Self-encrypting hard disk access method, device, electronic device, and physical machine system
By passing identification information and authentication key unlocking instructions between the host and disk array card, the security and operation efficiency problems in self-encrypted hard disk access methods are solved, and efficient access without manual input of authentication keys is achieved. Data protection.
Patent Information
- Application Number
- CN202411147473.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-21
- Publication Date
- 2024-12-20
- Estimated Expiration
- 2044-08-21
AI Technical Summary
The existing self-encrypted hard disk access methods are insufficient in terms of security and operation efficiency, especially when the host restarts, the authentication key needs to be manually entered and there is a risk of data leakage, and the data can be accessed when the security is low.
By passing the host's identification information between the host and the disk array card, authentication requests and authentication key unlocking instructions are performed, ensuring that the host automatically executes access tasks for self-encrypted hard disks after it has access rights, reducing the spread of authentication keys Range and improve safety.
It realizes efficient access to the self-encrypted hard disk without manually entering the authentication key after the host restarts, which enhances data security and ensures that only an authorized host can access the self-encrypted hard disk and effectively protects data.
Smart Images
Figure CN118656819B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer technology, and in particular to a method and device for accessing a self-encrypting hard disk, an electronic device, and a physical machine system. Background Art
[0002] The current use of self-encrypting hard disks by disk array cards mainly utilizes the built-in hardware encryption module (Hardware AES Engine) of the self-encrypting hard disk to realize the data encryption function. The entire data encryption process does not require the participation of the host CPU and the disk array card CPU. The disk array card only performs encryption function configuration, key management and other operations. After the self-encryption function is turned on, there are two ways to access the self-encrypting hard disk.
[0003] In the first way to access the self-encrypting hard disk, such as Figure 7 As shown, each time the host is restarted, the user needs to manually input the previously set authentication key, the host sends the authentication key input by the user to the disk array card, the disk array card sends the received authentication key to the self-encrypting hard disk, and the self-encrypting hard disk performs encryption and decryption operations on the data stored in the non-volatile storage medium according to the authentication key.
[0004] In the second self-encrypting hard disk access method, when the encryption function of the self-encrypting hard disk is turned on, the disk array card saves the authentication key to the non-volatile memory, such as Figure 8 As shown, after the host is started, the disk array card directly sends the authentication key it stores to the self-encrypting hard disk, and the self-encrypting hard disk performs encryption and decryption operations on the data stored in the non-volatile storage medium according to the authentication key.
[0005] Of the two ways to access the self-encrypting hard disk, the first one is more secure. Even if the disk array card and the self-encrypting hard disk are lost at the same time, data leakage will not occur. However, this method is cumbersome to operate, especially for the execution process of some automatic restart scripts, which also requires manual participation. In addition, the authentication key needs to be informed to everyone who uses the host, which increases the risk of authentication key leakage. The second access method is relatively simple to operate, but less secure. If the disk array card and the self-encrypting hard disk are lost at the same time, the data can still be accessed.
[0006] Therefore, how to efficiently and securely perform access operations on self-encrypting hard disks is a technical problem that needs to be solved urgently. Summary of the invention
[0007] In view of the problems existing in the prior art, the present invention provides a method, device, electronic device and physical machine system for accessing a self-encrypting hard disk, so as to efficiently and safely perform the access operation of the self-encrypting hard disk.
[0008] The present invention provides a method for accessing a self-encrypting hard disk, which is applied to a host side and includes the following steps.
[0009] In response to satisfying a condition for starting authentication, obtaining identification information of the host itself; wherein the identification information is generated according to a serial number of the host, and the condition for starting authentication at least includes restarting the host; sending an authentication request carrying the identification information to a disk array card connected to the host, so that the disk array card determines whether the host has access rights to a target self-encrypting hard disk with a self-encrypting function enabled in the disk array card according to the identification information and identification information of an authorized host stored in the disk array card; and in response to the host having access rights to the target self-encrypting hard disk, sending an unlocking instruction carrying an authentication key stored in the disk array card to the target self-encrypting hard disk, wherein the authentication key is transmitted to the disk array card when the host enables the self-encrypting function of the target self-encrypting hard disk; obtaining a result of the authentication request, and executing an access task to the target self-encrypting hard disk according to the result of the authentication request.
[0010] According to a method for accessing a self-encrypting hard disk provided by the present invention, the method further includes: in response to receiving a self-encrypting function activation request from the disk array card, obtaining an authentication key input by a user; wherein the self-encrypting function activation request is sent by the disk array card to the host in response to receiving an access task for the target self-encrypting hard disk that does not activate the self-encrypting function; obtaining identification information of the host; sending the authentication key and the identification information of the host to the disk array card, so that the disk array card sends a self-encrypting function activation instruction carrying the authentication key to the target self-encrypting hard disk, stores the authentication key, and stores the identification information of the host as identification information of an authorized host.
[0011] According to a method for accessing a self-encrypting hard disk provided by the present invention, sending an authentication request carrying the identification information to a disk array card connected to the host comprises: encapsulating the identification information in a custom command to obtain an authentication request carrying the identification information; wherein the custom command is supported by a communication protocol between the host and the disk array card; and sending the authentication request to the disk array card.
[0012] According to a method for accessing a self-encrypting hard disk provided by the present invention, the communication protocol between the host and the disk array card is the NVMe protocol, the custom command includes an operation code field and a first string field; the encapsulating the identification information in the custom command to obtain an authentication request carrying the identification information includes: filling the identification information into the first string field, and filling the semantic encoding of the authentication request into the operation code field to obtain the authentication request carrying the identification information.
