Hard disk control method, hard disk, storage system and related computer device

Abstract

The present application relates to the field of storage technology, and in particular to a hard disk control method, a hard disk, a storage system and related computer devices. The hard disk includes a control drive module and a plurality of storage units; wherein the hard disk drive of the control drive module can create a plurality of virtual units, each of which is respectively connected to the hard disk drive and associated with the storage unit; the hard disk control method includes: in response to the virtual unit obtaining a control request, taking the virtual unit that obtains the control request as the current virtual unit; parsing the storage unit associated with the current virtual unit and taking it as the target address; driving the target address to execute the control request. The use of this method can optimize the working principle of the hard disk, improve the convenience of hard disk use and the response efficiency.

Description

Technical Field

[0001] The present application relates to the field of storage technology, and in particular to a hard disk control method, a hard disk, a storage system, a computer program product, a computer device, and a computer-readable storage medium. Background Art

[0002] When using a mobile solid-state hard disk such as SSD (Solid State Disk), when reading data stored in the SSD, deleting data stored in the SSD, and writing data to the SSD, it is usually necessary to know the data storage address or the specific write address in order to locate the corresponding address to implement the corresponding hard disk operation requirements. The operation is relatively cumbersome and requires the specific storage address to be clear, which affects the convenience of using the hard disk. Summary of the invention

[0003] Based on this, it is necessary to provide a hard disk control method, hard disk, storage system, computer program product, computer device and computer-readable storage medium to address the above technical problems, which can optimize the working principle of the hard disk and improve the convenience of hard disk use and response efficiency.

[0004] On the one hand, a hard disk control method is provided, wherein the hard disk includes a control drive module and multiple storage units; wherein the hard disk drive of the control drive module can create several virtual units, each virtual unit is respectively connected to the hard disk drive and associated with a storage unit; the hard disk control method includes: responding to a virtual unit obtaining a control request, taking the virtual unit that obtains the control request as the current virtual unit; parsing the storage unit associated with the current virtual unit and taking it as the target address; and driving the target address to execute the control request.

[0005] In one embodiment of the present application, parsing the storage unit associated with the current virtual unit includes: obtaining configuration information of the current virtual unit; identifying unit information associated with the current virtual unit in the configuration information; wherein the unit information belongs to the storage unit associated with the current virtual unit.

[0006] In one embodiment of the present application, creating several virtual units includes: respectively obtaining unit information of storage units in the hard disk; wherein the unit information includes a unit identifier; respectively creating a virtual unit for each storage unit, and configuring the created virtual unit using the unit information of the storage unit.

[0007] In one embodiment of the present application, the unit information also includes an access mode, and the access mode includes a pass-through mode and a medium mode; the virtual unit created using the unit information configuration of the storage unit includes: writing the unit identifier of the storage unit into the configuration information of the virtual unit; writing the access mode of the storage unit into the configuration information of the virtual unit to identify the spatial status of the storage unit based on the access mode, and when the virtual unit obtains a control request, it determines whether to authenticate the requester based on the access mode.

[0008] In one embodiment of the present application, in response to the spatial state of the target address being an encrypted state, before driving the target address to execute a control request, the steps include: identifying the request category of the control request; in response to the request category of the control request being a hard disk access request, determining to authenticate the requesting party; in response to the request category of the control request being a hard disk write request, determining to allow the hard disk write request to be executed.

[0009] In one embodiment of the present application, in response to the spatial state of the target address being an encrypted state, before driving the target address to execute a control request, the steps include: obtaining the encrypted data of the target address in the encryption configuration table; obtaining the verification parameters from the requester; parsing whether the verification parameters match the encrypted data, and in response to the verification parameters matching the encrypted data, determining that the requester has passed the identity authentication and allowing the execution of the control request.

[0010] In one embodiment of the present application, the encrypted data includes an encrypted medium encrypted by a root key; parsing whether the verification parameters match the encrypted data includes: obtaining the root key of the hard disk; using the root key to decrypt the encrypted data to obtain the encrypted medium; and comparing the encrypted medium with the verification parameters.

[0011] In one embodiment of the present application, in response to the encryption medium including an encryption key, the encrypted data also includes a random key encrypted by a root key; executing a control request includes: in response to the control request being a hard disk access request, decrypting the encrypted data using the root key to obtain a random key; fusing the random key and the encryption key to obtain a fused key; and decrypting the data stored at the target address using the fused key.

[0012] In one embodiment of the present application, a hard disk control method includes: presetting the storage space of the hard disk into multiple storage units; in response to obtaining a management instruction, configuring a target storage unit based on the management instruction; wherein the management instruction is used to configure at least one of an access mode and an encryption medium of the storage unit; and configuring a virtual unit associated with the target storage unit.

