the hard drive encryption management method of this application. Figure 4 , Figure 4 This is a schematic diagram illustrating the connection between the host and the hard drive via a bridging chip in one embodiment of the hard drive encryption management method of this application. Figure 3 and Figure 4 As shown, hard drives (such as SSDs, Solid State Drives) receive manufacturer-defined commands from the host via standard interfaces (such as SATA, NVMe) or through a bridge chip (such as a USB-to-SATA / NVMe bridge chip). Because manufacturer-defined commands are designed for transparent transmission across various interface protocols, even in scenarios where non-standard hard drive interfaces like USB (Universal Serial Bus) are connected and a bridge chip is present, encrypted management commands can be transmitted to the hard drive intact and without loss. This solves the problem of traditional TCGOpal standard commands potentially being filtered or failing to convert in bridge chip scenarios. This is because bridge chips are primarily designed to implement core storage functions, filtering or modifying unsupported commands and only transmitting commands they understand. By utilizing the manufacturer-defined space reserved in the interface protocol, the incompatibility issues of bridge chips with specific standard commands are avoided, significantly improving the applicability of hard drive encryption in various connection scenarios and laying a reliable foundation for subsequent encrypted management operations.

[0024] Step S20: Parse the manufacturer-defined command to obtain the encryption management command.

[0025] In this embodiment, after receiving a manufacturer-defined command, the hard drive first verifies the completeness and legality of the manufacturer-defined command format, including checking whether parameters such as command header information and data length conform to preset specifications. Then, it parses the manufacturer-defined command according to preset encapsulation rules, determines the specific encryption management command type from the DW12 byte 2 field of the manufacturer-defined command, and extracts relevant parameters of the encryption management command, such as logical space identifier (LBA information) and plaintext password.

[0026] Step S30: When the encryption management command is the password setting command, if the first logical space of the hard disk is in an unencrypted or unlocked state, the first plaintext password is converted into a first ciphertext password through an encryption algorithm. The password setting command carries the first logical space and the first plaintext password.

[0027] In this embodiment, when the parsed encryption management command is SED_SET_PASSWORD (password setting command), the current state of the target logical space (i.e., the first logical space of the hard disk) is checked first. (Refer to...)Figure 5 , Figure 5 This is a schematic diagram illustrating command execution and state transitions of an embodiment of the hard disk encryption management method of this application, as shown below. Figure 5 As shown, if the logical space is in an unencrypted state (UNENCRYPTED Mode) or an unlocked state (UNLOCKED Mode), a password setting operation is performed. Specifically, the received first plaintext password is converted into a first ciphertext password by a one-way hash using a strong encryption algorithm such as AES-256. It should be noted that the hard drive of this invention is divided into multiple logical spaces. SED_SET_PASSWORD (password setting command), SED_ERASE_PASSWORD (password erasure command), and SED_UNLOCK (unlock command) all refer to one or more logical spaces of the hard drive. For ease of understanding the hard drive encryption and decryption operations of this invention, the subsequent SED_ERASE_PASSWORD (password erasure command) and SED_UNLOCK (unlock command) refer to the same logical space as SED_SET_PASSWORD (password setting command). It should also be noted that, referring to... Figure 5 After the hard drive is powered on, if the hard drive does not have hardware encryption enabled, it will enter the unencrypted mode. If the hard drive has hardware encryption enabled, it will enter the locked mode within the encrypted mode. Encryption states include two modes: LOCKED Mode and UNLOCKED Mode. Unencrypted Mode means the data on the hard drive is stored in plaintext without any encryption. Therefore, the data can be directly read and accessed. In this mode, the hard drive does not provide active data protection, and any user or program with physical access rights can view the content. Security is low, suitable for scenarios where data confidentiality requirements are not high. LOCKED Mode means the hard drive has encryption enabled, and the data is stored in ciphertext. In this mode, authentication is required to access the data, or although access is allowed, the accessed data is in ciphertext. UNLOCKED Mode means that after successful user authentication, the hard drive decrypts the data and allows normal read and write operations. In this mode, data is encrypted using the current key by the encryption engine before being written, and automatically decrypted upon reading. The entire process is transparent to the user and is usually controlled by an authenticated session. After unlocking, if the device disconnects or times out, the hard drive automatically returns to LOCKED Mode to enhance security.

