A storage medium access control method, device, equipment and medium

Abstract

The application discloses a storage medium access control method, device, equipment and medium, and relates to the technical field of electronic circuits and semiconductors, and comprises the following steps: after the storage medium is powered on, a reset command issued by a host is acquired; a reset operation is performed on the storage medium based on the reset command, and it is judged whether a preset security enable bit is in a set state; if the security enable bit is in the set state, security authentication is performed; and if the security enable bit is not in the set state, subsequent reset operations are completed according to a normal operation sequence of the storage medium. In the application, if the security enable bit has been set, security authentication operation needs to be performed, which is used for controlling the safe access of data on the storage medium, so that the data stored on the medium is safely protected.

Description

Technical Field

[0001] This invention relates to the field of electronic circuits and semiconductor technology, and in particular to a method, apparatus, device and medium for managing access permissions of storage media. Background Technology

[0002] Currently, when reading user data from storage devices such as flash memory chips, the user's physical data can be obtained through standard command read, write, and erase interface methods on the storage medium. However, these unprotected standard commands can easily lead to the leakage of sensitive user data if the storage medium is replaced with another controller chip.

[0003] In summary, how to protect the data on storage media and prevent it from being illegally accessed is a problem that needs to be solved. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide an access control method, apparatus, device, and medium for a storage medium, capable of protecting data on the storage medium and preventing unauthorized access to the data. The specific solution is as follows:

[0005] In a first aspect, this application discloses an access control method for a storage medium, comprising:

[0006] After the storage medium is powered on, it receives a reset command from the host.

[0007] The storage medium is reset based on the reset command, and it is determined whether the preset security enable bit is set.

[0008] If the bit is set, then security authentication is performed;

[0009] If the state is not set, the reset operation will be completed according to the normal operating sequence of the storage medium.

[0010] Optionally, the security authentication includes:

[0011] Obtain the setting command issued by the host, and determine whether the target security parameter in the setting command meets the corresponding preset matching conditions;

[0012] If not satisfied, all control signals in the safety parameters will be disabled.

[0013] Optionally, determining whether the target security parameter in the setting command meets the corresponding preset matching conditions includes:

[0014] Determine the target security parameters in the setting command; the target security parameters include user password, serial number, and control signal permissions.

[0015] Determine whether the user password, the serial number, and the control signal permissions meet the corresponding preset matching conditions.

[0016] Optionally, determining whether the user password, the serial number, and the control signal permissions meet the corresponding preset matching conditions includes:

[0017] Determine whether the user password meets a first preset matching condition; the first preset matching condition is that the user password matches.

[0018] Determine whether the serial number meets the second preset matching condition; the second preset matching condition is that the serial numbers are inconsistent.

[0019] Determine whether the control signal permissions meet a third preset matching condition; the third preset matching condition is that the control signal permissions are consistent.

[0020] Optionally, after determining whether the user password, the serial number, and the control signal permission meet the corresponding preset matching conditions, the method further includes:

[0021] If the user password, the serial number, and the control signal permissions all meet the corresponding preset matching conditions, then all control signals in the security parameters are enabled.

[0022] Optionally, after determining whether the user password, the serial number, and the control signal permission meet the corresponding preset matching conditions, the method further includes:

[0023] If the user password and the serial number satisfy the corresponding first preset matching condition and the second preset matching condition, respectively, and the control signal permission does not satisfy the third preset matching condition, then only the single-ended read enable control signal in the security parameters is enabled.

[0024] Optionally, the control signals in the security parameters include a single-ended read enable control signal, a single-ended write enable control signal, a differential read enable control signal, and a differential write enable control signal.

[0025] Optionally, after obtaining the setting command issued by the host, the method further includes:

[0026] Retrieve the start address parameter and end address parameter from the setting command;

[0027] The physical address range used to control access to the storage medium is determined based on the start address parameter and the end address parameter.

[0028] Secondly, this application discloses an access control device for a storage medium, comprising:

[0029] The reset command acquisition module is used to acquire the reset command issued by the host after the storage medium is powered on.

