A multi-partition control method of a storage device and related apparatus

Abstract

Embodiments of the present application provide a multi-partition control method of a storage device and a related device, and relate to the field of storage. The method comprises: receiving a partition instruction for a storage area of the storage device, partitioning the storage area of the storage device into a plurality of sub-areas based on the partition instruction, receiving a partition password corresponding to each sub-area, and locking each sub-area based on the partition password. The partitioning of the storage area is completed by the storage device, thereby avoiding security vulnerabilities introduced by host-side software implementation.

Description

Technical Field

[0001] The present application relates to the field of storage, and in particular to a multi-partition control method and related apparatus for a storage device. Background Art

[0002] In the field of device storage, the secure storage devices currently on the market only perform self-encryption storage of user data stored on themselves, and usually only support full disk identity control, making data storage inflexible.

[0003] In order to solve the above problems, partition control of storage devices is implemented through host-side software. This implementation method can bypass the upper-level software through professional tools to read and destroy data on the storage device, so there is a big security loophole. Summary of the Invention

[0004] The purpose of this application is to provide a multi-partition control method and related devices for a storage device, which can enable the storage device to partition the storage area and encrypt each partition, thereby improving data security.

[0005] In order to achieve the above objectives, the technical solutions adopted in the embodiments of the present application are as follows:

[0006] In a first aspect, an embodiment of the present application provides a multi-partition control method for a storage device, the method comprising:

[0007] receiving a partitioning instruction for a storage area of ​​a storage device;

[0008] dividing the storage area of ​​the storage device into a plurality of sub-areas based on the partition instruction;

[0009] receiving a partition password corresponding to each of the sub-areas;

[0010] Each sub-area is locked based on its partition password.

[0011] In an optional embodiment, the step of locking each sub-area based on each partition password includes:

[0012] Determining a chip root key of the storage device;

[0013] For each of the sub-regions, obtaining a first encryption value of the sub-region based on a partition password corresponding to the sub-region and the chip root key;

[0014] The corresponding sub-area is locked based on the first encryption value of each sub-area.

[0015] In an optional embodiment, the method further comprises:

[0016] determining a data encryption key for the storage device;

[0017] For each of the sub-areas, determining a partition password corresponding to each of the sub-areas;

[0018] A second encryption value of the sub-region is determined based on the data encryption key, the chip root key, and the partition password.

[0019] In an optional implementation manner, the storage device further includes a partition mapping area and a hidden area, and the method further includes:

[0020] determining a partition table based on the partition instruction, wherein the partition table stores the read and write status of each sub-area; and storing the partition table in the hidden area;

[0021] When each of the sub-areas is unlocked, the partition table is mapped into the partition mapping area.

[0022] In an optional embodiment, the method further comprises:

[0023] receiving a partition password for a sub-area to be unlocked input by a user, wherein the sub-area to be unlocked is any one of the sub-areas;

[0024] When the third encryption value corresponding to the partition password to be authenticated is consistent with the first encryption value of the sub-area to be unlocked, the sub-area to be unlocked is unlocked.

[0025] In an optional embodiment, the method further comprises:

[0026] Obtaining a first decryption value based on the partition password to be authenticated and the chip root key;

[0027] decrypting a data encryption key according to the first decryption value;

[0028] The data in the sub-area to be unlocked is encrypted and decrypted based on the decrypted data encryption key.

[0029] In an optional embodiment, the method further comprises:

[0030] Determining the read / write status of each of the sub-regions;

[0031] Based on the read / write status of each sub-region, a corresponding target partition table is obtained from the hidden region, wherein different partition tables are preset in the hidden region, and different partition tables correspond to different read / write statuses of the sub-regions;

[0032] When each of the sub-areas is unlocked, the target partition table is mapped into the partition mapping area.

[0033] In a second aspect, an embodiment of the present application provides a multi-partition control device for a storage device, the device comprising:

[0034] A receiving module, configured to receive a partitioning instruction for a storage area of ​​a storage device;

[0035] a partitioning module, configured to divide the storage area of ​​the storage device into a plurality of sub-areas based on the partitioning instruction;

[0036] The receiving module is further used to: receive a partition password corresponding to each of the sub-areas;

[0037] The locking module is configured to lock each of the sub-areas based on each of the partition passwords.