[0028] Step S40: Load the first ciphertext password into the encryption engine of the hard disk. The encryption engine uses the first ciphertext password as the key to convert the first preset data into first encrypted data and saves the first encrypted data to the spare area corresponding to the first logical space of the hard disk.

[0029] In this embodiment, after password conversion, the first ciphertext password is loaded into the hard drive's built-in encryption engine as a working key. After the first ciphertext password is loaded into the encryption engine, the engine uses it as the key to encrypt and decrypt data. Subsequently, the encryption engine uses this key to encrypt the first preset data, generating the first encrypted data. This first preset data is a predefined verification benchmark within the system, used for subsequent password verification. After encryption, the first encrypted data is written to the Spare Data area corresponding to the target logical space. This spare area is invisible to the host and is typically used to store SSD internal management data. Therefore, the SSD does not store the user's plaintext password or ciphertext password in any form. Even if the SSD is physically accessed, an attacker cannot obtain the user's plaintext or ciphertext password. Even if an attacker obtains the encrypted data, they cannot crack it because they do not know the original preset data content. This multi-layered protection greatly enhances password security. When it is necessary to verify the user's password later, the plaintext password entered by the user can be converted into a ciphertext password using the same encryption algorithm. The ciphertext password is then loaded into the encryption engine to decrypt the first encrypted data and compare it with the preset data to confirm the correctness of the password.

[0030] Step S50: After the first encrypted data is successfully saved, the first logical space of the hard disk is set to an encrypted and unlocked state, and the command execution result is sent back to the host.

[0031] In this embodiment, after confirming that the first encrypted data has been successfully written to the Spare Data area, the status flag of the target logical space is set to the Encrypted & Unlocked state. In this state, the user can read and write data in the logical space normally. Before writing, the data is encrypted by the encryption engine using the current key, and it is automatically decrypted when read. The entire process is transparent to the user. Subsequently, the hard drive returns a command execution success status code to the host, notifying the host that the password setting operation has been completed.

[0032] In this embodiment, the host encapsulates the encryption management commands in a vendor-defined command (Vendor Unique) according to the preset encapsulation rules agreed upon with the hard drive and sends it to the hard drive. Since vendor-defined commands are designed for transparent transmission in various interface protocols, even in scenarios where a bridging chip exists between the hard drive and a non-standard USB interface, the encryption management commands can be transmitted to the hard drive completely and without loss. This solves the problem of traditional TCG Opal standard commands potentially being filtered or failing to convert in bridging chip scenarios, significantly improving the applicability of the hard drive encryption function in various connection scenarios. Simultaneously, a unique encryption verification method provides multiple layers of protection; the hard drive neither stores plaintext nor ciphertext passwords, greatly enhancing password security. Furthermore, encryption management commands such as SED_SET_PASSWORD (password setting command) can carry the logical space address of the hard drive and the plaintext password, enabling the management of multiple logical spaces on the hard drive using independent user passwords, greatly expanding the application scenarios of hard drive encryption and decryption functions.

[0033] Further, in one embodiment, after step S20, the following is included: When the encryption management command is the erase password command, if the first logical space of the hard disk is in a locked or unlocked state, the second plaintext password is converted into a second ciphertext password through an encryption algorithm. The erase password command carries the first logical space and the second plaintext password. If the second plaintext password matches the preset super password, then the first logical space of the hard drive is set to an unencrypted state; If the second plaintext password does not match the preset super password, the first encrypted data is read from the spare area corresponding to the first logical space of the hard disk, the second ciphertext password is loaded into the encryption engine of the hard disk, and the encryption engine uses the second ciphertext password as the key to decrypt the first encrypted data to obtain the first decrypted data. If the first decrypted data is consistent with the first preset data, then the first logical space of the hard disk is set to an unencrypted state; If the first decrypted data is inconsistent with the first preset data, then reply to the host with a password error.

