Trigger verification method and device for ssd security freeze lock function and computer device

Abstract

The application relates to a method and device for triggering verification of an SSD security freeze lock function, computer equipment and a storage medium, wherein the method comprises the following steps: obtaining a triggering verification request of the SSD security freeze lock function; running a test script according to the triggering verification request, simulating a BIOS issuing a security freeze lock command at startup to make a solid state disk to be tested enter a frozen state; checking whether the solid state disk has entered the frozen state; if it is confirmed that the solid state disk has entered the frozen state, simulating issuing an entering D3cold state command to make the solid state disk to be tested enter a D3cold state; waking up the solid state disk from the D3cold state and checking whether the solid state disk to be tested has been unfrozen; if it is confirmed that the solid state disk has been unfrozen, simulating issuing a Block SID Authentication command; and checking again whether the solid state disk has entered the frozen state. The application effectively improves the test efficiency and saves the test cost.

Description

Technical Field

[0001] This invention relates to the field of storage system technology, and in particular to a method, apparatus, computer device, and storage medium for triggering and verifying the SSD security freeze lock function. Background Technology

[0002] Wake-up from "Modern Standby (S0iX)" on a laptop can be performed without BIOS assistance. However, if the SSD is in "D3cold" mode after entering "Modern Standby (S0iX)" state, it will power off. According to the "ATA / ATAPI Command Set" protocol, the SSD's "ATA SECURITY FREEZE LOCK" state will be cleared upon power-up. This exposes the user to ransomware attacks, which set the security password for the "ATA / ATAPI Command Set" protocol to an unknown value. Preventing ransomware attacks by having the host issue a "Block SID Authentication" command, and the SSD simultaneously triggering the "ATA SECURITY FREEZE LOCK" function upon receiving the command, presents a significant challenge.

[0003] Currently, there are few universal methods to verify whether the "Security Freeze Lock" function is triggered simultaneously after the SSD receives the "Block SID Authentication" command. Generally, the following two methods are used: 1. Select a laptop model that supports the SSD being in "D3cold" state after entering "Modern Standby (S0iX)" and the host issuing the "Block SID Authentication" command after waking from "Modern Standby (S0iX)". 2. Install a tool that can be used to verify the "ATA SECURITY FREEZE LOCK" function of the SSD after waking from "Modern Standby (S0iX)".

[0004] The above methods have the following drawbacks: 1. It is difficult to select suitable laptop models, as it is impossible to directly confirm whether the model supports the "D3cold" state of the SSD after entering "Modern Standby (S0iX)," and it is also impossible to directly confirm whether the host will issue the "Block SID Authentication" command after waking from "Modern Standby (S0iX)." 2. It is necessary to search for tools that can be used to verify the Security FreezeLock function of the SSD after waking from "Modern Standby (S0iX)." Summary of the Invention

[0005] Therefore, it is necessary to provide a method, apparatus, computer equipment, and storage medium for triggering and verifying the SSD security freeze lock function to address the aforementioned technical issues.

[0006] A method for triggering and verifying the SSD security freeze lock function, the method comprising:

[0007] Get the trigger verification request for the SSD security freeze lock function;

[0008] The test script is run according to the trigger verification request to simulate the BIOS issuing a security freeze lock command during startup to make the solid-state drive under test enter a frozen state.

[0009] Check if the solid-state drive is in a frozen state;

[0010] If it has been confirmed that the solid-state drive is in a frozen state, then a command to enter the D3cold state is simulated to make the solid-state drive under test enter the D3cold state.

[0011] The solid-state drive is woken up from the D3cold state, and it is checked whether the solid-state drive under test has been unfrozen.

[0012] If the solid-state drive has been confirmed to be unfrozen, then a Block SID Authentication command is simulated and issued.

[0013] Double-check that the solid-state drive is in a frozen state.

[0014] In one embodiment, the step of rechecking whether the solid-state drive is in a frozen state further includes:

[0015] If the solid-state drive is confirmed to be in a frozen state, the verification will pass; otherwise, the verification will fail.

[0016] In one embodiment, the step of checking whether the solid-state drive is in a frozen state is further included:

[0017] If the solid-state drive is not in a frozen state, the verification fails.

[0018] In one embodiment, after the steps of waking the solid-state drive from the D3cold state and checking whether the solid-state drive under test has been unfrozen, the method further includes:

[0019] If the solid-state drive is not unfrozen, the verification will fail.