[0038] In a third aspect, an embodiment of the present application provides a storage device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the multi-partition control method of the storage device when executing the computer program.

[0039] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the multi-partition control method of the storage device.

[0040] This application has the following beneficial effects:

[0041] This application receives a partitioning instruction for a storage area of ​​a storage device, divides the storage area of ​​the storage device into multiple sub-areas based on the partitioning instruction, receives a partition password corresponding to each sub-area, and locks each sub-area based on the partition password. The partitioning of the storage area is implemented internally by the storage device, avoiding security vulnerabilities introduced by host-side software implementation. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0043] Figure 1 A block diagram of a storage device provided in an embodiment of the present application;

[0044] Figure 2 One of the flow charts of a multi-partition control method for a storage device provided in an embodiment of the present application;

[0045] Figure 3 A regional division diagram of a storage device provided in this application;

[0046] Figure 4 Flowchart No. 2 of a multi-partition control method of a storage device provided by an embodiment of the present application;

[0047] Figure 5 Flowchart No. 3 of a multi-partition control method of a storage device provided by an embodiment of the present application;

[0048] Figure 6 Flowchart No. 4 of a multi-partition control method of a storage device provided by an embodiment of the present application;

[0049] Figure 7 Flowchart No. 5 of a multi-partition control method of a storage device provided by an embodiment of the present application;

[0050] Figure 8 Flowchart No. 6 of a multi-partition control method of a storage device provided by an embodiment of the present application;

[0051] Figure 9 Structural block diagram of a multi-partition control device of a storage device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in connection with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings can be arranged and designed in various different configurations.

[0053] Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without creative labor are within the scope of protection of the present application.

[0054] It should be noted that: similar reference numerals and letters represent similar items in the following drawings, therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0055] In the description of this application, it should be noted that if the terms "upper", "lower", "inside", "outside", etc. appear, the orientation or position relationship indicated is based on the orientation or position relationship shown in the accompanying drawings, or is the orientation or position relationship in which the invented product is usually placed when in use. It is only for the convenience of describing this application and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on this application.

[0056] In addition, the terms "first", "second", etc., if used, are merely used to distinguish and describe, and should not be understood as indicating or implying relative importance.

[0057] It should also be noted that, in the description of this application, unless otherwise expressly specified or limited, the terms "disposed," "installed," "connected," and "connected" should be understood in a broad sense. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; and they can refer to internal connections between two components. Those skilled in the art will understand the specific meanings of the above terms in this application based on the specific circumstances.

[0058] After extensive research, the inventors discovered that in the field of device storage, the secure storage devices currently on the market only perform self-encryption storage on the user data stored on themselves, and usually only support full disk identity control, making it impossible to store data flexibly.

[0059] Partition management on storage devices is typically implemented in conjunction with supporting upper-layer software. Data encryption and decryption, as well as partition control, must be performed by the host-side software; the storage device cannot independently perform these functions. This implementation method allows specialized tools to bypass the upper-layer software and read and destroy data on the storage device.

[0060] In addition, the security standard protocols commonly used in current storage devices have limitations. They can only support full-disk read and write control and do not support data self-encryption. Or, although they support multi-partition control and data self-encryption, the protocol interaction is cumbersome and the development cost is high.

[0061] Furthermore, in actual user scenarios, storage devices are typically used as system disks or removable disks for installing operating systems. Even if a storage device supports multiple partitions, the partition table cannot be refreshed simultaneously. If a partition is locked but the partition table indicates it is available, the host will receive an error when attempting to read or write to it, potentially leading to unpredictable situations such as operating system hangs or file system errors.

[0062] In light of the aforementioned issues, this embodiment provides a multi-partition control method and related apparatus for a storage device. The method receives a partition instruction for a storage area of ​​the storage device, divides the storage area into multiple sub-areas based on the partition instruction, receives a partition password corresponding to each sub-area, and locks each sub-area based on the partition password. This partitioning is accomplished internally within the storage device, avoiding the security vulnerabilities introduced by host-side software implementation. The solution provided by this embodiment is detailed below.