[0034] In this embodiment, we continue to refer to... Figure 5When the encryption management command is SED_ERASE_PASSWORD (erase password command), the system first confirms whether the target logical space is in locked mode or unlocked mode. Then, the user-provided second plaintext password is converted into a second ciphertext password using the same encryption algorithm (e.g., AES-256) as when the password was set. The system first checks if the second plaintext password matches the preset super password (usually a manufacturer-preset security recovery key, used only for password erasure operations). If they match, the target logical space state is directly reset to unencrypted mode (UNENCRYPTED mode) without further verification; this design is intended to handle the special case of the user forgetting their password. If the super password does not match, the system reads the previously stored first encrypted data from the Spare Data area, attempts to decrypt it using the second ciphertext password as the key, obtains the first decrypted data, and compares it with the system's preset first data. If they match, the user-provided password is correct, and the system resets the target logical space state to unencrypted mode; if they do not match, a password error message is returned to the host. By verifying whether a user can correctly decrypt the stored verification data, the correctness of their password is indirectly confirmed without storing any plaintext password or reversible password representation on the SSD. This achieves both secure password erasure and an emergency recovery mechanism for the super password, while avoiding plaintext storage of password information, greatly enhancing system security and user-friendliness.

[0035] Further, in one embodiment, after step S20, the following is included: When the encryption management command is an unlock command, if the first logical space of the hard disk is locked, the third plaintext password is converted into a third ciphertext password through an encryption algorithm. The unlock command carries the first logical space and the third plaintext password. Read the first encrypted data from the spare area corresponding to the first logical space of the hard disk, load the third ciphertext password into the encryption engine of the hard disk, and use the third ciphertext password as the key to decrypt the first encrypted data to obtain the second decrypted data; If the second decrypted data is consistent with the first preset data, then the first logical space of the hard disk is set to the unlocked state; If the second decrypted data is inconsistent with the first preset data, the system will reply to the host with a password error and count the number of password errors.

[0036] In this embodiment, we continue to refer to... Figure 5When the encryption management command is SED_UNLOCK (unlock command) and the target logical space is in locked mode, the unlocking operation is performed. Specifically, the user-provided third plaintext password is converted into a third ciphertext password. The first encrypted data is read from the Spare Data area, and the third ciphertext password is used as the key to decrypt the first encrypted data, resulting in the second decrypted data. The second decrypted data is then compared with the system's preset first data: if they match, the user's password is correct, and the system updates the target logical space status to unlocked mode, allowing the user to access the data normally; if they do not match, a password error message is returned to the host, and the password error counter for that logical space is incremented. This password error count provides a basis for subsequent security protection (such as data erasure after multiple errors), protecting user data security and preventing brute-force attacks.

[0037] Further, in one embodiment, after counting the number of password errors, the following is included: When the number of incorrect password attempts exceeds the preset limit, erase all data on the hard drive, set the hard drive to an unencrypted state, and restore the current state of the hard drive to the host.

[0038] In this embodiment, after each failed password verification, the system increments the password error counter in the corresponding logical space. When the counter value exceeds a preset security threshold (e.g., 5 or 10 times, configurable according to the security policy), a security protection mechanism is triggered: First, a full-disk secure erase operation is initiated, using a secure erase algorithm (e.g., the DoD 5220.22-M standard) to completely erase all user data in the SSD; then, the entire hard drive is reset to an unencrypted state (UNENCRYPTED Mode). By limiting the number of password attempts, brute-force attacks are effectively prevented, while the full-disk erase ensures that even if an attacker eventually gains access to the device after multiple unauthorized access attempts, they will not be able to obtain any valuable data. This significantly improves the system's resistance to attacks, protects the security of sensitive data, and is particularly suitable for commercial and industrial applications with high security requirements, complying with data security regulations for the protection of sensitive information.

[0039] Further, in one embodiment, before step S10, the following steps are included: The host manages multiple logical spaces on the hard drive and the user password for each logical space.

[0040] In this embodiment, before performing any encryption management operations, the host uses dedicated management software to logically partition the hard drive and configure password policies. Specifically, the host can divide the physical storage space of the hard drive into multiple independent logical spaces (such as LUN0, LUN1, etc.), and each logical space can be configured with an independent access password and security policy. The host management interface provides intuitive operation options, allowing users to create and delete logical spaces, and set access permissions and password policies for each space. The logical principle of this multi-logical space management is that by virtualizing the physical hard drive into multiple independent secure areas, it enables isolated access to the same physical device by different users or application scenarios, with data encryption and access control in each area being independent of each other. On the one hand, it meets the needs of multiple users sharing the same storage device, which is particularly suitable for departmental data isolation in enterprise environments; on the other hand, even if the password of one logical space is cracked, the data in other logical spaces remains secure, achieving fine-grained security protection and greatly expanding the application scenarios of hard drive encryption technology.