[0013] The present invention provides a method for accessing a self-encrypting hard disk, which is applied to a disk array card and includes the following steps.
[0014] In response to receiving an authentication request carrying identification information of a host mounted with the disk array card, determining whether the host has access rights to a target self-encrypting hard disk with a self-encrypting function enabled in the disk array card according to the identification information and identification information of an authorized host stored in the disk array card, wherein the identification information is generated according to a serial number of the host; in response to a result of the authentication being that the host has access rights to the target self-encrypting hard disk, issuing an unlocking instruction carrying a stored authentication key to the target self-encrypting hard disk; wherein the authentication key is transmitted to the disk array card when the host enables the self-encrypting function of the target self-encrypting hard disk; and returning a result of the authentication request so that the host executes an access task to the target self-encrypting hard disk according to the result of the authentication request.
[0015] According to a method for accessing a self-encrypting hard disk provided by the present invention, the method further includes: in response to receiving an access task for the target self-encrypting hard disk whose self-encrypting function is not enabled, sending a self-encrypting function enabling request to the host so that the host obtains an authentication key input by a user; in response to receiving the authentication key and the identification information of the host, sending a self-encrypting function enabling instruction carrying the authentication key to the target self-encrypting hard disk; and storing the authentication key, and storing the identification information of the host as the identification information of the authorized host.
[0016] According to a method for accessing a self-encrypting hard disk provided by the present invention, the authentication request carrying the identification information is obtained by encapsulating the identification information in a custom command, and the custom command is supported by the communication protocol between the host and the disk array card; after receiving the authentication request, the method further includes: parsing the authentication request based on the communication protocol between the host and the disk array card to obtain the identification information.
[0017] According to a method for accessing a self-encrypting hard disk provided by the present invention, the communication protocol between the host and the disk array card is the NVMe protocol, the custom command includes an operation code field and a first string field; the parsing of the authentication request based on the communication protocol between the host and the disk array card to obtain the identification information includes: confirming whether the custom command is an authentication request according to the operation code field; and obtaining the identification information according to content of the first string field in response to the custom command being an authentication request.
[0018] The present invention also provides a device for accessing a self-encrypting hard disk, which is arranged at a host end and includes the following modules: a first acquisition module, used to obtain identification information of the host itself in response to satisfying a condition for starting authentication; wherein the identification information is generated according to a serial number of the host, and the condition for starting authentication at least includes restarting the host; a first sending module, used to send an authentication request carrying the identification information to a disk array card connected to the host, so that the disk array card determines whether the host has access rights to a target self-encrypting hard disk with a self-encrypting function enabled in the disk array card according to the identification information and identification information of an authorized host stored in the disk array card, and in response to the host having access rights to the target self-encrypting hard disk, sends an unlocking instruction carrying an authentication key stored in the disk array card to the target self-encrypting hard disk, wherein the authentication key is transmitted to the disk array card when the host turns on the self-encrypting function of the target self-encrypting hard disk; and a second acquisition module, used to obtain a result of the authentication request, and execute an access task for the target self-encrypting hard disk according to the result of the authentication request.
[0019] According to a self-encrypting hard disk access device provided by the present invention, the device further includes:
[0020] a third acquisition module, configured to acquire the authentication key input by the user in response to receiving a self-encryption function activation request from the disk array card; wherein the self-encryption function activation request is sent by the disk array card to the host in response to receiving an access task for the target self-encrypting hard disk without the self-encryption function activated; a fourth acquisition module, configured to acquire the identification information of the host; and a second sending module, configured to send the authentication key and the identification information of the host to the disk array card, so that the disk array card sends a self-encryption function activation instruction carrying the authentication key to the target self-encrypting hard disk, stores the authentication key, and stores the identification information of the host as the identification information of the authorized host.
[0021] The present invention also provides another self-encrypting hard disk access device, which is arranged at the disk array card end and includes the following modules.
[0022] a determination module, for responding to an authentication request carrying identification information of a host mounted with the disk array card, and determining whether the host has access rights to a target self-encrypting hard disk with a self-encrypting function enabled in the disk array card according to the identification information and identification information of an authorized host stored in the disk array card, wherein the identification information is generated according to a serial number of the host; a sending module, for responding to a result of the authentication that the host has access rights to the target self-encrypting hard disk, and sending an unlocking instruction carrying a stored authentication key to the target self-encrypting hard disk; wherein the authentication key is transmitted to the disk array card when the host enables the self-encrypting function of the target self-encrypting hard disk; and a returning module, for returning a result of the authentication request, so that the host executes an access task to the target self-encrypting hard disk according to the result of the authentication request.
[0023] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for accessing the self-encrypting hard disk as described above is implemented.
[0024] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method for accessing a self-encrypting hard disk as described above is implemented.
[0025] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method for accessing a self-encrypting hard disk as described above is implemented.
[0026] The present invention also provides a physical machine system, including a host and a disk array card, and the interaction process between the host and the disk array card is as follows.