[0013] In one embodiment of the present application, configuring the target storage unit based on the management instruction includes: identifying and recording the encrypted medium carried by the management instruction; wherein the encrypted medium includes an access password and / or an encryption key; in response to the encrypted medium carried by the management instruction including the access password, determining that the access mode of the target storage unit is a first medium mode; in response to the encrypted medium carried by the management instruction including the access password and the encryption key, determining that the access mode of the target storage unit is a second medium mode; in response to the encrypted medium carried by the management instruction including the encryption key, determining that the access mode of the target storage unit is a third medium mode.

[0014] In one embodiment of the present application, in response to determining that the access mode of the target storage unit is the second media mode or the third media mode, recording the encryption medium carried by the management instruction includes: obtaining a root key, and encrypting the encryption medium using the root key; controlling the generation of a random key, and encrypting the random key using the root key; recording the encrypted encryption medium and the random key; wherein the random key is used to encrypt data after being merged with the encryption key.

[0015] In one embodiment of the present application, the encryption medium carried by the record management instruction includes: calling an encryption configuration table stored in a hard disk; wherein the header of the encryption configuration table includes a unit label category, a storage address range category, an access mode category, an access password category, an encryption key category, and a random key category of the storage unit; based on the category of the encryption medium and the target storage unit, the encrypted medium is written into the body of the corresponding header in the encryption configuration table.

[0016] In one embodiment of the present application, driving the target address to execute the control request includes: in response to the control request being a hard disk write request, obtaining write data carried by the hard disk write request; and writing the write data to the target address.

[0017] In one embodiment of the present application, writing write data to a target address includes: querying an access mode of the target address; in response to the access mode of the target address being a media mode and the encrypted medium including an encryption key, obtaining the encryption key of the target address stored on the hard disk; encrypting the write data using the obtained encryption key, and writing the encrypted write data to the target address.

[0018] In one embodiment of the present application, encrypting the write data using the obtained encryption key includes: obtaining a random key stored at a target address on the hard disk; fusing the random key and the encryption key to obtain a fused key; and encrypting the write data using the fused key.

[0019] On the other hand, a hard disk is provided, which includes: multiple storage units and a control drive module; the control drive module is connected to the storage units; the control drive module includes a hard disk drive, and the hard disk drive can create a number of virtual units, each of which is connected to the hard disk drive and associated with the storage units; the control drive module is used to implement the following steps: respond to the virtual unit obtaining a control request, and use the virtual unit that obtains the control request as the current virtual unit; parse the storage unit associated with the current virtual unit and use it as the target address; drive the target address to execute the control request.

[0020] On the other hand, a storage system is provided, which includes an interactive device and a hard disk as described above; the interactive device includes an interactive module and an interactive channel, the interactive module includes multiple sub-interactive units, and each interactive unit is connected to an interactive channel respectively; the virtual units of the hard disk are connected to an interactive channel respectively.

[0021] On the other hand, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps: in response to a virtual unit obtaining a control request, taking the virtual unit that obtains the control request as the current virtual unit; parsing a storage unit associated with the current virtual unit and taking it as a target address; and driving the target address to execute the control request.

[0022] On the other hand, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are implemented: in response to a virtual unit obtaining a control request, the virtual unit that obtains the control request is used as the current virtual unit; a storage unit associated with the current virtual unit is parsed and used as a target address; and the target address is driven to execute the control request.

[0023] On the other hand, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: in response to a virtual unit obtaining a control request, the virtual unit that obtains the control request is used as the current virtual unit; the storage unit associated with the current virtual unit is parsed and used as the target address; and the target address is driven to execute the control request.

[0024] In the above-mentioned hard disk control method, hard disk, storage system, computer program product, computer device and computer-readable storage medium, the control drive module of the hard disk can create several virtual units, and the virtual units are connected to the hard disk drive and associated with the storage units. As such, in the present application, it is possible to receive control instructions for the hard disk through the virtual units, and locate the storage unit associated with the current virtual unit receiving the control instructions, and execute the corresponding control request. In other words, when controlling the hard disk, it is possible to demand to know the storage address or intended storage address of specific data, and the address can be located relatively simply and clearly through the virtual units, so as to optimize the working principle of the hard disk and improve the convenience and response efficiency of the hard disk. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a structural schematic diagram of an embodiment of a hard disk of the present application;

[0026] Figure 2 is a structural schematic diagram of another embodiment of the hard disk of the present application;

[0027] Figure 3 It is a structural schematic diagram of another embodiment of the hard disk of the present application;

[0028] Figure 4 It is a structural diagram of an embodiment of a storage system of the present application;

[0029] Figure 5 is a structural diagram of another embodiment of the storage system of the present application;