[0041] Secondly, embodiments of this application also provide a hard disk encryption management device.

[0042] In one embodiment, reference is made to Figure 6 , Figure 6 This is a functional module diagram of an embodiment of the hard disk encryption management device of this application, as shown below. Figure 6 As shown, the hard disk encryption management device includes: The receiving module 10 is used for the hard disk to receive manufacturer-defined commands from the host, wherein the manufacturer-defined commands encapsulate encrypted management commands. Parsing module 20 is used to parse manufacturer-defined commands to obtain encryption management commands; The password setting module 30 is used to convert the first plaintext password into a first ciphertext password through an encryption algorithm when the encryption management command is the password setting command and the first logical space of the hard disk is in an unencrypted or unlocked state. The password setting command carries the first logical space and the first plaintext password. The data storage module 40 is used to load the first ciphertext password into the encryption engine of the hard disk. The encryption engine uses the first ciphertext password as the key to convert the first preset data into first encrypted data and saves the first encrypted data to the spare area corresponding to the first logical space of the hard disk. The setting status module 50 is used to set the first logical space of the hard disk to an encrypted and unlocked state after the first encrypted data is successfully saved, and to reply to the host with the command execution result.

[0043] Furthermore, in one embodiment, the hard disk encryption management device further includes an erasure password module, used for: When the encryption management command is the erase password command, if the first logical space of the hard disk is in a locked or unlocked state, the second plaintext password is converted into a second ciphertext password through an encryption algorithm. The erase password command carries the first logical space and the second plaintext password. If the second plaintext password matches the preset super password, then the first logical space of the hard drive is set to an unencrypted state; If the second plaintext password does not match the preset super password, the first encrypted data is read from the spare area corresponding to the first logical space of the hard disk, the second ciphertext password is loaded into the encryption engine of the hard disk, and the encryption engine uses the second ciphertext password as the key to decrypt the first encrypted data to obtain the first decrypted data. If the first decrypted data is consistent with the first preset data, then the first logical space of the hard disk is set to an unencrypted state; If the first decrypted data is inconsistent with the first preset data, then reply to the host with a password error.

[0044] Furthermore, in one embodiment, the hard disk encryption management device further includes an unlocking module, used for: When the encryption management command is an unlock command, if the first logical space of the hard disk is locked, the third plaintext password is converted into a third ciphertext password through an encryption algorithm. The unlock command carries the first logical space and the third plaintext password. Read the first encrypted data from the spare area corresponding to the first logical space of the hard disk, load the third ciphertext password into the encryption engine of the hard disk, and use the third ciphertext password as the key to decrypt the first encrypted data to obtain the second decrypted data; If the second decrypted data is consistent with the first preset data, then the first logical space of the hard disk is set to the unlocked state; If the second decrypted data is inconsistent with the first preset data, the system will reply to the host with a password error and count the number of password errors.

[0045] Furthermore, in one embodiment, the hard disk encryption management device further includes a data erasure module, used for: When the number of incorrect password attempts exceeds the preset limit, erase all data on the hard drive, set the hard drive to an unencrypted state, and restore the current state of the hard drive to the host.

[0046] Furthermore, in one embodiment, the hard disk encryption management device further includes a logical space management module, used for: The host manages multiple logical spaces on the hard drive and the user password for each logical space.

[0047] The functions of each module in the aforementioned hard disk encryption management device correspond to the steps in the aforementioned hard disk encryption management method embodiment, and their functions and implementation processes will not be described in detail here.

[0048] Thirdly, embodiments of this application provide a hard disk encryption management device.

[0049] Reference Figure 7 , Figure 7 This is a schematic diagram of the hardware structure of the hard disk encryption management device involved in the embodiments of this application. In the embodiments of this application, the hard disk encryption management device may include a processor, a memory, a communication interface, and a communication bus.

