A method for realizing control of SSD partition hiding based on a SATA encryption bridge

Abstract

The application discloses a kind of based on SATA encryption bridge implementation control SSD partition hiding method, belong to SSD reading and writing technical field, the method is used for data reading and writing system, the data reading and writing system includes PC, SATA encryption bridge and SSD, the PC is connected the SSD by the SATA encryption bridge, the method includes: step 1: receiving the configuration information sent by PC, the configuration information includes the logical offset address of hidden partition, hidden area space size, hidden area user password and first encryption key;Step 2: according to the configuration information, set hidden partition in the SSD.This application based on SATA encryption bridge implementation control SSD partition hiding method, the configuration of visible partition and hidden partition is realized to SSD, effectively guarantee the security of data storage, reduce the possibility of sensitive data leakage;Hidden partition increases the setting of user password, can effectively prevent illegal user operation and cause data loss.

Description

Technical Field

[0001] This invention relates to the field of SSD (Solid State Disk) read / write technology, and in particular to a method for controlling the hiding of SSD partitions based on a SATA encrypted bridge. Background Technology

[0002] In personal computers (PCs), storage devices such as hard drives and USB flash drives are connected to the PC through various interfaces, among which SATA (Serial Advanced Technology Attachment) is one of the most common. SATA mainly refers to the connection standard between hard drives and computers, allowing users to easily connect hard drives and other storage devices to their computers. SATA features data integrity, reliability, large storage capacity, and hot-swapping support. Currently, traditionally, SATA master devices and SATA slave devices are directly connected, with the SATA master device directly controlling read and write operations on the SATA slave device.

[0003] Currently, existing SATA bridge chips on the market only convert voltage to provide storage capabilities for PCs. They cannot dynamically configure the encryption and decryption operations of read and write data or commands, nor can they monitor data and hard drive parameters, resulting in poor security and flexibility.

[0004] In addition, when an external SSD storage module is connected to a SATA bridge, the PC will see all the partition data of the SSD. If an unauthorized user uses it, there is a risk of important data leakage. Summary of the Invention

[0005] The technical problem to be solved by this invention is to provide a highly secure method for controlling the hiding of SSD partitions based on a SATA encrypted bridge.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] A method for controlling SSD partition hiding based on a SATA encrypted bridge, used in a data read / write system, the data read / write system including a PC, a SATA encrypted bridge, and an SSD, wherein the PC is connected to the SSD through the SATA encrypted bridge, the method comprising:

[0008] Step 1: Receive configuration information sent by the PC, including the logical offset address of the hidden partition, the size of the hidden area space, the user password of the hidden area, and the first encryption key;

[0009] Step 2: Based on the configuration information, set a hidden partition within the SSD.

[0010] The present invention has the following beneficial effects:

[0011] This invention provides a method for controlling SSD partition hiding based on a SATA encrypted bridge. It allows for the configuration of visible and hidden partitions on the SSD, effectively ensuring data storage security. Compared to traditional SSDs, it offers certain advantages in use:

[0012] (1) The disk can use SM4 / AES and other methods to encrypt data, which ensures the data security of the stored files;

[0013] (2) The use of software to control hidden partitions on the disk effectively reduces the possibility of sensitive data leakage;

[0014] (3) Adding a user password to the hidden disk partition can effectively prevent data loss caused by unauthorized user operations. Attached Figure Description

[0015] Figure 1 This is a schematic diagram illustrating an application scenario of the method for controlling SSD partition hiding based on a SATA encrypted bridge according to the present invention.

[0016] Figure 2 This is a schematic diagram of the method for controlling SSD partition hiding based on a SATA encrypted bridge according to the present invention. Detailed Implementation

[0017] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0018] This invention provides a method for controlling SSD partition hiding based on a SATA encrypted bridge, used in data read / write systems, such as... Figure 1 As shown, the data read / write system includes a PC, a SATA encrypted bridge, and an SSD. The PC is connected to the SSD through the SATA encrypted bridge.

[0019] like Figure 2 As shown, this method is executed by the SATA encryption bridge and may specifically include:

[0020] Step 1: Receive configuration information sent by the PC, including the logical offset address of the hidden partition, the size of the hidden area space, the user password of the hidden area, and the first encryption key;

[0021] Step 2: Based on the configuration information, set a hidden partition within the SSD.