[0020] A trigger verification device for SSD security freeze lock function, the device comprising:

[0021] The acquisition module is used to acquire the trigger verification request of the SSD security freeze lock function;

[0022] The first issuing module is used to run a test script according to the trigger verification request, simulating the BIOS issuing a security freeze lock command during power-on to make the solid-state drive under test enter a frozen state.

[0023] The first inspection module is used to check whether the solid-state drive is in a frozen state.

[0024] The second sending module is used to simulate sending a command to enter the D3cold state so that the solid-state drive under test enters the D3cold state if it has been confirmed that the solid-state drive is in a frozen state.

[0025] The second inspection module is used to wake up the solid-state drive from the D3cold state and check whether the solid-state drive under test has been unfrozen.

[0026] The third sending module, if it has confirmed that the solid-state drive has been unfrozen, simulates sending a Block SID Authentication command;

[0027] The third inspection module is used to re-check whether the solid-state drive is in a frozen state.

[0028] In one embodiment, the third inspection module is further configured to:

[0029] If the solid-state drive is confirmed to be in a frozen state, the verification will pass; otherwise, the verification will fail.

[0030] In one embodiment, the first inspection module is further configured to:

[0031] If the solid-state drive is not in a frozen state, the verification fails.

[0032] In one embodiment, the second inspection module is further configured to:

[0033] If the solid-state drive is not unfrozen, the verification will fail.

[0034] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of any of the methods described above.

[0035] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above methods.

[0036] The aforementioned SSD security freeze lock function trigger verification method, device, computer equipment, and storage medium obtain the SSD security freeze lock function trigger verification request; run a test script according to the trigger verification request, simulating the BIOS issuing a security freeze lock command during startup to cause the SSD under test to enter a freeze state; check whether the SSD is already in a freeze state; if the SSD is confirmed to be in a freeze state, simulate issuing a command to enter the D3cold state to cause the SSD under test to enter the D3cold state; wake up the SSD from the D3cold state and check whether the SSD under test has been unfrozen; if the SSD is confirmed to have been unfrozen, simulate issuing a Block SIDAuthentication command; and check again whether the SSD is already in a freeze state. This invention utilizes Ulink's DriveMaster software to write test scripts to verify whether the SSD triggers the security freeze lock function simultaneously after receiving the Block SID Authentication command, eliminating the steps of selecting a laptop model, searching for and installing tools, effectively improving testing efficiency and saving testing costs. Attached Figure Description

[0037] Figure 1 This is a flowchart illustrating the trigger verification method for the SSD security freeze lock function in one embodiment;

[0038] Figure 2 This is a flowchart illustrating the trigger verification method for the SSD security freeze lock function in another embodiment;

[0039] Figure 3 This is a flowchart illustrating the trigger verification method for the SSD security freeze lock function in another embodiment;

[0040] Figure 4 This is a structural block diagram of a trigger verification device for the SSD security freeze lock function in one embodiment;

[0041] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0043] Currently, Lenovo laptops can wake up from "Modern Standby (S0iX)" without BIOS assistance. However, if the SSD uses the "D3cold" method after entering "Modern Standby (S0iX)" state, the SSD will be powered off. According to the "ATA / ATAPI Command Set" protocol, the SSD's "ATASECURITY FREEZE LOCK" state will be cleared upon power-up. This exposes users to ransomware attacks, which set the "ATA / ATAPI Command Set" protocol's security password to an unknown value. To prevent ransomware attacks, Lenovo plans to issue a "Block SID Authentication" command from the host computer. Upon receiving the "Block SID Authentication" command, the SSD will simultaneously trigger the "ATA SECURITY FREEZE LOCK" function.

[0044] The following describes "Modern Standby (S0iX)", "D3cold", "ATA SECURITY FREEZE LOCK", and "Block SID Authentication":

[0045] "Modern Standby (S0iX)" is a sleep power mode for laptops. Its main function is to allow some background applications to continue running while saving power and enabling immediate wake-up. When a laptop enters "Modern Standby (S0iX)" mode, in order to save power, the host can put the SSD into "D3cold" mode.

[0046] "D3cold" is a device power state defined by the PCIe protocol, primarily used by PCIe devices for energy saving. When an NVMe SSD enters "D3cold," the SSD will lose power.