[0050] The communication bus can be of any type and is used to interconnect the processor, memory, and communication interface.

[0051] The communication interface includes input / output (I / O) interfaces, physical interfaces, and logical interfaces used for interconnecting internal components of the hard disk encryption management device, as well as interfaces used for interconnecting the hard disk encryption management device with other devices (such as other computing devices or user equipment). Physical interfaces can be Ethernet interfaces, fiber optic interfaces, ATM interfaces, etc.; user equipment can be displays, keyboards, etc.

[0052] Memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0053] The processor can be a general-purpose processor, which can call the hard disk encryption management program stored in the memory and execute the hard disk encryption management method provided in the embodiments of this application. For example, the general-purpose processor can be a central processing unit (CPU). The method executed when the hard disk encryption management program is called can be referred to in the various embodiments of the hard disk encryption management method of this application, and will not be repeated here.

[0054] Those skilled in the art will understand that Figure 7 The hardware structure shown does not constitute a limitation of this application and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0055] Fourthly, embodiments of this application also provide a readable storage medium.

[0056] The present application has a readable storage medium storing a hard disk encryption management program, wherein when the hard disk encryption management program is executed by a processor, it implements the steps of the hard disk encryption management method described above.

[0057] The method implemented when the hard disk encryption management program is executed can be referred to in various embodiments of the hard disk encryption management method of this application, and will not be repeated here.

[0058] It should be noted that the sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0059] The terms "comprising" and "having," and any variations thereof, in the specification, claims, and accompanying drawings of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus. The terms "first," "second," and "third," etc., are used to distinguish different objects, etc., and do not indicate a sequence, nor do they limit "first," "second," and "third" to different types.

[0060] In the description of the embodiments of this application, terms such as "exemplary," "for example," or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplary," "for example," or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary," "for example," or "for instance" is intended to present the relevant concepts in a concrete manner.

[0061] In the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in the text is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more.

[0062] In some processes described in the embodiments of this application, multiple operations or steps are included in a specific order. However, it should be understood that these operations or steps may not be executed in the order they appear in the embodiments of this application, or they may be executed in parallel. The sequence number of the operation is only used to distinguish different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed sequentially or in parallel, and these operations or steps may be combined.

[0063] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device to execute the methods described in the various embodiments of this application.

[0064] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A hard disk encryption management method, characterized in that, The hard disk encryption management method includes: The hard drive receives manufacturer-defined commands from the host, which encapsulate encrypted management commands. The vendor-defined commands are parsed to obtain the encryption management commands; When the encryption management command is the password setting command, if the first logical space of the hard disk is in an unencrypted or unlocked state, the first plaintext password is converted into the first ciphertext password through an encryption algorithm. The password setting command carries the first logical space and the first plaintext password. The first ciphertext password is loaded into the encryption engine of the hard disk. The encryption engine uses the first ciphertext password as the key to convert the first preset data into the first encrypted data and saves the first encrypted data to the spare area corresponding to the first logical space of the hard disk. After the first encrypted data is successfully saved, the first logical space of the hard drive is set to an encrypted and unlocked state, and the command execution result is sent back to the host.

2. The hard disk encryption management method as described in claim 1, characterized in that, After parsing the vendor-defined commands to obtain the encryption management commands, the process includes: When the encryption management command is the erase password command, if the first logical space of the hard disk is in a locked or unlocked state, the second plaintext password is converted into a second ciphertext password through an encryption algorithm. The erase password command carries the first logical space and the second plaintext password. If the second plaintext password matches the preset super password, then the first logical space of the hard drive is set to an unencrypted state; If the second plaintext password does not match the preset super password, the first encrypted data is read from the spare area corresponding to the first logical space of the hard disk, the second ciphertext password is loaded into the encryption engine of the hard disk, and the encryption engine uses the second ciphertext password as the key to decrypt the first encrypted data to obtain the first decrypted data. If the first decrypted data is consistent with the first preset data, then the first logical space of the hard disk is set to an unencrypted state; If the first decrypted data is inconsistent with the first preset data, then reply to the host with a password error.