[0027] The host, in response to satisfying a condition for starting authentication, obtains identification information of the host itself; wherein the identification information is generated according to a serial number of the host, and the condition for starting authentication at least includes restarting the host; the host sends an authentication request carrying the identification information to a disk array card connected to the host; the disk array card, in response to receiving the authentication request carrying the identification information of the host mounted on the disk array card, determines whether the host has access rights to a target self-encrypting hard disk with a self-encrypting function enabled in the disk array card according to the identification information and identification information of an authorized host stored in the disk array card; the disk array card, in response to the result of the authentication being that the host has access rights to the target self-encrypting hard disk, sends an unlock instruction carrying a stored authentication key to the target self-encrypting hard disk; wherein the authentication key is transmitted to the disk array card when the host enables the self-encrypting function of the target self-encrypting hard disk; the disk array card returns the result of the authentication request; the host obtains the result of the authentication request, and executes an access task to the target self-encrypting hard disk according to the result of the authentication request.
[0028] The access method, device, electronic device and physical machine system of the self-encrypting hard disk provided by the present invention obtain the identification information of the host itself when the conditions for starting authentication are met; send an authentication request carrying the identification information to the disk array card connected to the host, so that the disk array card performs an authentication operation on the host according to the identification information and the identification information of the authorized host stored in the disk array card; and execute the access task for the target self-encrypting hard disk according to the result of the authentication request. Since the authentication operation is completed through the identification information of the host, the self-encrypting hard disk hanging under the disk array card can be normally accessed without manually inputting the authentication key again after the host is powered on again each time, and the access task of the self-encrypting hard disk can be completed efficiently, and the security performance of the self-encrypting hard disk is improved because the propagation range of the authentication key password is effectively reduced; if the self-encrypting hard disk is connected to other disk array cards or the disk array card and the self-encrypting hard disk are connected to other hosts together, the authentication cannot be passed, and the correct authentication key must be manually input to access the data in the self-encrypting hard disk, which effectively protects the security of the self-encrypting hard disk data. Therefore, the access operation of the self-encrypting hard disk can be performed efficiently and safely. BRIEF DESCRIPTION OF THE DRAWINGS
[0029] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0030] Figure 1 This is one of the flow charts of the method for accessing the self-encrypting hard disk provided by the present invention.
[0031] Figure 2 This is one of the flow charts of the method for starting the self-encryption function of the self-encrypting hard disk provided by the present invention.
[0032] Figure 3 This is the second flow chart of the method for accessing the self-encrypting hard disk provided by the present invention.
[0033] Figure 4 This is the second flow chart of the method for starting the self-encryption function of the self-encrypting hard disk provided by the present invention.
[0034] Figure 5 It is a structural schematic diagram of the physical machine system provided by the present invention.
[0035] Figure 6 It is a schematic diagram of the process of starting the self-encryption function of the self-encrypting hard disk provided by the present invention.
[0036] Figure 7 The present invention is a schematic diagram of a process of accessing a self-encrypting hard disk provided by the prior art.
[0037] Figure 8 This is another schematic diagram of a process for accessing a self-encrypting hard disk provided by the prior art.
[0038] Fig. 9 It is a schematic diagram of the process of starting the self-encryption function of the self-encrypting hard disk of the physical machine system provided by the present invention.
[0039] Fig.10 It is a schematic diagram of the process of accessing a self-encrypting hard disk by a physical machine system provided by the present invention.
[0040] Fig.11 It is a schematic diagram of the custom command provided by the present invention.
[0041] Fig.12 This is one of the structural schematic diagrams of the access device of the self-encrypting hard disk provided by the present invention.
[0042] Fig.13 This is the second structural schematic diagram of the access device of the self-encrypting hard disk provided by the present invention.
[0043] Fig.14 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION
[0044] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0045] Combine the following Figure 1-Figure 11 The access method of the self-encrypting hard disk of the present invention is described.
[0046] Figure 1 is one of the flow charts of the method for accessing the self-encrypting hard disk provided by the present invention, and the method is applied to the host side, such as Figure 1 As shown, the method includes the following:
[0047] Step 101: In response to satisfying a condition for starting authentication, obtaining identification information of the host itself; wherein the identification information is generated according to a serial number of the host.
[0048] The conditions for starting authentication may include host restart or other conditions that require authentication of the host's access rights to the target self-encrypting hard disk. The target self-encrypting hard disk is a self-encrypting hard disk in a disk array card connected to the host with the self-encrypting function turned on. For example, the target self-encrypting hard disk may be a self-encrypting hard disk corresponding to secure volume 1.
[0049] The serial number of the host, also commonly known as the service tag or product number, is a unique code that is used to identify a specific computer device. This serial number is set by the computer manufacturer when the device is manufactured, and each device has a unique serial number.
[0050] In the specific implementation process, the host identification information can be generated according to the host serial number in a variety of ways, which are not limited by the description of this specification. For example, the host serial number can be used as the host identification information. For another example, the hash value of the host serial number can be used as the host identification information.
[0051] Step 102: Send an authentication request carrying identification information to the disk array card connected to the host.
[0052] In a specific implementation process, the identification information may be encapsulated in a custom command to obtain an authentication request carrying the identification information; wherein the custom command is supported by the communication protocol between the host and the disk array card.
[0053] In some embodiments, the communication protocol between the host and the disk array card is the NVMe protocol, and the custom command includes an operation code field and a first string field.
[0054] As an example only, in the NVMe protocol, the format of the custom command is as follows Fig.11 As shown in the figure, opcode, string length, string1, and string2 are custom fields, and the remaining fields are filled in according to the NVMe admin command format requirements; the opcode structure is shown in Table 1 below:
[0055] Table 1 Operation code composition
[0056]
[0057] Among them, bit 7 (Generic Command) of the operation code opcode is 1b (binary), (bit 1: bit 0) indicates the data transmission direction, which can be set to 00b or other values; (bit 6: bit 2), the function field indicates the specific function of the custom command. Because the protocol specifies that the user-defined command Combined Opcode range is 0xC0-0xFF, the function value must be designed within this range.