[0047] "ATA SECURITY FREEZE LOCK" is a function defined by the "ATA / ATAPI Command Set" protocol. This function puts the SSD into a frozen state, disabling all security-related functions of the "ATA / ATAPI Command Set" protocol. Its main purpose is to prevent ransomware from setting unknown security passwords for the "ATA / ATAPI Command Set" protocol. However, the frozen state is cleared after the SSD is powered off and then powered on again.

[0048] "Block SID Authentication" is a feature defined by the TCG Storage (Trusted Computing Group Storage) protocol. When an SSD receives the "Block SID Authentication" command, it enters the "Block SID" state. Its main purpose is to prevent ransomware from setting unknown passwords for the TCG Storage protocol. However, the "Block SID" state of the SSD will be cleared after a power outage and subsequent power restoration.

[0049] Currently, there are few universal methods to verify whether the SSD triggers the "ATASECURITY FREEZE LOCK" function simultaneously after receiving the "Block SID Authentication" command. The current methods are: 1. Selecting a laptop model that supports the SSD being in "D3cold" state after entering "ModernStandby (S0iX)" and the host issuing the "Block SID Authentication" command after waking from "Modern Standby (S0iX)"; 2. Installing a tool that can be used to verify the "ATA SECURITY FREEZE LOCK" function of the SSD after waking from "ModernStandby (S0iX)".

[0050] The above method has the following shortcomings: 1. It is difficult to select a suitable laptop model, because it is not possible to directly confirm whether the model supports the "D3cold" state of the SSD after entering "Modern Standby (S0iX)" and whether the host will issue the "Block SID Authentication" command after waking up from "Modern Standby (S0iX)"; 2. It is necessary to search for tools that can be used to verify the Security FreezeLock function of the SSD after waking up from "Modern Standby (S0iX)".

[0051] Based on this, the present invention provides a method for triggering and verifying the SSD security freeze lock function, which aims to eliminate the steps of selecting a laptop model, searching for and installing tools, thereby improving testing efficiency and reducing costs.

[0052] In one embodiment, such as Figure 1 As shown, a method for triggering and verifying the SSD security freeze lock function is provided, the method including:

[0053] Step 102: Obtain the trigger verification request for the SSD security freeze lock function;

[0054] Step 104: Run the test script according to the trigger verification request to simulate the BIOS issuing a security freeze lock command during startup to make the solid-state drive under test enter a frozen state;

[0055] Step 106: Check if the solid-state drive is in a frozen state;

[0056] Step 108: If it has been confirmed that the solid-state drive is in a frozen state, then simulate issuing a command to enter the D3cold state so that the solid-state drive under test enters the D3cold state.

[0057] Step 110: Wake up the solid-state drive from D3cold state and check whether the solid-state drive under test has been unfrozen.

[0058] Step 112: If it has been confirmed that the solid-state drive has been unfrozen, then simulate issuing the Block SIDAuthentication command;

[0059] Step 114: Check again whether the SSD is in a frozen state.

[0060] In this embodiment, a method for triggering and verifying the SSD security freeze lock function is proposed. Using Ulink's DriveMaster software, a test script is written to verify whether the SSD triggers the "ATA SECURITY FREEZE LOCK" function simultaneously after receiving the "Block SID Authentication" command. The implementation steps are as follows:

[0061] First, obtain the trigger verification request for the SSD security freeze lock function. Then, run the test script according to the trigger verification request to simulate the BIOS issuing a security freeze lock command during boot to put the SSD under test into a freeze state.

[0062] Next, check if the solid-state drive is in a frozen state. If it is confirmed that the solid-state drive is in a frozen state, simulate issuing a command to enter the D3cold state so that the solid-state drive under test enters the D3cold state.

[0063] Next, the SSD is woken up from D3cold state, and it is checked whether the SSD under test has been unfrozen. If the SSD has been confirmed to be unfrozen, a Block SID Authentication command is simulated.

[0064] Finally, check again whether the SSD is in a frozen state. If the SSD is confirmed to be in a frozen state, the verification passes; otherwise, the verification fails.