[0030] The reset module is used to perform a reset operation on the storage medium based on the reset command, and to determine whether the preset security enable bit is set.

[0031] A security authentication module is used to perform security authentication if the state is set.

[0032] The normal operation module is used to complete the subsequent reset operation according to the normal operation sequence of the storage medium if the state is not set.

[0033] Thirdly, this application discloses an electronic device, including:

[0034] Memory, used to store computer programs;

[0035] A processor is configured to execute the computer program to implement the steps of the aforementioned disclosed access control method for storage media.

[0036] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the steps of the aforementioned access control method for the storage medium.

[0037] As can be seen, after the storage medium is powered on, this application receives a reset command from the host; based on the reset command, it performs a reset operation on the storage medium and determines whether the preset security enable bit is set; if it is set, security authentication is performed; if it is not set, the subsequent reset operations are completed according to the normal operation sequence of the storage medium. Therefore, after the storage medium completes the power-on operation, the host sends a reset command so that the storage medium can receive the reset command and perform a reset operation, and determines whether the preset security enable bit is set. If it is set, it indicates that the security feature is currently enabled, and security authentication is required; if it is not set, it indicates that the security feature is not currently enabled, and the subsequent reset operations are completed according to the normal operation sequence of the storage medium. The above scheme achieves access control of the storage medium by requiring security authentication when the security enable bit is set. In this way, by controlling the secure access to data on the physical storage medium, the data stored on the medium is protected, resulting in high security. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0039] Figure 1 This is a flowchart of an access control method for a storage medium disclosed in this application;

[0040] Figure 2 This is a schematic diagram of a specific command sequence disclosed in this application;

[0041] Figure 3 This is a flowchart of a specific access control method for a storage medium disclosed in this application;

[0042] Figure 4 This is a schematic diagram of the structure of an access control device for a storage medium disclosed in this application;

[0043] Figure 5 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0044] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0045] Currently, when reading user data from storage devices such as flash memory chips, standard command read, write, and erase interface methods can be used to obtain the user's physical data on the storage medium. However, these unprotected standard commands can easily lead to the leakage of sensitive user data if the storage medium is replaced with another host chip. Therefore, this application discloses an access control method, apparatus, device, and medium for storage media, which can protect the data on the storage medium and prevent unauthorized access.

[0046] See Figure 1 As shown in the figure, this application discloses an access control method for a storage medium, the method comprising:

[0047] Step S11: After the storage medium is powered on, a reset command is obtained from the host.

[0048] In this embodiment, after the storage medium is powered on and ready, the host will issue a 0xff reset command. This preparation is essentially the first power-on process of the storage medium, which requires the user to set a user password, serial number, and control permissions. Specifically, the storage medium can be a flash memory chip, which is the storage medium of a solid-state drive (SSD). Flash memory is a non-volatile memory, meaning it can retain written data even when power is off.

[0049] Step S12: Perform a reset operation on the storage medium based on the reset command, and determine whether the preset security enable bit is set.

[0050] In this embodiment, the storage medium is reset based on the issued reset command, and it is determined whether the preset security enable bit is set. That is, during the reset operation, it is checked whether the security enable bit SE is set to 1. If it is 1, it means that the security function has been enabled, that is, the security feature has been enabled. Then the control signal in the security parameter needs security authentication to be enabled. If the security enable bit is not 1, it means that the security function is not currently enabled.

[0051] Step S13: If the state is set, perform security authentication.

[0052] In this embodiment, the security authentication specifically includes: obtaining a setting command issued by the host, and determining whether the target security parameter in the setting command meets the corresponding preset matching conditions; if not, disabling all control signals in the security parameters. The setting command is specifically a `set feature` command. It can be understood that if the security enable bit is already set to 1, indicating a currently enabled state, the host continues to issue `set feature` commands. After receiving the `set feature` command, the storage medium determines whether the target security parameter in the `set feature` command meets the corresponding preset matching conditions. If the target security parameter in the `set feature` command does not meet the corresponding preset matching conditions, disabling all control signals in the security parameters. The above scheme achieves access control of the storage medium by determining whether the target security feature parameter in the `set feature` command received by the storage medium meets the preset matching conditions, thereby determining whether to disable or enable the control signals in the security parameters. In this way, by controlling circuit signals from the physical storage medium, the data stored on the medium is protected, resulting in high security.