3. The hard disk encryption management method as described in claim 1, characterized in that, After parsing the vendor-defined commands to obtain the encryption management commands, the process includes: When the encryption management command is an unlock command, if the first logical space of the hard disk is locked, the third plaintext password is converted into a third ciphertext password through an encryption algorithm. The unlock command carries the first logical space and the third plaintext password. Read the first encrypted data from the spare area corresponding to the first logical space of the hard disk, load the third ciphertext password into the encryption engine of the hard disk, and use the third ciphertext password as the key to decrypt the first encrypted data to obtain the second decrypted data; If the second decrypted data is consistent with the first preset data, then the first logical space of the hard disk is set to the unlocked state; If the second decrypted data is inconsistent with the first preset data, the system will reply to the host with a password error and count the number of password errors.

4. The hard disk encryption management method as described in claim 3, characterized in that, Following the count of incorrect password attempts, the following is included: When the number of incorrect password attempts exceeds the preset limit, erase all data on the hard drive, set the hard drive to an unencrypted state, and restore the current state of the hard drive to the host.

5. The hard disk encryption management method as described in claim 1, characterized in that, Before the hard drive receives vendor-defined commands from the host, the following is included: The host manages multiple logical spaces on the hard drive and the user password for each logical space.

6. A hard disk encryption management device, characterized in that, The hard disk encryption management device includes: The receiving module is used for the hard drive to receive manufacturer-defined commands from the host, which encapsulate encrypted management commands. The parsing module is used to parse vendor-defined commands to obtain encryption management commands; The password setting module is used to convert the first plaintext password into a first ciphertext password using an encryption algorithm when the encryption management command is the password setting command and the first logical space of the hard disk is in an unencrypted or unlocked state. The password setting command carries the first logical space and the first plaintext password. The data storage module is used to load the first ciphertext password into the encryption engine of the hard disk. The encryption engine uses the first ciphertext password as the key to convert the first preset data into the first encrypted data and saves the first encrypted data to the spare area corresponding to the first logical space of the hard disk. The status module is used to set the first logical space of the hard disk to an encrypted and unlocked state after the first encrypted data is successfully saved, and to reply to the host with the command execution result.

7. The hard disk encryption management device as described in claim 6, characterized in that, The hard disk encryption management device also includes an erase password module, used for: When the encryption management command is the erase password command, if the first logical space of the hard disk is in a locked or unlocked state, the second plaintext password is converted into a second ciphertext password through an encryption algorithm. The erase password command carries the first logical space and the second plaintext password. If the second plaintext password matches the preset super password, then the first logical space of the hard drive is set to an unencrypted state; If the second plaintext password does not match the preset super password, the first encrypted data is read from the spare area corresponding to the first logical space of the hard disk, the second ciphertext password is loaded into the encryption engine of the hard disk, and the encryption engine uses the second ciphertext password as the key to decrypt the first encrypted data to obtain the first decrypted data. If the first decrypted data is consistent with the first preset data, then the first logical space of the hard disk is set to an unencrypted state; If the first decrypted data is inconsistent with the first preset data, then reply to the host with a password error.

8. The hard disk encryption management device as described in claim 6, characterized in that, The hard disk encryption management device also includes an unlocking module, used for: When the encryption management command is an unlock command, if the first logical space of the hard disk is locked, the third plaintext password is converted into a third ciphertext password through an encryption algorithm. The unlock command carries the first logical space and the third plaintext password. Read the first encrypted data from the spare area corresponding to the first logical space of the hard disk, load the third ciphertext password into the encryption engine of the hard disk, and use the third ciphertext password as the key to decrypt the first encrypted data to obtain the second decrypted data; If the second decrypted data is consistent with the first preset data, then the first logical space of the hard disk is set to the unlocked state; If the second decrypted data is inconsistent with the first preset data, the system will reply to the host with a password error and count the number of password errors.

9. A hard disk encryption management device, characterized in that, The hard disk encryption management device includes a processor, a memory, and a hard disk encryption management program stored in the memory and executable by the processor, wherein when the hard disk encryption management program is executed by the processor, it implements the steps of the hard disk encryption management method as described in any one of claims 1 to 5.

10. A readable storage medium, characterized in that, The readable storage medium stores a hard disk encryption management program, wherein when the hard disk encryption management program is executed by a processor, it implements the steps of the hard disk encryption management method as described in any one of claims 1 to 5.

Images