[0058] In the specific implementation process, any field of string1 (string 1) and string2 (string 2) can be used as the first string field to fill in the host identification; and the semantic encoding 10000b of the authentication request (for example, the transmission sequence number is used as the authentication request) is filled in the function field of the operation code to obtain the authentication request carrying the identification information.
[0059] Step 103: Obtain the result of the authentication request, and execute the access task for the target self-encrypting hard disk according to the result of the authentication request.
[0060] The access task for the target self-encrypting hard disk may include writing data into the non-volatile storage medium of the target self-encrypting hard disk, or reading data from the non-volatile storage medium of the target self-encrypting hard disk.
[0061] The results of the authentication request include authentication passed and authentication failed.
[0062] If the authentication is passed, the host can normally execute the access task from the user to the target SED. For example, the data passed by the user can be written to the secure volume corresponding to the target SED, or the data can be read from the secure volume corresponding to the target SED and returned to the user. Each time an operation is performed on the target SED, the disk array card sends the authentication key and access task information stored in it to the target SED, and the target SED performs data encryption and decryption operations based on the authentication key.
[0063] If the authentication fails, the host can prompt the user through the human-computer interaction interface that the host does not have the authority to operate the target self-encrypting hard disk mounted thereon, and refuses to perform the access task to the target self-encrypting hard disk.
[0064] Figure 2 It is one of the flow charts of the method for starting the self-encryption function of the self-encrypting hard disk provided by the present invention, and the method is applied to the host side, such as Figure 2 As shown, the method includes the following:
[0065] Step 201: In response to receiving a self-encryption function activation request from a disk array card, an authentication key input by a user is obtained.
[0066] In the specific implementation process, the disk array card will identify whether the downstream hard disk has the self-encryption function. If it does, when receiving an access task for a target self-encryption hard disk that does not have the self-encryption function enabled, it will send a self-encryption function enablement request to the host.
[0067] After receiving the self-encryption function activation request, the host can ask the user whether to activate the self-encryption function of the target self-encrypting hard disk in various ways, which are not limited by the description of this manual.
[0068] After the user confirms to enable the self-encryption function, the host can obtain the authentication key input by the user through a human-computer interaction interface (for example, a text box, etc.).
[0069] Step 202: Obtain identification information of the host.
[0070] For a detailed description of the host's identification information, see Figure 1 The relevant content in will not be repeated here.
[0071] Step 203: Send the authentication key and the host identification information to the disk array card.
[0072] In a specific implementation process, the authentication key may be encapsulated in a custom command supported by the communication protocol between the host and the disk array card, and the authentication key may be sent to the disk array card by sending the custom command carrying the authentication key to the disk array card.
[0073] In some embodiments, the communication protocol between the host and the disk array card is the NVMe protocol. For a detailed description of the custom commands of the NVMe protocol, see Figure 1 The relevant content in will not be repeated here.
[0074] As an example only, any field in string1 or string2 can be used as the second string field to fill in the authentication key; and the semantic code 10001b for transmitting the authentication key can be filled in the function field of the operation code to obtain a custom command carrying the authentication key.
[0075] For a detailed description of sending host identification information to the disk array card, see Figure 1 The relevant contents of sending the authentication request to the disk array card are not repeated here.
[0076] After receiving the host's identification information and authentication key, the disk array card sends a self-encryption function activation instruction carrying the authentication key to the target self-encrypting hard disk, stores the authentication key, and stores the host's identification information as the identification information of the authorized host.
[0077] After turning on the self-encryption function of the target SED, the host can create a secure volume corresponding to the target SED. All data written to the volume will be encrypted before being written to the non-volatile storage medium (e.g., flash NAND) of the target SED. All data read from the NAND medium of the SED will be decrypted.
[0078] In the embodiment provided by the present invention, when a self-encryption function activation request is received from a disk array card, Figure 6 As shown, the authentication key input by the user and the identification information of the host are sent to the disk array card, so that the disk array card starts the self-encryption function, and the identification information of the host is stored as the identification information of the authorized host. After the host is restarted, it only needs to send its own identification information to the disk array card. The disk array card can determine whether the host has the authority to access the target self-encrypting hard disk based on the stored identification information of the authorized host, thereby effectively improving the access efficiency of the self-encrypting hard disk.
[0079] Figure 3 This is a second flow chart of the method for accessing a self-encrypting hard disk provided by the present invention, which is applied to a disk array card end, such as Figure 3 As shown, the method includes the following:
[0080] Step 301: In response to receiving an authentication request carrying identification information of a host mounted with a disk array card, determine whether the host has access rights to a target self-encrypting hard disk with a self-encryption function enabled in the disk array card according to the identification information and identification information of an authorized host stored in the disk array card.
[0081] For a detailed description of the host's identification information and authentication request, see Figure 1 The relevant content in will not be repeated here.
[0082] In some embodiments, the authentication request carrying the identification information is obtained by encapsulating the identification information in a custom command, and the custom command is supported by the communication protocol between the host and the disk array card.