[0063] This embodiment provides a storage device that can implement partitioning. In a possible implementation, the storage device can be a solid-state hard disk, a USB flash drive, an optical disk, a floppy disk, a mobile hard disk, etc.

[0064] Please refer to Figure 1 , Figure 1 is a schematic diagram of the structure of the storage device 100 provided in an embodiment of the present application. The storage device 100 may also include Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown. Figure 1 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0065] The storage device 100 includes a multi-partition control device 110 , a memory 120 , and a processor 130 .

[0066] The components of the memory 120 and the processor 130 are electrically connected to each other directly or indirectly to realize data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses or signal lines. The multi-partition control device 110 of the storage device includes at least one software function module that can be stored in the memory 120 in the form of software or firmware or solidified in the operating system (OS) of the storage device 100. The processor 130 is used to execute the executable modules stored in the memory 120, such as the software function modules and computer programs included in the multi-partition control device 110 of the storage device.

[0067] The memory 120 may be, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, etc. The memory 120 is used to store programs, and the processor 130 executes the programs after receiving an execution instruction.

[0068] Please refer to Figure 2 , Figure 2 For application Figure 1 The flowchart of a multi-partition control method of a storage device 100 is shown in FIG. , and the method including each step is described in detail below.

[0069] S201: Receive a partitioning instruction for a storage area of ​​a storage device.

[0070] S202: Divide the storage area of ​​the storage device into multiple sub-areas based on the partition instruction.

[0071] S203: Receive the partition password corresponding to each sub-area.

[0072] S204: Lock each sub-area based on the partition password.

[0073] It should be noted that, from the host's perspective, the storage device has three logical address areas, such as Figure 3 As shown, they are the partition mapping area, storage area and hidden area. When the user divides the storage area of ​​the storage device into multiple sub-areas, a partition table is generated and stored in the hidden area. When the sub-area is unlocked, the partition table needs to be mapped from the hidden area to the partition mapping area.

[0074] When a storage device leaves the factory, no partitioning policy is created by default. To configure partitioning for a storage device, a partitioning command is sent to the device. This command may include dividing the storage area in the storage device into several sub-areas and setting a range of LBAs (Logical Block Addresses) for each sub-area. The storage device is partitioned based on the LBA ranges set for each sub-area. A partition password is also set for each sub-area to lock it.

[0075] When the storage device is divided into multiple sub-areas and the size range of the LBA of each sub-area is set, a conflict check needs to be performed on the size range of the LBA of each sub-area.

[0076] In an example: the first sub-area and the second sub-area are set, the size range of the LBA of the first sub-area is set from LBA5 to LBA20, the size range of the LBA of the second sub-area is set from LBA19 to LBA30, at this time, the storage areas of the first sub-area and the second sub-area overlap, the partition fails, and a new partition instruction needs to be sent to the storage device again.

[0077] In another example, when the total LBA range of the storage area of the storage device is 50, the LBA range of the first sub-area is set to 30, and the LBA range of the second sub-area is also set to 30, then the sum of the LBA ranges of the storage areas of the first sub-area and the second sub-area is greater than the logical address range corresponding to the storage area of the storage device, at this time, the partition instruction setting fails, a new partition instruction needs to be sent to the storage device again, and when there is no conflict in the set sub-areas, the partition is completed.

[0078] The partition instruction also includes a read-write state setting instruction for each sub-area, and the read-write state of each sub-area is stored in the partition table, the partition table is stored in the hidden area of the storage device, and when each sub-area is unlocked, the partition table is mapped to the partition mapping area.

[0079] It should be noted that the read-write state can include non-readable and non-writable, readable and writable, read-only, and writable.