[0053] Specifically, the control signals in the aforementioned security parameters may include, but are not limited to, single-ended read enable control signals, single-ended write enable control signals, differential read enable control signals, and differential write enable control signals. Figure 2This is a schematic diagram of a specific command sequence disclosed in this application. It should be noted that this embodiment pre-adds a set of security features to the `set feature` command, and these features need to be persistently stored in the storage medium for redundancy and multiple backups. This allows for enabling or disabling corresponding signals based on the control signal values ​​in the security feature parameters of the `set feature` command issued by the current host. In other words, this embodiment provides a set of secure access control policy mechanisms for the storage medium and adds a set of storage medium access security features and commands to the existing NAND flash chip manufacturer's manual for user use, in order to control unauthorized access to sensitive user data on the storage medium. The relevant security parameters in the `set feature` command are shown in Table 1. It should be noted that the security feature parameters include, but are not limited to, the parameters and signal control shown in Table 1. Expand or trim, and the specific length can also be adjusted:

[0054] Table 1

[0055]

[0056]

[0057] Among them, USER PIN0 to USER PIN3 are the actual user passwords; to ensure compatibility, the Feature address can be a reserved address or a vendor-specific address; the security enable bit SE, i.e., DQ7 of B0, checks whether this bit is 1 during reset. If it is 1, it means that the security function is enabled. Signals DQ1 to DQ4 require security authentication to enable; SERIAL NUMBER0 to SERIAL NUMBER3 are the serial numbers set each time. In addition, command data scrambling can also be enabled for this security feature to prevent replay attacks; PRIVLIGID0 to PRIVLIGID3 are used to distinguish different permissions and allow operation control. (i.e., differential write enable control signal) The values ​​of (i.e., differential read enable control signal), WE (i.e., single-ended write enable control signal), and RE (single-ended read enable control signal) are used to effectively control the enabling and disabling of relevant signals after particle replacement. For example, PRIVLIGUU allows control of... PRIVLIGXX allows control over whether to disable or enable it. The PRIVLIGYY parameter allows control over the disable or enable of WE, while the PRIVLIGZZ parameter allows control over the disable or enable of RE, as shown in Table 2 below:

[0058] Table 2

[0059]

[0060]

[0061] Furthermore, in Table 1, START ADDR0 to END ADDR1 represent the address range for read / write control, with a minimum granularity of a block. An address consisting entirely of zeros indicates a range covering the entire flash memory unit (LUN). The start and end address formats are as follows:

[0062] LUN[15:13]BLOCK[12:0];

[0063] Therefore, after obtaining the set feature command issued by the host, the process further includes: obtaining the start address parameter and end address parameter in the set feature command; and determining the physical address range for controlling access to the storage medium based on the start address parameter and end address parameter. That is, the physical address range for accessing the storage medium can be controlled through the start address parameter and end address parameter in the set feature command. For example, LUN[15:13] and BLOCK[12:0] indicate that bits 1 to 13 are the physical address of BLOCK, and bits 14 to 16 are the physical address of LUN; therefore, access to the storage medium is only possible within this range.

[0064] It should be noted that the parameters in Table 1 need to be persistently stored in the reserved area of ​​the particle, with redundancy and multiple backups possible. Among these, the control signals... The persistent storage of WE and RE is only used to record and understand the last settings. The actual control is controlled by the user's current command parameters. Furthermore, the relevant signals will be reset or restored to the default value when the storage medium receives a 0xff reset command. Other persistently stored parameters cannot be reset or cleared.

[0065] Step S14: If it is not in the set state, then follow the normal operation sequence of the storage medium to complete the subsequent reset operation.