[0083] In some embodiments, the communication protocol between the host and the disk array card is the NVMe protocol, and the custom command includes an operation code field and a first string field. The operation code field can be used to confirm whether the custom command is an authentication request; when the custom command is an authentication request, the identification information is obtained based on the content of the first string field.
[0084] For a detailed description of authentication requests and custom commands for the NVMe protocol, see Figure 1 The relevant content in will not be repeated here.
[0085] After receiving the authentication request, the disk array card can parse the authentication request based on the communication protocol between the host and the disk array card to obtain the identification information.
[0086] As an example only, for the example in step 102, the binary code "10000b" can be read from the function field of the operation code, which indicates that the serial number is transmitted this time. After the self-encryption function of the target self-encrypting hard disk is turned on, the transmission serial number is an authentication request, and the host identification information is read from the first string field.
[0087] In a specific implementation process, the disk array card (for example, executed by the CPU of the disk array card) can compare the received identification information with the identification information of the authorized host stored in the disk array card. If the two are consistent, it is determined that the host has the access permission for the target self-encrypting hard disk with the self-encryption function enabled in the disk array card. If the two are inconsistent, it is determined that the host does not have the access permission for the target self-encrypting hard disk with the self-encryption function enabled in the disk array card.
[0088] Step 302: In response to the authentication result that the host has access rights to the target self-encrypting hard disk, an unlocking instruction carrying a stored authentication key is sent to the target self-encrypting hard disk.
[0089] The authentication key is sent to the disk array card when the host turns on the self-encryption function of the target self-encrypting hard disk. For a detailed description, see Figure 2 The relevant content in will not be repeated here.
[0090] After the disk array card determines that the host has access rights to the target self-encrypting hard disk, it sends an unlock command with the stored authentication key to the target self-encrypting hard disk. After receiving the authentication key, the target self-encrypting hard disk uses KDF (Key Derivation Function) and the authentication key to derive KEK (Key EncryptionKey), and reads the Encrypted MEK (Media EncryptionKey) stored in the non-volatile medium at the same time, and uses the KEK to decrypt the Encrypted MEK to obtain the MEK that is actually used for data encryption and decryption; all subsequent IO read and write data and MEK will be passed to the hardware AES (Advanced Encryption Standard) engine to perform the actual data encryption and decryption process.
[0091] Step 303: Return the result of the authentication request.
[0092] In a specific implementation process, the disk array card can feed back the result of the authentication request to the host, so that the host can perform an access task for the target self-encrypting hard disk according to the result of the authentication request.
[0093] In the embodiment provided by the present invention, after receiving the authentication request carrying the identification information of the host mounted with the disk array card, it is determined whether the host has the access right to the target self-encrypting hard disk with the self-encrypting function enabled in the disk array card according to the identification information and the identification information of the authorized host stored in the disk array card; when the result of the authentication is that the host has the access right to the target self-encrypting hard disk, an unlocking instruction carrying the stored authentication key is issued to the target self-encrypting hard disk. Since the disk array card stores the identification information and the authentication key of the authorized host, the host needs to provide the correct identification information to the disk array card when accessing the target self-encrypting hard disk, and the target self-encrypting hard disk needs to obtain the correct authentication key from the disk array card when performing encryption and decryption on the data stored in the non-volatile storage medium, thereby realizing the secure topological binding of the host, the disk array card and the target self-encrypting hard disk. When any one or more nodes change (for example, the target self-encrypting hard disk is lost or the disk array card and the target self-encrypting hard disk are lost together), the data in the target self-encrypting hard disk cannot be accessed, and when the topological connection remains unchanged, there is no need to manually input the authentication key.
[0094] Figure 4 This is a second flow chart of a method for starting the self-encryption function of a self-encrypting hard disk provided by the present invention. The method is applied to a disk array card end, such as Figure 4 As shown, the method includes the following:
[0095] Step 401: In response to receiving an access task for a target self-encrypting hard disk whose self-encrypting function is not enabled, a self-encrypting function enabling request is sent to a host, so that the host obtains an authentication key input by a user.
[0096] In the specific implementation process, the disk array card will identify whether the downstream hard disk has the self-encryption function. If it does, when receiving an access task for a target self-encryption hard disk that does not have the self-encryption function enabled, it will send a self-encryption function enablement request to the host.
[0097] Step 402: In response to receiving the authentication key and the host identification information, a self-encryption function activation instruction carrying the authentication key is sent to the target self-encrypting hard disk.
[0098] After receiving the authentication key, the target self-encrypting hard disk uses KDF and the authentication key to derive a KEK, which encrypts the MEK generated by the AES engine to generate an Encrypted MEK and saves it to the non-volatile medium. The Encrypted MEK can be used to encrypt data written to the non-volatile storage medium or to decrypt data read from the non-volatile storage medium. For more detailed descriptions, see the relevant content in step 302, which will not be repeated here.
[0099] Step 403: Store the authentication key, and store the host's identification information as the authorized host's identification information.
[0100] In the specific implementation process, the disk array card stores the authentication key and the identification information of the authorized host in a read-only storage medium. The stored authentication key and the identification information of the authorized host can be used to access the data in the target self-encrypting hard disk later. For a detailed description, see Figure 1 and Figure 3 The relevant content in will not be repeated here.
[0101] Figure 5 It is a structural diagram of the physical machine system provided by the present invention, such as Figure 5 As shown, the physical machine system includes a host, a disk array card, and a target self-encrypting hard disk.