[0065] In this embodiment, a trigger verification request for the SSD security freeze lock function is obtained; a test script is run according to the trigger verification request to simulate the BIOS issuing a security freeze lock command during startup to put the SSD under test into a freeze state; it is checked whether the SSD is already in a freeze state; if the SSD is confirmed to be in a freeze state, a command to enter the D3cold state is simulated to put the SSD under test into the D3cold state; the SSD is woken up from the D3cold state, and it is checked whether the SSD under test has been unfrozen; if the SSD is confirmed to be unfrozen, a Block SID Authentication command is simulated; and the SSD is checked again to see if it is in a freeze state. This solution uses Ulink's DriveMaster software to write test scripts to verify whether the SSD triggers the security freeze lock function when it receives the BlockSID Authentication command, eliminating the steps of selecting a laptop model, searching for and installing tools, effectively improving testing efficiency and saving testing costs.

[0066] In one embodiment, such as Figure 2 As shown, a method for triggering and verifying the SSD security freeze lock function is provided, the method including:

[0067] Step 202: Simulate the BIOS issuing a security freeze lock command during startup to put the solid-state drive under test into a frozen state;

[0068] Step 204: Check if the solid-state drive is in a frozen state;

[0069] Step 206: If the solid-state drive is not in a frozen state, the verification fails.

[0070] Step 208: If it has been confirmed that the solid-state drive is in a frozen state, then simulate issuing a command to enter the D3cold state so that the solid-state drive under test enters the D3cold state.

[0071] Step 210: Wake up the solid-state drive from D3cold state and check whether the solid-state drive under test has been unfrozen.

[0072] Step 212: If the solid-state drive is not unfrozen, the verification will fail.

[0073] Step 214: If it has been confirmed that the solid-state drive has been unfrozen, then simulate issuing the Block SIDAuthentication command;

[0074] Step 216, check again whether the solid-state drive is in a frozen state;

[0075] Step 218: If the solid-state drive is confirmed to be in a frozen state, the verification passes; otherwise, the verification fails.

[0076] Specifically, refer to Figure 3 As shown, this embodiment provides a complete test process implemented through a test script. The test environment for the test script is as follows:

[0077] Hardware Requirements: The computer under test is a desktop computer with an ASUS Z590 motherboard. Specifically, the method described in this embodiment requires a desktop computer, but the specific model is not mandatory. In this embodiment, an ASUS Z590 motherboard is preferred as the computer under test. The SSD under test is an SSD that supports both PCIe and NVMe protocols.

[0078] Software requirements: Operating system is Windows 10; testing software is UlinkDriveMaster8NVMe; test script is a self-written DriveMaster test script.

[0079] The test script execution flow is as follows:

[0080] Step 1: Simulate the BIOS issuing the "ATA SECURITY FREEZE LOCK" command when the laptop boots up, causing the SSD to enter a frozen state.

[0081] Step 2: Confirm that the SSD is in a frozen state.

[0082] Step 3: Issue the command to enter D3cold state to put the SSD into D3cold state. Simulating the laptop entering "ModernStandby (S0iX)", the SSD is in "D3cold" state.

[0083] Step 4: Wake the SSD from D3cold. Simulate the laptop waking from "Modern Standby (S0iX)", at which point the corresponding SSD will wake from D3cold.

[0084] Step 5: Confirm that the SSD is unfrozen.

[0085] Step 6: The simulated host issues the "Block SID Authentication" command.

[0086] Step 7: Confirm that the SSD is in a frozen state.

[0087] In this embodiment, the testing method is applicable to verifying SSD products that support the function of triggering "ATA SECURITY FREEZE LOCK" when receiving the "Block SID Authentication" command. The test eliminates the steps of selecting a laptop model, searching and installing tools, and the test is fully automatic, which improves the testing efficiency and saves testing costs.

[0088] It should be understood that, although Figure 1-3 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1-3 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0089] In one embodiment, such as Figure 4 As shown, a trigger verification device 400 for SSD security freeze lock function is provided, the device comprising:

[0090] Acquisition module 401, the acquisition module is used to acquire the trigger verification request of SSD security freeze lock function;

[0091] The first issuing module 402 is used to run a test script according to the trigger verification request, simulating the BIOS issuing a security freeze lock command during power-on to make the solid-state drive under test enter a frozen state.

[0092] First inspection module 403, the first inspection module is used to check whether the solid-state drive is in a frozen state;

[0093] The second sending module 404 is used to simulate sending a command to enter the D3cold state so that the solid-state drive under test enters the D3cold state if it has been confirmed that the solid-state drive is in a frozen state.

[0094] The second inspection module 405 is used to wake up the solid-state drive from the D3cold state and check whether the solid-state drive under test has been unfrozen.