[0066] In this embodiment, if the security enable bit is not set, it indicates that the security feature is not currently enabled, which means that security authentication is not required. Instead, the normal operation sequence of the storage medium can be followed to complete the reset operation.

[0067] As can be seen, after the storage medium is powered on, this application receives a reset command from the host; based on the reset command, it performs a reset operation on the storage medium and determines whether the preset security enable bit is set; if it is set, security authentication is performed; if it is not set, the subsequent reset operations are completed according to the normal operation sequence of the storage medium. Therefore, after the storage medium completes the power-on operation, the host sends a reset command so that the storage medium can receive the reset command and perform a reset operation, and determines whether the preset security enable bit is set. If it is set, it indicates that the security feature is currently enabled, and security authentication is required; if it is not set, it indicates that the security feature is not currently enabled, and the subsequent reset operations are completed according to the normal operation sequence of the storage medium. The above scheme achieves access control of the storage medium by requiring security authentication when the security enable bit is set. In this way, by controlling the secure access to data on the physical storage medium, the data stored on the medium is protected, resulting in high security.

[0068] See Figure 3 As shown, this application discloses a specific access control method for a storage medium. Compared to the previous embodiment, this embodiment further explains and optimizes the technical solution. Specifically, it includes:

[0069] Step S21: After the storage medium is powered on, a reset command is obtained from the host.

[0070] Step S22: Perform a reset operation on the storage medium based on the reset command, and determine whether the preset security enable bit is set.

[0071] Step S23: If the state is set, obtain the setting command issued by the host and determine the target security parameters in the setting command; the target security parameters include user password, serial number and control signal permissions.

[0072] In this embodiment, if the security enable bit is set, it indicates that the security feature has been enabled. After the reset operation is completed, for each independent flash memory component with its own CE signal, the host first issues a set feature command. After receiving the command, the storage medium determines the target security parameters in the set feature command, which specifically include the user password, serial number and control signal permissions.

[0073] Step S24: Determine whether the user password, the serial number, and the control signal permissions meet the corresponding preset matching conditions.

[0074] In this embodiment, it is determined whether the user password, serial number, and control signal permissions meet the corresponding preset matching conditions. Specifically, determining whether the user password, serial number, and control signal permissions meet the corresponding preset matching conditions includes: determining whether the user password meets a first preset matching condition; the first preset matching condition is that the user password is consistent; determining whether the serial number meets a second preset matching condition; the second preset matching condition is that the serial number is inconsistent; determining whether the control signal permissions meet a third preset matching condition; the third preset matching condition is that the control signal permissions are consistent. It can be understood that after receiving a command, the storage medium first performs a match between the user password, serial number, and control signal permissions. Since the user has already set the password, serial number, and permission level during the first power-on process, subsequent power-on processes compare whether the password and permission level are the same as the preset values, and whether the serial number changes according to the agreed rules. If all these conditions are met, the storage medium is considered to be matched; otherwise, it is considered to be mismatched. Specifically, the user password must meet the first preset matching condition, which is that the user passwords match; the serial number must meet the second preset matching condition, which is that the serial numbers do not match; and the control signal permissions must meet the third preset matching condition, which is that the control signal permissions match. Taking the parameters in Table 1 as an example, the data corresponding to the user passwords USER PIN0 to USER PIN3 must be consistent, which means that the user password match is successful; the data corresponding to the serial numbers SERIAL NUMBER0 to SERIAL NUMBER3 must all be different, which means that the serial number match is successful; and the data corresponding to the control signal permissions PRIVLIGID0 to PRIVLIGID3 must be consistent, which means that the control signal permissions match is successful.

[0075] Step S25: If not satisfied, disable all control signals in the safety parameters.

[0076] In the first specific implementation, if the user password, serial number and control signal permissions do not meet the corresponding preset matching conditions, all control signals in the security parameters are disabled, that is, the single-ended read enable control signal, the single-ended write enable control signal, the differential read enable control signal and the differential write enable control signal are all disabled.