[0102] like Fig.10 As shown in the figure, the interaction between the host and the disk array card includes:
[0103] The host, in response to satisfying a condition for starting authentication, obtains identification information of the host itself; wherein the identification information is generated according to a serial number of the host, and the condition for starting authentication at least includes restarting the host.
[0104] The host sends an authentication request carrying identification information to the disk array card connected to the host.
[0105] The disk array card, in response to receiving an authentication request carrying identification information of a host mounted with the disk array card, determines whether the host has access rights to a target self-encrypting hard disk with the self-encryption function enabled in the disk array card according to the identification information and identification information of the authorized host stored in the disk array card.
[0106] The disk array card, in response to the authentication result that the host has access rights to the target self-encrypting hard disk, sends an unlock instruction carrying a stored authentication key to the target self-encrypting hard disk; wherein the authentication key is transmitted to the disk array card when the host turns on the self-encryption function of the target self-encrypting hard disk.
[0107] The disk array card returns the result of the authentication request.
[0108] The host obtains the result of the authentication request, and executes an access task for the target self-encrypting hard disk according to the result of the authentication request.
[0109] Among them, Fig. 9 As shown in the figure, during the startup process of the self-encryption function of the target self-encrypting hard disk, the interaction between the host and the disk array card includes:
[0110] In response to receiving an access task for a target self-encrypting hard disk whose self-encrypting function is not enabled, the disk array card sends a self-encrypting function enabling request to the host.
[0111] In response to receiving a self-encryption function activation request from the disk array card, the host obtains an authentication key input by a user.
[0112] The host obtains its own identification information.
[0113] The host sends the authentication key and its own identification information to the disk array card.
[0114] In response to receiving the authentication key and the identification information of the host, the disk array card sends a self-encryption function activation instruction carrying the authentication key to the target self-encrypting hard disk; and
[0115] The authentication key is stored, and the host's identification information is stored as the authorized host's identification information.
[0116] The access device of the self-encrypting hard disk provided by the present invention is described below. The access device of the self-encrypting hard disk described below and the access method of the self-encrypting hard disk described above can be referred to each other.
[0117] Fig.12 1 is a schematic diagram of a structure of a device for accessing a self-encrypting hard disk provided by the present invention. The device is arranged at a host end. Fig.12 As shown, the device 1200 includes the following modules.
[0118] The first acquisition module 1210 is used to acquire the identification information of the host itself in response to meeting the condition for starting authentication; wherein the identification information is generated according to the serial number of the host, and the condition for starting authentication at least includes restarting the host.
[0119] The first sending module 1220 is configured to send an authentication request carrying the identification information to a disk array card connected to the host, so that the disk array card determines whether the host has access rights to a target self-encrypting hard disk with a self-encrypting function enabled in the disk array card according to the identification information and identification information of the authorized host stored in the disk array card, and in response to the host having access rights to the target self-encrypting hard disk, send an unlocking instruction carrying an authentication key stored in the disk array card to the target self-encrypting hard disk, wherein the authentication key is transmitted to the disk array card when the host enables the self-encrypting function of the target self-encrypting hard disk.
[0120] The second acquisition module 1230 is used to obtain the result of the authentication request and execute the access task for the target self-encrypting hard disk according to the result of the authentication request.
[0121] In some embodiments, the device also includes the following modules.
[0122] The third acquisition module is used to obtain the authentication key input by the user in response to receiving a self-encryption function activation request from the disk array card; wherein the self-encryption function activation request is sent by the disk array card to the host in response to receiving an access task for the target self-encrypting hard disk with the self-encryption function not activated.
[0123] The fourth acquisition module is used to acquire the identification information of the host.
[0124] The second sending module is used to send the authentication key and the identification information of the host to the disk array card, so that the disk array card sends a self-encryption function activation instruction carrying the authentication key to the target self-encrypting hard disk, stores the authentication key, and stores the identification information of the host as the identification information of the authorized host.
[0125] Fig.13 This is a second structural diagram of the access device of the self-encrypting hard disk provided by the present invention. The device is arranged at the end of the disk array card, such as Fig.13 As shown, the device 1300 includes the following modules.
[0126] The determination module 1310 is used to determine, in response to receiving an authentication request carrying identification information of a host mounted with the disk array card, whether the host has access rights to a target self-encrypting hard disk with a self-encryption function enabled in the disk array card according to the identification information and identification information of an authorized host stored in the disk array card, wherein the identification information is generated according to a serial number of the host.
[0127] The sending module 1320 is used for sending an unlocking instruction carrying a stored authentication key to the target self-encrypting hard disk in response to the result of the authentication that the host has access rights to the target self-encrypting hard disk; wherein the authentication key is transmitted to the disk array card when the host turns on the self-encryption function of the target self-encrypting hard disk;
[0128] The return module 1330 is used to return the result of the authentication request, so that the host can perform the access task for the target self-encrypting hard disk according to the result of the authentication request.