[0080] For example, in the factory state of the storage device, a partition instruction for the storage area of the storage device is received, indicating that the storage area is divided into sub-area 1, sub-area 2, and sub-area 3, and the LBA range size corresponding to sub-area 1, the LBA range size corresponding to sub-area 2, and the LBA range size corresponding to sub-area 3 are set. The partition password of sub-area 1, sub-area 2, and sub-area 3 is set, and each sub-area is locked based on the corresponding partition password.

[0081] After the partition password is set successfully, the next time the storage device is powered on, each sub-area will be in a locked state by default, and after unlocking with the correct partition password, the corresponding sub-area can be read and written after the partition table is synchronized.

[0082] There are various implementation manners for locking each sub-area based on each partition password, in one implementation manner, as shown in Figure 4 The steps include:

[0083] S204-1: Determine the chip root key of the storage device.

[0084] S204-2: For each sub-region, obtain a first encryption value of the sub-region based on the partition password corresponding to the sub-region and the chip root key.

[0085] S204-3: Lock the corresponding sub-area based on the first encryption value of each sub-area.

[0086] Since the set partition password is easy to crack, in order to improve data security, the first encryption value of each sub-area is obtained based on the chip root key of the storage device and the partition password corresponding to each sub-area, and the corresponding sub-area is locked based on each first encryption value.

[0087] It should be noted that the chip root key is the key corresponding to the highest-authority user in the storage device.

[0088] There are multiple ways to calculate the first encryption value. In one embodiment, for each sub-area, the fourth encryption value of the partition password of the sub-area is calculated, and the first encryption value of the sub-area is obtained based on the fourth encryption value and the chip root key.

[0089] For security reasons, the storage device does not store the partition password set by the user in plain text, but encrypts the partition password of each sub-region to obtain a first encrypted value, and stores the first encrypted value of each sub-region.

[0090] For example, when setting a partition password for each sub-region, the partition password can be encrypted using the SM3 algorithm to obtain a fourth encrypted value, namely the user password hash value. This fourth encrypted value is then encrypted with the chip root key using the SM4 algorithm to obtain a first encrypted value. Each sub-region has its own corresponding first encrypted value, which is only used for authentication and encryption of the corresponding sub-region and cannot be used for authentication and encryption of other sub-regions.

[0091] Protect the data encryption key based on the set partition password, refer to Figure 5 , including the following steps:

[0092] S301: Determine a data encryption key of a storage device.

[0093] S302: For each sub-area, determine the partition password corresponding to each sub-area.

[0094] S303: Determine the encrypted second encryption value of the sub-area based on the data encryption key, the chip root key, and the partition password.

[0095] Each sub-area uses a data encryption key to encrypt and decrypt user data. If a partition password is set, the data encryption key will be protected by the partition password.

[0096] When a sub-region is locked, the correct data encryption key for that sub-region cannot be obtained, and therefore the correct user data cannot be decrypted. Only after the sub-region's partition password authentication is passed can the correct data encryption key be decrypted and the correct user data be retrieved. This design ensures the security of data in each sub-region, and each sub-region's data encryption key is linked to the user-set partition password, further enhancing data security.

[0097] There are multiple implementations for determining the encrypted second encrypted value of the sub-region. In one implementation:

[0098] Calculate the fourth encrypted value of the partition password corresponding to each sub-region, perform an XOR operation on the fourth encrypted value and the chip root key to obtain a fifth encrypted value, and determine the second encrypted value of the sub-region based on the fifth encrypted value and the data encryption key.

[0099] In one example, the fourth encryption value of the partition password, i.e., the password hash value, can be calculated based on the partition password of the sub-area using the SM3 encryption algorithm. The password hash value is XORed with the chip root key of the storage device to obtain a fifth encryption value. The fifth encryption value and the data encryption key of the storage device are encrypted and calculated using the SM4 encryption algorithm to obtain the second encryption value of the sub-area. The sub-data encryption key is encrypted and protected based on the second encryption value.

[0100] In another example, the fourth encryption value of the partition password, that is, the password hash value, can be calculated based on the partition password of the sub-area through the SM3 encryption algorithm, and the lower 128 bits of the fourth encryption value can be obtained. The lower 128 bits of the fourth encryption value are XORed with the chip root key to obtain the fifth encryption value. After the fifth encryption value and the data encryption key of the storage device are encrypted and calculated through the SM4 encryption algorithm, the second encryption value of the sub-area is obtained, and the sub-data encryption key is encrypted and protected based on the second encryption value.