[0095] The third sending module 406, if it has confirmed that the solid-state drive has been unfrozen, simulates sending a Block SID Authentication command;

[0096] The third inspection module 407 is used to re-check whether the solid-state drive is in a frozen state.

[0097] In one embodiment, the third inspection module 407 is further configured to:

[0098] If the solid-state drive is confirmed to be in a frozen state, the verification will pass; otherwise, the verification will fail.

[0099] In one embodiment, the first inspection module 403 is further configured to:

[0100] If the solid-state drive is not in a frozen state, the verification fails.

[0101] In one embodiment, the second inspection module 405 is further configured to:

[0102] If the solid-state drive is not unfrozen, the verification will fail.

[0103] For specific limitations on the trigger verification device for the SSD security freeze lock function, please refer to the limitations on the trigger verification method for the SSD security freeze lock function mentioned above, which will not be repeated here.

[0104] In one embodiment, a computer device is provided, the internal structure of which can be shown as follows: Figure 5 As shown, the computer device includes a processor, memory, and a network interface connected via a device bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores operating devices, computer programs, and databases. The internal memory provides an environment for the operation of the operating devices and computer programs stored in the non-volatile storage media. The network interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a trigger verification method for an SSD security freeze lock function.

[0105] Those skilled in the art will understand that Figure 5The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0106] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps in the various method embodiments described above.

[0107] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the various method embodiments described above.

[0108] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0109] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0110] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for triggering and verifying the SSD security freeze lock function, characterized in that, The method includes: Get the trigger verification request for the SSD security freeze lock function; The test script is run according to the trigger verification request to simulate the BIOS issuing a security freeze lock command during startup to put the solid-state drive under test into a frozen state; wherein, the test script is run on a desktop computer based on Ulink DriveMaster software, and the desktop computer is configured with a solid-state drive that supports PCIe and NVMe protocols; Check if the solid-state drive is in a frozen state; If it has been confirmed that the solid-state drive is in a frozen state, then a command to enter the D3cold state is simulated to make the solid-state drive under test enter the D3cold state. The solid-state drive is woken up from the D3cold state, and it is checked whether the solid-state drive under test has been unfrozen. If the solid-state drive has been confirmed to be unfrozen, then a Block SID Authentication command is simulated and issued. Double-check that the solid-state drive is in a frozen state; If the solid-state drive is confirmed to be in a frozen state, the verification will pass; otherwise, the verification will fail.

2. The method for triggering and verifying the SSD security freeze lock function according to claim 1, characterized in that, The step of checking whether the solid-state drive is in a frozen state is further included: If the solid-state drive is not in a frozen state, the verification fails.

3. The trigger verification method for the SSD security freeze lock function according to claim 2, characterized in that, After the steps of waking the solid-state drive from the D3cold state and checking whether the solid-state drive under test has been unfrozen, the method further includes: If the solid-state drive is not unfrozen, the verification will fail.

4. A trigger verification device for SSD security freeze lock function, characterized in that, The device includes: The acquisition module is used to acquire the trigger verification request of the SSD security freeze lock function; The first issuing module is used to run a test script according to the trigger verification request, simulating the BIOS issuing a security freeze lock command during startup to make the solid-state drive under test enter a frozen state; wherein, the test script is run on a desktop computer based on Ulink DriveMaster software, and the desktop computer is configured with a solid-state drive that supports PCIe and NVMe protocols; The first inspection module is used to check whether the solid-state drive is in a frozen state. The second sending module is used to simulate sending a command to enter the D3cold state so that the solid-state drive under test enters the D3cold state if it has been confirmed that the solid-state drive is in a frozen state. The second inspection module is used to wake up the solid-state drive from the D3cold state and check whether the solid-state drive under test has been unfrozen. The third sending module, if it has confirmed that the solid-state drive has been unfrozen, simulates sending a Block SID Authentication command; The third inspection module is used to check again whether the solid-state drive is in a frozen state. If it is confirmed that the solid-state drive is in a frozen state, the verification is successful; otherwise, the verification fails.

5. The trigger verification device for the SSD security freeze lock function according to claim 4, characterized in that, The first inspection module is also used for: If the solid-state drive is not in a frozen state, the verification fails.

6. The trigger verification device for the SSD security freeze lock function according to claim 5, characterized in that, The second inspection module is also used for: If the solid-state drive is not unfrozen, the verification will fail.

7. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 3.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 3.

Images