[0077] In the second specific implementation, after determining whether the user password, the serial number, and the control signal permissions meet the corresponding preset matching conditions, the method further includes: if the user password, the serial number, and the control signal permissions all meet the corresponding preset matching conditions, then all control signals in the security parameters are enabled. That is, if the user password, the serial number, and the control signal permissions all meet the corresponding preset matching conditions, then the single-ended read enable control signal, the single-ended write enable control signal, the differential read enable control signal, and the differential write enable control signal in the security parameters are enabled.

[0078] In the third specific implementation, after determining whether the user password, the serial number, and the control signal permission meet the corresponding preset matching conditions, the method further includes: if the user password and the serial number meet the corresponding first preset matching conditions and the second preset matching conditions respectively, and the control signal permission does not meet the third preset matching condition, then only the single-ended read enable control signal in the security parameters is enabled. That is, if both the user password and the serial number meet the corresponding preset matching conditions, and only the control signal permission does not match, then only the single-ended read enable control signal in the security parameters can be enabled.

[0079] Step S26: If it is not in the set state, then follow the normal operation sequence of the storage medium to complete the subsequent reset operation.

[0080] For more detailed processing procedures of steps S21, S22 and S26, please refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0081] As can be seen, after receiving the `set feature` command issued by the host, this application's embodiments determine whether the user password, serial number, and control signal permissions in the `set feature` command meet the corresponding preset matching conditions. If all conditions are met, all control signals in the security parameters are enabled. These control signals include, but are not limited to, single-ended read enable control signals, single-ended write enable control signals, differential read enable control signals, and differential write enable control signals. If none of these conditions are met, all control signals are disabled. If only the control signal permissions are not met, only the single-ended read enable control signal is enabled. This application provides security protection for user data stored on the storage medium and controls circuit signals from the physical medium, thereby preventing unauthorized access to or tampering with user data or data within a specific range on the medium. It has high security; even if the storage medium containing the user data is connected to its environment, the data in the medium cannot be accessed.

[0082] See Figure 4 As shown in the figure, this application discloses an access control device for a storage medium, the device comprising:

[0083] The reset command acquisition module 11 is used to acquire the reset command issued by the host after the storage medium is powered on.

[0084] The reset module 12 is used to perform a reset operation on the storage medium based on the reset command, and to determine whether the preset security enable bit is set.

[0085] The security authentication module 13 is used to perform security authentication if the state is set.

[0086] The normal operation module 14 is used to complete the subsequent reset operation according to the normal operation sequence of the storage medium if the state is not set.

[0087] As can be seen, after the storage medium is powered on, this application receives a reset command from the host; based on the reset command, it performs a reset operation on the storage medium and determines whether the preset security enable bit is set; if it is set, security authentication is performed; if it is not set, the subsequent reset operations are completed according to the normal operation sequence of the storage medium. Therefore, after the storage medium completes the power-on operation, the host sends a reset command so that the storage medium can receive the reset command and perform a reset operation, and determines whether the preset security enable bit is set. If it is set, it indicates that the security feature is currently enabled, and security authentication is required; if it is not set, it indicates that the security feature is not currently enabled, and the subsequent reset operations are completed according to the normal operation sequence of the storage medium. The above scheme achieves access control of the storage medium by requiring security authentication when the security enable bit is set. In this way, by controlling the secure access to data on the physical storage medium, the data stored on the medium is protected, resulting in high security.

[0088] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Specifically, it may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the access control method for the storage medium executed by the electronic device disclosed in any of the foregoing embodiments.

[0089] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0090] The processor 21 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 21 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 21 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0091] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored on it include operating system 221, computer program 222 and data 223, etc., and the storage method can be temporary storage or permanent storage.

[0092] The operating system 221 manages and controls the various hardware devices on the electronic device 20 and the computer program 222 to enable the processor 21 to perform calculations and processing on the massive amounts of data 223 in the memory 22. The operating system 221 can be Windows, Unix, Linux, etc. The computer program 222, in addition to including a computer program capable of performing the access control method for the storage medium executed by the electronic device 20 as disclosed in any of the foregoing embodiments, may further include computer programs capable of performing other specific tasks. The data 223 may include data received by the electronic device from external devices, as well as data collected by its own input / output interface 25.