[0101] For example, after the storage area of ​​the storage device is divided into multiple sub-areas, when storing data in each sub-area, the user data of each sub-area is encrypted using the data encryption key of the storage device, and different sub-areas use different partition passwords to encrypt the data encryption key.

[0102] It should be noted that when a storage device leaves the factory, a corresponding data encryption key is randomly generated, and different storage devices correspond to different data encryption keys.

[0103] When the storage device is not partitioned, it is displayed as an entire storage area. Only the chip root key is used to protect the data encryption key, and user data in the storage device is encrypted and protected based on the data encryption key of the storage device.

[0104] When unlocking the encrypted sub-area, refer to Figure 6 As shown, the following steps are included:

[0105] S401: Receive a partition password to be authenticated for a sub-area to be unlocked, input by a user.

[0106] The sub-area to be unlocked is any one of the sub-areas.

[0107] S402: When the third encryption value corresponding to the partition password to be authenticated is consistent with the first encryption value of the sub-region to be unlocked, the sub-region to be unlocked is unlocked.

[0108] Exemplarily, when unlocking the sub-area to be unlocked, the password of the partition to be authenticated of the sub-area to be unlocked input by the user is received, and the third encrypted value of the password to be authenticated is calculated, and the first encrypted value stored in the sub-area to be unlocked is obtained from the storage device. By comparing the first encrypted value with the third encrypted value, when the third encrypted value is consistent with the first encrypted value, the sub-area to be unlocked is unlocked. When the comparison value of the password of the partition to be authenticated is inconsistent with the stored password comparison value, the unlocking of the sub-area to be unlocked fails.

[0109] To prevent brute force unlocking, in another example, if a user unlocks the sub-area to be unlocked multiple times and the third encrypted value is inconsistent with the first encrypted value a preset number of times, the storage device locks the sub-area to be unlocked. Unlocking the sub-area to be unlocked can only be continued after the storage device is powered on again.

[0110] It should be noted that the preset number of times can be set to 5 times, 10 times, 15 times, etc., and the embodiment of the present application does not impose any specific restrictions on this.

[0111] When calculating the third encrypted value, the method of calculating the first encrypted value based on the partition password set by the user must be consistent.

[0112] After unlocking the sub-area based on the partition password, the partition table needs to be synchronized to perform read and write operations on each sub-area, such as Figure 7 As shown, the following steps are included:

[0113] S501: Determine the read / write status of each sub-region.

[0114] S502: Based on the read / write status of each sub-area, a corresponding target partition table is obtained from the hidden area.

[0115] There are different partition tables preset in the hidden area, and different partition tables correspond to different read and write states of each sub-area.

[0116] S503: When each sub-area is unlocked, the target partition table is mapped into the partition mapping area.

[0117] Exemplarily, different read and write states are set for sub-area 1, sub-area 2, and sub-area 3, and different read and write states correspond to different partition tables, wherein partition table 1 indicates that sub-area 1 is readable and writable, and sub-area 2 and sub-area 3 are not readable and writable; partition table 2 indicates that sub-area 1 and sub-area 3 are not readable and writable, and sub-area 2 is readable and writable; partition table 3 indicates that sub-area 1 and sub-area 2 are not readable and writable, and sub-area 3 is readable and writable; partition table 4 indicates that sub-area 1 and sub-area 2 are readable and writable, and sub-area 3 is not readable and writable; partition table 5 indicates that sub-area 2 and sub-area 3 are readable and writable, and sub-area 1 is not readable and writable; partition table 6 indicates that sub-area 1 and sub-area 3 are readable and writable, and sub-area 2 is not readable and writable; partition table 7 indicates that sub-area 1, sub-area 2, and sub-area 3 are all readable and writable.