[0129] Fig.14 An example of a physical structure diagram of an electronic device is shown in FIG. Fig.14 As shown, the electronic device may include: a processor (processor) 1410 , a communication interface (Communications Interface) 1420 , a memory (memory) 1430 and a communication bus 1440 , wherein the processor 1410 , the communication interface 1420 , and the memory 1430 communicate with each other through the communication bus 1440 . The processor 1410 may call the logic instructions in the memory 1430 to execute the method for accessing the self-encrypting hard disk, the method comprising: in response to satisfying the condition for starting authentication, obtaining the identification information of the host itself; wherein the identification information is generated according to the serial number of the host, and the condition for starting authentication at least includes the host restarting; sending an authentication request carrying the identification information to a disk array card connected to the host, so that the disk array card determines whether the host has access rights to a target self-encrypting hard disk with the self-encrypting function enabled in the disk array card according to the identification information and the identification information of the authorized host stored in the disk array card; and in response to the host having access rights to the target self-encrypting hard disk, sending an unlocking instruction carrying the authentication key stored in the disk array card to the target self-encrypting hard disk, wherein the authentication key is transmitted to the disk array card when the host enables the self-encrypting function of the target self-encrypting hard disk; obtaining the result of the authentication request, and executing the access task for the target self-encrypting hard disk according to the result of the authentication request.
[0130] In addition, the logic instructions in the above-mentioned memory 1430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.
[0131] On the other hand, the present invention also provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the self-encrypting hard disk access method provided by the above methods, the method comprising: in response to satisfying the conditions for starting authentication, obtaining the identification information of the host itself; wherein the identification information is generated according to the serial number of the host, and the conditions for starting authentication at least include restarting the host; sending an authentication request carrying the identification information to a disk array card connected to the host, so that the disk array card According to the identification information and the identification information of the authorized host stored in the disk array card, it is determined whether the host has access rights to the target self-encrypting hard disk in the disk array card with the self-encrypting function turned on; and in response to the host having access rights to the target self-encrypting hard disk, an unlocking instruction carrying the authentication key stored in the disk array card is issued to the target self-encrypting hard disk, wherein the authentication key is transmitted to the disk array card when the host turns on the self-encrypting function of the target self-encrypting hard disk; and a result of the authentication request is obtained, and according to the result of the authentication request, an access task to the target self-encrypting hard disk is executed.
[0132] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented by a processor to execute the access method of the self-encrypting hard disk provided by the above methods when the computer program is executed, the method comprising: in response to satisfying a condition for starting authentication, obtaining identification information of the host itself; wherein the identification information is generated according to the serial number of the host, and the condition for starting authentication at least includes restarting the host; sending an authentication request carrying the identification information to a disk array card connected to the host, so that the disk array card determines whether the host has access rights to a target self-encrypting hard disk with a self-encrypting function enabled in the disk array card according to the identification information and identification information of an authorized host stored in the disk array card, and in response to the host having access rights to the target self-encrypting hard disk, sending an unlock instruction carrying an authentication key stored in the disk array card to the target self-encrypting hard disk, wherein the authentication key is transmitted to the disk array card when the host turns on the self-encrypting function of the target self-encrypting hard disk; obtaining a result of the authentication request, and executing an access task for the target self-encrypting hard disk according to the result of the authentication request.
[0133] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.
[0134] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.
[0135] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for accessing a self-encrypting hard disk, characterized in that: Applied to the host side, the method includes: In response to satisfying a condition for starting authentication, obtaining identification information of the host itself; wherein the identification information is generated according to a serial number of the host, and the condition for starting authentication at least includes restarting the host; sending an authentication request carrying the identification information to a disk array card connected to the host, so that the disk array card determines whether the host has access rights to a target self-encrypting hard disk with the self-encrypting function enabled in the disk array card according to the identification information and identification information of the authorized host stored in the disk array card, and in response to the host having access rights to the target self-encrypting hard disk, sending an unlocking instruction carrying the authentication key stored in the disk array card to the target self-encrypting hard disk, wherein the authentication key is transmitted to the disk array card when the host enables the self-encrypting function of the target self-encrypting hard disk; The result of the authentication request is obtained, and according to the result of the authentication request, an access task for the target self-encrypting hard disk is executed.
2. The method for accessing a self-encrypting hard disk according to claim 1, characterized in that: The method further comprises: In response to receiving a self-encryption function activation request from the disk array card, obtaining an authentication key input by a user; wherein the self-encryption function activation request is sent by the disk array card to the host in response to receiving an access task for the target self-encrypting hard disk that does not activate the self-encryption function; Obtaining identification information of the host; The authentication key and the identification information of the host are sent to the disk array card, so that the disk array card sends a self-encryption function activation instruction carrying the authentication key to the target self-encrypting hard disk, stores the authentication key, and stores the identification information of the host as the identification information of the authorized host.
3. The method for accessing a self-encrypting hard disk according to claim 1 or 2, characterized in that: The step of sending an authentication request carrying the identification information to a disk array card connected to the host comprises: Encapsulating the identification information in a custom command to obtain an authentication request carrying the identification information; wherein the custom command is supported by the communication protocol between the host and the disk array card; Send the authentication request to the disk array card.
4. The method for accessing a self-encrypting hard disk according to claim 3, characterized in that: The communication protocol between the host and the disk array card is the NVMe protocol, and the custom command includes an operation code field and a first string field; The step of encapsulating the identification information in a custom command to obtain an authentication request carrying the identification information includes: The identification information is filled into the first character string field, and the semantic code of the authentication request is filled into the operation code field to obtain an authentication request carrying the identification information.
5. A method for accessing a self-encrypting hard disk, characterized in that: Applied to disk array card end, including: In response to receiving an authentication request carrying identification information of a host mounted with the disk array card, determining whether the host has access rights to a target self-encrypting hard disk with a self-encryption function enabled in the disk array card according to the identification information and identification information of an authorized host stored in the disk array card, wherein the identification information is generated according to a serial number of the host; In response to the result of the authentication being that the host has access rights to the target self-encrypting hard disk, an unlocking instruction carrying a stored authentication key is issued to the target self-encrypting hard disk; wherein the authentication key is transmitted to the disk array card when the host turns on the self-encryption function of the target self-encrypting hard disk; The result of the authentication request is returned, so that the host executes an access task for the target self-encrypting hard disk according to the result of the authentication request.