[0022] This step involves setting up a hidden partition on the SSD based on the logical offset address and size of the hidden area. The specific setup method is common knowledge in this field and will not be elaborated here. In this step, the configuration information can also be stored for later use. Specifically, it can be stored in the Flash area of ​​the controller chip within the SATA encryption bridge (this area is protected against power failure).

[0023] In this invention, controlling the hidden SSD partition means using custom commands based on the SATA protocol to select and configure the logical offset address and storage space of the hidden partition. Users can securely store important data files through read and write commands. After the device is initialized at the factory, the PC only displays the visible partition space of the SSD, and the hidden partition can only be operated through command tools.

[0024] This invention provides a method for controlling SSD partition hiding based on a SATA encrypted bridge. It allows for the configuration of visible and hidden partitions on the SSD, effectively ensuring data storage security. Compared to traditional SSDs, it offers certain advantages in use:

[0025] (1) The disk can use SM4 / AES and other methods to encrypt data, which ensures the data security of the stored files;

[0026] (2) The use of software to control hidden partitions on the disk effectively reduces the possibility of sensitive data leakage;

[0027] (3) Adding a user password to the hidden disk partition can effectively prevent data loss caused by unauthorized user operations.

[0028] This invention is applicable to fields that are sensitive to data security, such as government, military, enterprises, schools, information services, telecommunications, and finance.

[0029] To encrypt and decrypt stored data and further improve security, preferably, step 2 may be followed during data writing as follows:

[0030] Step 3: Receive a data write command sent by the PC, the data write command including the location to be written and the data to be written;

[0031] Step 4: Determine whether the location to be written is the hidden partition and whether the data writing instruction includes the correct hidden partition user password. If both are true, proceed to the next step.

[0032] As an optional embodiment, step 4 may include:

[0033] If the location to be written is the hidden partition, and the data write instruction does not include the correct hidden partition user password, then the operation is rejected;

[0034] In this embodiment, since the PC client failed to provide the correct password for the hidden partition, the PC client user is determined to be an unauthorized user, and their data writing operation to the SSD hidden partition is denied.

[0035] Step 5: After encrypting the data to be written using the first encryption key, write it to the SSD according to the location to be written.

[0036] During data reading, preferably, step 5 may be followed by:

[0037] Step 6: Receive a data read instruction sent by the PC, the data read instruction including the location to be read and the data to be read;

[0038] Step 7: Determine whether the location to be read is the hidden partition and whether the data reading instruction includes the correct hidden partition user password. If both are yes, proceed to the next step.

[0039] As an optional embodiment, step 7 may include:

[0040] If the location to be read is the hidden partition, and the data read instruction does not include the correct hidden partition user password, then the operation is rejected;

[0041] In this embodiment, since the PC client failed to provide the correct password for the hidden partition, the PC client user is determined to be an unauthorized user, and their data reading operation on the SSD hidden partition is denied.

[0042] Step 8: Read the data to be read from the SSD according to the location to be read, decrypt it using the first encryption key, and then send it to the PC.

[0043] In this invention, the configuration information may also include the encryption algorithm and encryption mode used when encrypting the data in the hidden partition, so that users can set it as needed.

[0044] Furthermore, to improve the security of the stored data in the visible partition, the configuration information may also include a second encryption key for the visible partition;

[0045] At this point, during data writing, step 4 may include:

[0046] If the location to be written is not the hidden partition, then the data to be written is encrypted using the second encryption key and written to the SSD according to the location to be written.

[0047] Since the location to be written is not a hidden partition, it is a visible partition. Therefore, the data being written is encrypted to improve security.

[0048] Accordingly, during data reading, step 7 may include:

[0049] If the location to be read is not the hidden partition, the data to be read is read from the SSD according to the location to be read, and then decrypted using the second encryption key before being sent to the PC.

[0050] Since the location to be read is not a hidden partition, it is a visible partition. The data read here has been decrypted to improve security.

[0051] In a specific implementation of this invention, the workflow on the PC can be achieved through... Figure 2 The "SATA Bridge Security Operation Tool" shown is implemented in the form of software. The main functions of this software can include setting the following parameters: the logical offset address of the hidden partition, the size of the hidden area space, the user password and encryption key of the hidden area, the encryption algorithm, the encryption mode, and file data reading and writing.