[0093] Furthermore, embodiments of this application also disclose a computer-readable storage medium storing a computer program. When the computer program is loaded and executed by a processor, it implements the method steps executed during the access control process of the storage medium as disclosed in any of the foregoing embodiments.

[0094] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0095] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0096] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0097] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0098] The above provides a detailed description of the access control method, apparatus, device, and storage medium for a storage medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. An access control method for a storage medium, characterized in that, include: After the storage medium is powered on, it receives a reset command from the host. The storage medium is reset based on the reset command, and it is determined whether the preset security enable bit is set. If the bit is set, then security authentication is performed; If it is not in the set state, the reset operation is completed according to the normal operation sequence of the storage medium. The security authentication includes: Obtain the configuration command issued by the host, and determine the target security parameters in the configuration command; the target security parameters include user password, serial number, and control signal permissions; Determine whether the user password meets a first preset matching condition; the first preset matching condition is that the user password matches. Determine whether the serial number meets the second preset matching condition; the second preset matching condition is that the serial numbers are inconsistent; the serial number is a related security parameter in the setting command, and the security parameter needs to be persistently stored in the reserved area of ​​the storage medium; the inconsistent serial number means that the serial number has not changed according to the agreed rules. Determine whether the control signal permissions meet a third preset matching condition; the third preset matching condition is that the control signal permissions are consistent. If none of these conditions are met, then all control signals in the safety parameters are disabled.

2. The access control method for a storage medium according to claim 1, characterized in that, After determining whether the user password, the serial number, and the control signal permissions meet the corresponding preset matching conditions, the method further includes: If the user password, the serial number, and the control signal permissions all meet the corresponding preset matching conditions, then all control signals in the security parameters are enabled.

3. The access control method for a storage medium according to claim 1, characterized in that, After determining whether the user password, the serial number, and the control signal permissions meet the corresponding preset matching conditions, the method further includes: If the user password and the serial number satisfy the corresponding first preset matching condition and the second preset matching condition, respectively, and the control signal permission does not satisfy the third preset matching condition, then only the single-ended read enable control signal in the security parameters is enabled.

4. The access control method for a storage medium according to claim 1, characterized in that, The control signals in the security parameters include single-ended read enable control signal, single-ended write enable control signal, differential read enable control signal, and differential write enable control signal.

5. The access control method for a storage medium according to claim 1, characterized in that, After obtaining the configuration command issued by the host, the process also includes: Retrieve the start address parameter and end address parameter from the setting command; The physical address range used to control access to the storage medium is determined based on the start address parameter and the end address parameter.

6. An access control device for a storage medium, characterized in that, include: The reset command acquisition module is used to acquire the reset command issued by the host after the storage medium is powered on. The reset module is used to perform a reset operation on the storage medium based on the reset command, and to determine whether the preset security enable bit is set. The security authentication module is used to perform security authentication if the preset security enable bit is in the set state. The normal operation module is used to complete the subsequent reset operation according to the normal operation sequence of the storage medium if the preset security enable bit is not in the set state. The security authentication module is used to obtain the setting command issued by the host and determine the target security parameters in the setting command. The target security parameters include the user password, serial number, and control signal permissions. It determines whether the user password meets a first preset matching condition, where the first preset matching condition is that the user password matches. It then determines whether the serial number meets a second preset matching condition, where the second preset matching condition is that the serial number does not match. The serial number is a relevant security parameter in the setting command, and this security parameter needs to be persistently stored in a reserved area of ​​the storage medium. An inconsistent serial number means that the serial number does not change according to the agreed rules. Finally, it determines whether the control signal permissions meet a third preset matching condition, where the third preset matching condition is that the control signal permissions match. If none of these conditions are met, all control signals in the security parameters are disabled.

7. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the access control method for the storage medium as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, Used for storing computer programs; wherein, when the computer program is executed by a processor, it implements the steps of the access control method for the storage medium as described in any one of claims 1 to 5.

Images