[0118] When the read / write status of sub-area 1 is in a read / write state and sub-area 2 and sub-area 3 are both in a non-read / write state, partition table 1 is obtained from the hidden area as the target partition table. When sub-area 1 is unlocked successfully, partition table 1 is mapped to the partition mapping area to complete the partition table refresh operation.

[0119] When the read / write status of sub-area 1 and the read / write status of sub-area 3 are in a non-readable / writable state, and the read / write status of sub-area 2 is in a readable / writable state, partition table 2 is obtained from the hidden area as the target partition table. When sub-area 2 is unlocked successfully, partition table 2 is mapped to the partition mapping area to complete the refresh operation of the partition table.

[0120] When sub-area 1 and sub-area 2 are both in a non-readable and non-writable state, and sub-area 3 is in a readable and writable state, partition table 3 is obtained from the hidden area as the target partition table. When sub-area 3 is unlocked successfully, partition table 3 is mapped to the partition mapping area to complete the partition table refresh operation.

[0121] When sub-area 1 and sub-area 2 are both in a readable and writable state and sub-area 3 is in a non-readable and writable state, partition table 4 is obtained from the hidden area as the target partition table. When sub-area 1 and sub-area 2 are unlocked successfully, partition table 4 is mapped to the partition mapping area to complete the partition table refresh operation.

[0122] When sub-area 2 and sub-area 3 are both in a readable and writable state and sub-area 1 is in a non-readable and writable state, partition table 5 is obtained from the hidden area as the target partition table. When sub-area 2 and sub-area 3 are unlocked successfully, partition table 5 is mapped to the partition mapping area to complete the partition table refresh operation.

[0123] When sub-area 1 and sub-area 3 are both in a readable and writable state and sub-area 2 is in a non-readable and writable state, partition table 6 is obtained from the hidden area as the target partition table. When sub-area 1 and sub-area 3 are unlocked successfully, partition table 6 is mapped to the partition mapping area to complete the partition table refresh operation.

[0124] When sub-area 1, sub-area 2 and sub-area 3 are all in a readable and writable state, partition table 7 is obtained from the hidden area as the target partition table. When sub-area 1, sub-area 2 and sub-area 3 are all unlocked successfully, partition table 7 is mapped to the partition mapping area to complete the partition table refresh operation.

[0125] When sub-area 1, sub-area 2, and sub-area 3 are all in readable and writable state, but sub-area 1 and sub-area 2 are unlocked successfully, but sub-area 3 is not unlocked successfully, it is necessary to map partition table 4 to the partition mapping area instead of mapping partition table 7 to complete the synchronous refresh operation of the partition table. Finally, based on the refreshed partition table, the read and write operations of the corresponding sub-area are realized. There are many ways to decrypt the encrypted data in the sub-area. In one implementation, Figure 8 As shown, the following steps are included:

[0126] S601: Obtain a first decryption value based on the partition password to be authenticated and the chip root key.

[0127] S602: Decrypt the data encryption key according to the first decryption value.

[0128] S603: Encrypt and decrypt the data in the sub-area to be unlocked based on the decrypted data encryption key.

[0129] In one example, an SM3 encryption algorithm is used to obtain a hash value of the partition password to be authenticated. This hash value is then XORed with the chip root key of the storage device to obtain a first decrypted value. The first decrypted value is then used to decrypt the second encrypted value using the SM4 decryption algorithm to obtain a data encryption key. The decrypted data encryption key is then used to encrypt and decrypt user data in the sub-area to be unlocked using the SM4 algorithm. Since the partition password has been successfully authenticated, the sub-area to be unlocked is now in a successfully unlocked state.

[0130] In another example, the SM3 decryption algorithm is used to obtain a hash value of the partition password to be authenticated based on the partition password to be authenticated. The lower 128 bits of the hash value of the password to be authenticated are obtained. The lower 128 bits of the hash value of the password to be authenticated are XORed with the chip root key of the storage device to obtain a first decrypted value. The first decrypted value is decrypted using the SM4 decryption algorithm to obtain a data encryption key. The decrypted data encryption key is then used to encrypt and decrypt user data in the sub-area to be unlocked using the SM4 algorithm. Since the partition password has been successfully authenticated, the sub-area to be unlocked is now in a successfully unlocked state.