[0030] Figure 6 It is a flowchart of an embodiment of the hard disk control method of the present application;

[0031] Figure 7 It is a flowchart of another embodiment of the hard disk control method of the present application;

[0032] Figure 8 This is a flowchart of an embodiment of executing a new instruction of the present application;

[0033] Fig. 9 This is a flowchart of an embodiment of executing an update instruction of the present application;

[0034] Fig.10 This is a flowchart of an embodiment of executing a discard instruction of the present application;

[0035] Fig.11 This is a flowchart of an embodiment of the present application executing a hard disk access request;

[0036] Fig.12 This is a flowchart of an embodiment of the present application executing a hard disk write request;

[0037] Fig.13It is a structural diagram of an embodiment of a computer device of the present application. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0039] In order to solve the technical problem that the hard disk operation is cumbersome and affects the efficiency in the related art, the present application provides a hard disk control method, a hard disk, a storage system, a computer program product, a computer device and a computer-readable storage medium. The hard disk includes a control drive module and a plurality of storage units; wherein the hard disk drive of the control drive module can create a plurality of virtual units, each of which is respectively connected to the hard disk drive and associated with the storage unit; the hard disk control method includes: in response to the virtual unit obtaining a control request, the virtual unit that obtains the control request is used as the current virtual unit; the storage unit associated with the current virtual unit is parsed and used as the target address; the target address is driven to execute the control request. The specific architecture and detailed working principle of the present application are described below with examples.

[0040] See also Figure 1 , Figure 1 It is a structural diagram of a hard disk embodiment of the present application.

[0041] In one embodiment, the hard disk may include a plurality of storage units 111 and a control driving module 20 .

[0042] The control driving module 20 is connected to the storage unit 111 .

[0043] The control driving module 20 includes a hard disk drive 21 . The hard disk drive 21 can create a plurality of virtual units 31 . Each virtual unit 31 is respectively connected to the hard disk drive 21 and associated with the storage unit 111 .

[0044] Optionally, the mapping relationship between the virtual unit 31 and the storage unit 111 can be one-to-one, one-to-many, many-to-one, etc., which is not limited here. It is not recommended to configure the mapping relationship between the virtual unit 31 and the storage unit 111 as many-to-many, but it can be set as such to meet its own needs, that is, the mapping relationship between the virtual unit 31 and the storage unit 111 is set to many-to-many, which is not strictly limited here.

[0045] The control driving module 20 can respond to the virtual unit 31 to obtain the control request, take the virtual unit 31 that obtains the control request as the current virtual unit 31; parse the storage unit 111 associated with the current virtual unit 31 and take it as the target address; and drive the target address to execute the control request.

[0046] It can be seen that the control drive module 20 of the hard disk in this embodiment can create a number of virtual units 31, and the virtual unit 31 is connected to the hard disk drive 21 and associated with the storage unit 111. As such, in this application, it is possible to receive a control request for the hard disk through the virtual unit 31, and locate the storage unit 111 associated with the current virtual unit 31 that receives the control request, and execute the corresponding control request. In other words, when controlling the hard disk, it is possible to demand to know the storage address or intended storage address of specific data, and the virtual unit 31 can be used to relatively simply and clearly locate the address, so as to optimize the working principle of the hard disk and improve the convenience and response efficiency of the hard disk.

[0047] See also Figure 2 , Figure 2 It is a structural schematic diagram of another embodiment of the hard disk of the present application.

[0048] In one embodiment, the hard disk includes a first storage module 11 , an encryption module 40 and a control and driving module 20 .

[0049] The first storage module 11 includes a plurality of storage units 111. Generally speaking, the storage unit 111 can be considered as a sub-hard disk, etc. The first storage module 11 is compatible with the storage unit 111 in an encrypted state and the storage unit 111 in a non-encrypted state.

[0050] Optionally, during the hard disk generation process, the space state of at least one storage unit 111 may be pre-specified as an encrypted state, and the space state of at least one storage unit 111 may be pre-specified as a non-encrypted state, such as pre-configuring the encrypted storage unit 111 and the non-encrypted storage unit. And / or, at least one storage unit 111 may be reserved without a pre-configured space state, so that the user can configure the space state of the reserved storage unit 111 to meet his own data storage security needs, and other storage units 111 in the hard disk may be pre-configured as an encrypted state or a non-encrypted state.

[0051] For example, all storage units 111 in the first storage module 11 are pre-set, and the space status of some storage units 111 can be set to an encrypted state, that is, the access mode is a medium mode that requires encrypted media for decryption, and the space status of other storage units 111 can be set to a non-encrypted state, that is, the access mode is a pass-through mode that does not require encrypted media for decryption, allowing direct access to data stored in the storage unit 111 without authentication.