[0052] In this invention, the use of the device (SATA encrypted bridge and SSD) is divided into two stages: the "factory delivery stage" (i.e., steps 1-2 above) and the "usage stage" (i.e., steps 3-8 above). In the "factory delivery stage," the user can know the original storage space size of the SSD storage module through the SATA encrypted bridge on the PC. When using the device, the user performs factory configuration initialization. The factory configuration can be performed using the "SATA Bridge Security Operation Tool" according to individual needs. After the configuration is completed, the user can power off and restart the device, after which the device enters the "usage stage."

[0053] Once the device enters the "use phase," it cannot be restored to the "factory default phase" unless the firmware is downloaded again. In other words, once the user has completed the configuration, it is not allowed to reconfigure it again to avoid serious problems such as data loss caused by user misoperation.

[0054] After the user has configured the data, data read and write operations can only be performed through the "SATA Bridge Security Operation Tool". The "gray area" (hidden partition) is not allowed to be displayed on the PC and cannot be operated directly by the user.

[0055] Data in the "white zone" (visible partition) will also be encrypted and decrypted after passing through the SATA encryption bridge. For security reasons, the "gray zone" allows for optional "user password" and "encryption key" operations, while the "white zone" does not have user password operations, and the encryption key is a fixed key on the device side, meaning that once the user specifies the key, it cannot be changed.

[0056] In this invention, the SATA encryption bridge and the SSD can have a one-to-one correspondence, and the relevant workflow can be executed according to the aforementioned method. However, in actual use, there may be multiple SSDs. In application scenarios where the SATA encryption bridge and SSD have a one-to-many relationship, the method of this invention is preferably improved as follows:

[0057] Step 2 may include:

[0058] Obtain the unique identifier information of the currently connected SSD, establish a correspondence between the unique identifier information and the configuration information, and store them;

[0059] In this step, the unique identification information is information that can uniquely identify the SSD, such as the product serial number; the unique identification information and configuration information are linked and stored locally (within the SATA encrypted bridge) for use in subsequent steps.

[0060] At this point, step 4 further involves: determining whether the location to be written is the hidden partition of the currently connected SSD, and whether the data writing instruction includes the correct hidden partition user password. If both are true, then proceed to the next step.

[0061] Step 5 further comprises: encrypting the data to be written using the first encryption key corresponding to the currently connected SSD, and then writing it to the currently connected SSD according to the location to be written;

[0062] Step 7 further involves: determining whether the location to be read is the hidden partition of the currently connected SSD, and whether the data read instruction includes the correct hidden partition user password. If both are true, then proceed to the next step.

[0063] Step 8 further comprises: reading the data to be read from the currently connected SSD according to the location to be read, decrypting it using the first encryption key corresponding to the currently connected SSD, and then sending it to the PC.

[0064] In this way, by obtaining the unique identification information of the currently connected SSD, establishing a correspondence between the unique identification information and the configuration information and storing it, the method of the present invention can be applied to a one-to-many application scenario where the SATA encryption bridge and the SSD are connected. Depending on the different SSDs currently connected, the SATA encryption bridge selects the corresponding configuration information (including the logical offset address of the hidden partition, the size of the hidden area space, the user password of the hidden area, and the first encryption key, etc.) to operate on the SSD, thereby expanding the application scenarios and making it more convenient for users to use.

[0065] In the above embodiments, the first encryption key and the second encryption key can be the same, but to improve security, they are preferably different.

[0066] In this invention, a SATA encryption bridge connects the SATA master device and the SATA slave device. The SATA encryption bridge preferably uses the T660 chip from Shandong Fangcun Microelectronics Technology Co., Ltd., which employs a domestically produced CK core and can monitor data and commands between the SATA master and slave devices in real time. The T660 chip preferably includes a CRYPTO hardware module to support national cryptographic algorithms such as SM4 and AES256, and supports encryption modes such as ECB, CBC, and OFB. Its encryption algorithms and modes can be configured by the user. Figure 1 As shown, when PC data flows into the SATA encrypted bridge from the SATA Host interface, the T660 chip starts the CRYPTO module to encrypt the data. After encryption, the data is saved to other storage devices such as SSD. Conversely, when the PC initiates an action to read data files from the SSD, the data will flow into the T660 chip through the SATA Device interface, and then be decrypted by the CRYPTO module. The decrypted data is finally transmitted to the PC through the SATA Host interface.