[0131] Please refer to Figure 9 The present application also provides an embodiment of a method for Figure 1 The multi-partition control device 110 of the storage device 100 includes:

[0132] A receiving module 111 is configured to receive a partitioning instruction for a storage area of ​​a storage device;

[0133] a partitioning module 112, configured to divide the storage area of ​​the storage device into a plurality of sub-areas based on the partitioning instruction;

[0134] The receiving module 111 is further configured to: receive a partition password corresponding to each of the sub-areas;

[0135] The locking module 113 is configured to lock each of the sub-areas based on each of the partition passwords.

[0136] The present application also provides a storage device 100, which includes a processor 130 and a memory 120. The memory 120 stores computer-executable instructions, which, when executed by the processor 130, implement the multi-partition control method of the storage device.

[0137] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by the processor 130, the multi-partition control method of the storage device is implemented.

[0138] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, program segment or a part of the code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0139] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist separately, or two or more modules can be integrated to form an independent part. If the function is implemented in the form of a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0140] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0141] The above descriptions are merely examples of various embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any modifications or substitutions that can be readily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included within the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A multi-partition control method for a storage device, characterized in that: The method comprises: receiving a partitioning instruction for a storage area of ​​a storage device; dividing the storage area of ​​the storage device into a plurality of sub-areas based on the partition instruction; receiving a partition password corresponding to each of the sub-areas; The step of locking each sub-area based on each partition password comprises: Determining a chip root key of the storage device; For each of the sub-regions, obtaining a first encryption value of the sub-region based on a partition password corresponding to the sub-region and the chip root key; The corresponding sub-area is locked based on the first encryption value of each sub-area.

2. The method according to claim 1, characterized in that The method further comprises: determining a data encryption key for the storage device; For each of the sub-areas, determining a partition password corresponding to each of the sub-areas; A second encryption value of the sub-area is determined based on the data encryption key, the chip root key, and the partition password.

3. The method according to claim 1, characterized in that The storage device further includes a partition mapping area and a hidden area, and the method further includes: determining a partition table based on the partition instruction, wherein the partition table stores the read and write status of each sub-area; and storing the partition table in the hidden area; When each of the sub-areas is unlocked, the partition table is mapped into the partition mapping area.

4. The method according to claim 1, wherein The method further comprises: receiving a partition password for a sub-area to be unlocked input by a user, wherein the sub-area to be unlocked is any one of the sub-areas; When the third encryption value corresponding to the partition password to be authenticated is consistent with the first encryption value of the sub-area to be unlocked, the sub-area to be unlocked is unlocked.

5. The method according to claim 4, characterized in that The method further comprises: Obtaining a first decryption value based on the partition password to be authenticated and the chip root key; decrypting a data encryption key according to the first decryption value; The data in the sub-area to be unlocked is encrypted and decrypted based on the decrypted data encryption key.

6. The method according to claim 3, characterized in that The method further comprises: Determining the read / write status of each of the sub-regions; Based on the read / write status of each sub-region, a corresponding target partition table is obtained from the hidden region, wherein different partition tables are preset in the hidden region, and different partition tables correspond to different read / write statuses of the sub-regions; When each of the sub-areas is unlocked, the target partition table is mapped into the partition mapping area.

7. A multi-partition control device for a storage device, characterized in that: The device comprises: A receiving module, configured to receive a partitioning instruction for a storage area of ​​a storage device; a partitioning module, configured to divide the storage area of ​​the storage device into a plurality of sub-areas based on the partitioning instruction; The receiving module is further used to: receive a partition password corresponding to each of the sub-areas; A locking module, configured to lock each of the sub-areas based on each of the partition passwords; The locking module is specifically used to: determine the chip root key of the storage device; for each sub-area, obtain the first encryption value of the sub-area based on the partition password corresponding to the sub-area and the chip root key; and lock the corresponding sub-area based on the first encryption value of each sub-area.

8. A storage device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method according to any one of claims 1 to 6 when executing the computer program.

9. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images