6. The method for accessing a self-encrypting hard disk according to claim 5, characterized in that: The method further comprises: In response to receiving an access task for the target self-encrypting hard disk whose self-encrypting function is not enabled, sending a self-encrypting function enabling request to the host, so that the host obtains an authentication key input by a user; In response to receiving the authentication key and the identification information of the host, sending a self-encryption function activation instruction carrying the authentication key to the target self-encrypting hard disk; and The authentication key is stored, and the identification information of the host is stored as the identification information of the authorized host.
7. The method for accessing a self-encrypting hard disk according to claim 5 or 6, characterized in that: The authentication request carrying the identification information is obtained by encapsulating the identification information in a custom command, and the custom command is supported by the communication protocol between the host and the disk array card; After receiving the authentication request, the method further includes: Based on the communication protocol between the host and the disk array card, the authentication request is parsed to obtain the identification information.
8. The method for accessing a self-encrypting hard disk according to claim 7, characterized in that: The communication protocol between the host and the disk array card is the NVMe protocol, and the custom command includes an operation code field and a first string field; The step of parsing the authentication request based on the communication protocol between the host and the disk array card to obtain the identification information includes: According to the operation code field, confirm whether the custom command is an authentication request; In response to the custom command being an authentication request, the identification information is obtained according to content of the first string field.
9. A device for accessing a self-encrypting hard disk, characterized in that: The device is arranged at the host end, and the device comprises: A first acquisition module, configured to acquire identification information of the host itself in response to satisfying a condition for starting authentication; wherein the identification information is generated according to a serial number of the host, and the condition for starting authentication at least includes restarting the host; a first sending module, configured to send an authentication request carrying the identification information to a disk array card connected to the host, so that the disk array card determines whether the host has access rights to a target self-encrypting hard disk with a self-encrypting function enabled in the disk array card according to the identification information and identification information of the authorized host stored in the disk array card, and, in response to the host having access rights to the target self-encrypting hard disk, sends an unlocking instruction carrying an authentication key stored in the disk array card to the target self-encrypting hard disk, wherein the authentication key is transmitted to the disk array card when the host enables the self-encrypting function of the target self-encrypting hard disk; The second acquisition module is used to obtain the result of the authentication request and execute the access task for the target self-encrypting hard disk according to the result of the authentication request.
10. The access device for a self-encrypting hard disk according to claim 9, characterized in that: The device also includes: a third acquisition module, configured to acquire the authentication key input by the user in response to receiving a self-encryption function activation request from the disk array card; wherein the self-encryption function activation request is sent by the disk array card to the host in response to receiving an access task for the target self-encrypting hard disk for which the self-encryption function is not activated; A fourth acquisition module, used to acquire identification information of the host; The second sending module is used to send the authentication key and the identification information of the host to the disk array card, so that the disk array card sends a self-encryption function activation instruction carrying the authentication key to the target self-encrypting hard disk, stores the authentication key, and stores the identification information of the host as the identification information of the authorized host.
11. A device for accessing a self-encrypting hard disk, characterized in that: The device is arranged at the disk array card end and comprises: a determination module, configured to, in response to receiving an authentication request carrying identification information of a host mounted with the disk array card, determine whether the host has access rights to a target self-encrypting hard disk with a self-encryption function enabled in the disk array card according to the identification information and identification information of an authorized host stored in the disk array card, wherein the identification information is generated according to a serial number of the host; a sending module, configured to send an unlock instruction carrying a stored authentication key to the target self-encrypting hard disk in response to the result of the authentication being that the host has access rights to the target self-encrypting hard disk; wherein the authentication key is transmitted to the disk array card when the host turns on the self-encryption function of the target self-encrypting hard disk; The return module is used to return the result of the authentication request, so that the host can perform an access task for the target self-encrypting hard disk according to the result of the authentication request.
12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for accessing the self-encrypting hard disk according to any one of claims 1 to 8 is implemented.
13. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for accessing the self-encrypting hard disk according to any one of claims 1 to 8 is implemented.
14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method for accessing the self-encrypting hard disk according to any one of claims 1 to 8 is implemented.
15. A physical machine system, comprising a host and a disk array card, characterized in that: The host, in response to satisfying a condition for starting authentication, obtains identification information of the host itself; wherein the identification information is generated according to a serial number of the host, and the condition for starting authentication at least includes restarting the host; The host sends an authentication request carrying the identification information to a disk array card connected to the host; The disk array card, in response to receiving an authentication request carrying identification information of a host mounted on the disk array card, determines whether the host has access rights to a target self-encrypting hard disk with a self-encryption function enabled in the disk array card according to the identification information and identification information of an authorized host stored in the disk array card; The disk array card, in response to the result of the authentication that the host has access rights to the target self-encrypting hard disk, sends an unlock instruction carrying a stored authentication key to the target self-encrypting hard disk; wherein the authentication key is transmitted to the disk array card when the host turns on the self-encryption function of the target self-encrypting hard disk; The disk array card returns the result of the authentication request; The host obtains a result of the authentication request, and executes an access task for the target self-encrypting hard disk according to the result of the authentication request.