[0067] In summary, to address the drawback of SATA bridge chips not being able to encrypt data, this invention provides a domestically produced SATA encryption bridge device. This device connects between a SATA master device and a SATA slave device, and uses the Fangcun T660 domestic encryption chip. This chip uses hardware encryption algorithms SM4 and AES256 to encrypt and decrypt data exchanged between the SATA master and slave devices, monitors data and hard drives, and the encryption algorithm and encryption mode are user-configurable.

[0068] This SATA encryption bridge device supports the SATA 3.0 protocol and is backward compatible with SATA 2.0 and SATA 1.0. It has a communication capability of up to 6Gbps and its hardware encryption module has a performance of 800MB / s@200MHz. After enabling the hardware encryption module, the data encryption and decryption read and write performance for SSD storage modules reaches up to 600MB / s.

[0069] The present invention provides a method for controlling the hiding of SSD partitions based on SATA encryption bridges. For SSD storage, as a SATA slave device, the SATA encryption bridge not only encrypts and decrypts the data stored in the SSD, making the SSD module unreadable and unwriteable after being connected to other SATA bridges, but also hides some SSD partitions as a private area for storing important data files.

[0070] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for controlling SSD partition hiding based on a SATA encrypted bridge, used in a data read / write system, the data read / write system comprising a PC, a SATA encrypted bridge, and an SSD, wherein the PC is connected to the SSD through the SATA encrypted bridge, characterized in that, The method includes: Step 1: Receive configuration information sent by the PC, including the logical offset address of the hidden partition, the size of the hidden area space, the user password of the hidden area, and the first encryption key; Step 2: Based on the configuration information, set a hidden partition within the SSD; Step 3: Receive a data write command sent by the PC, the data write command including the location to be written and the data to be written; Step 4: Determine whether the location to be written is the hidden partition and whether the data writing instruction includes the correct hidden partition user password. If both are true, proceed to the next step. Step 5: After encrypting the data to be written using the first encryption key, write it to the SSD according to the location to be written; Step 6: Receive a data read instruction sent by the PC, the data read instruction including the location to be read and the data to be read; Step 7: Determine whether the location to be read is the hidden partition and whether the data reading instruction includes the correct hidden partition user password. If both are yes, proceed to the next step. Step 8: Read the data to be read from the SSD according to the location to be read, decrypt it using the first encryption key, and then send it to the PC.

2. The method according to claim 1, characterized in that, The configuration information also includes the encryption algorithm and encryption mode used when encrypting the data in the hidden partition.

3. The method according to claim 1, characterized in that, The configuration information also includes a second encryption key for the visible partition; Step 4 includes: If the location to be written is the hidden partition, and the data write instruction does not include the correct hidden partition user password, then the operation is rejected; Alternatively, if the location to be written is not the hidden partition, the data to be written is encrypted using the second encryption key and then written to the SSD according to the location to be written.

4. The method according to claim 3, characterized in that, Step 7 includes: If the location to be read is the hidden partition, and the data read instruction does not include the correct hidden partition user password, then the operation is rejected; Alternatively, if the location to be read is not the hidden partition, the data to be read is read from the SSD according to the location to be read, decrypted using the second encryption key, and then sent to the PC.

5. The method according to claim 1, characterized in that, Step 2 includes: Obtain the unique identifier information of the currently connected SSD, establish a correspondence between the unique identifier information and the configuration information, and store them; Step 4 further involves: determining whether the location to be written is the hidden partition of the currently connected SSD, and whether the data writing instruction includes the correct hidden partition user password. If both are true, then proceed to the next step. Step 5 further comprises: encrypting the data to be written using the first encryption key corresponding to the currently connected SSD, and then writing it to the currently connected SSD according to the location to be written; Step 7 further involves: determining whether the location to be read is the hidden partition of the currently connected SSD, and whether the data read instruction includes the correct hidden partition user password. If both are true, then proceed to the next step. Step 8 further comprises: reading the data to be read from the currently connected SSD according to the location to be read, decrypting it using the first encryption key corresponding to the currently connected SSD, and then sending it to the PC.

6. The method according to claim 3, characterized in that, The first encryption key and the second encryption key are different.

7. The method according to claim 1, characterized in that, The SATA encryption bridge uses the T660 chip from Shandong Fangcun Microelectronics Technology Co., Ltd.

8. The method according to claim 7, characterized in that, The T660 chip includes a CRYPTO hardware module.

Images