[0052] Alternatively, some storage units 111 in the first storage module 11 are pre-set, and some storage units 111 are reserved for self-configuration. That is, the space status of some storage units 111 can be pre-set to an encrypted state, or the space status of some storage units 111 can be set to a non-encrypted state, or the space status of some storage units 111 can be pre-set to an encrypted state, and the space status of some storage units 111 can be pre-set to a non-encrypted state; other storage units 111 are reserved without pre-setting the space status, and their space status can be freely selected to be set to an encrypted state or a non-encrypted state.

[0053] Alternatively, all storage units 111 in the first storage module 11 may not have a preset space status.

[0054] The specific working principle of the storage unit 111 configured without a pre-set spatial state will be explained in the following text with examples and will not be repeated here.

[0055] The encryption module 40 is used to encrypt at least one storage unit 111 .

[0056] The control and driving module 20 is connected to the first storage module 11 and the encryption module 40. The control and driving module 20 can obtain a hard disk access request; identify the space state of the target address of the hard disk access request; wherein the space state includes an encrypted state and a non-encrypted state; the hard disk includes a plurality of storage units 111, wherein the space states of two storage units 111 may be different; in response to the storage unit 111 to which the target address belongs being in an encrypted state, authenticate the requester of the hard disk access request, so as to allow the hard disk access request to be responded to when the requester passes the identity authentication.

[0057] It can be seen that in this embodiment, the hard disk can be divided into multiple storage units 111. In addition, the spatial state of at least one storage unit 111 is pre-set to an encrypted state, and the spatial state of at least one storage unit 111 is pre-set to a non-encrypted state; and / or, the spatial state of at least one storage unit 111 is configurable. In this way, the hard disk can store encrypted storage units 111 and non-encrypted storage units 111 at the same time, making it compatible with encrypted storage units 111 and non-encrypted storage units 111 to adapt to data storage with different encryption requirements. After obtaining a hard disk access request, whether access to the data is allowed can be verified based on the spatial state of the target address and the identity of the requester, so as to ensure data security while taking into account data storage flexibility.

[0058] See also Figure 3 , Figure 3 It is a structural diagram of another embodiment of the hard disk of the present application.

[0059] In one embodiment, the encryption module 40 may include a random key unit 41 , a key protection unit 42 , and an encryption unit 43 .

[0060] The random key unit 41 is used to generate a random key.

[0061] The key protection unit 42 is used to store the root key. The key protection unit 42 hides the access channel relative to the outside of the hard disk.

[0062] The encryption unit 43 is used to encrypt at least one of the random key, the encryption key and the access password based on the root key.

[0063] Optionally, the storage module may further include a second storage module 12. The second storage module 12 is invisible to the outside of the hard disk and is used to store the encryption configuration table, thereby preventing the hard disk from externally accessing the encryption configuration table, which is beneficial to improving the storage security of the encryption configuration table, reducing the risk of the encryption configuration table being acquired and affecting the security of the storage unit 111 of the hard disk in an encrypted state, and can further improve the security of the hard disk.

[0064] Furthermore, the control drive module 20 may further include a control unit 22. The hard disk drive 21 may be used to create a virtual unit 31 (eg Figure 1 ), and save the mapping relationship between the virtual unit 31 and the storage unit 111. In this way, the control unit 22 does not need to perceive the virtual unit 31 and save the relationship between the virtual unit 31 and the storage unit 111. For example, when a new module (i.e., the virtual unit 31) is added to the hard disk, the workload of the control unit 22 will not be significantly increased, which is conducive to ensuring the performance of the control unit 22. As the name suggests, the control unit 22 can be considered to be equivalent to the main control chip of the hard disk, and the hard disk drive is used to specifically drive the storage unit 111 to execute control requests, etc.

[0065] See also Figure 4 , Figure 4 It is a structural diagram of an embodiment of the storage system of the present application.

[0066] In one embodiment, the storage system includes an interactive device and a hard disk as described above; the interactive device includes an interactive module 51 and an interactive channel 52, the interactive module 51 includes multiple sub-interactive units, each interactive unit is connected to an interactive channel 52; the virtual units 31 of the hard disk are respectively connected to an interactive channel 52.

[0067] Optionally, the mapping relationship between the interaction module 51 and the virtual unit 31 can be one-to-one, one-to-many, many-to-one, etc., which is not limited here. It is not recommended to configure the mapping relationship between the interaction module 51 and the virtual unit 31 as many-to-many, but it can be set as such to meet its own needs, that is, the mapping relationship between the interaction module 51 and the virtual unit 31 is set to many-to-many, which is not strictly limited here.

[0068] See also Figure 5 , Figure 5 It is a structural diagram of another embodiment of the storage system of the present application.

[0069] In one embodiment, the virtual unit 31 of the hard disk, the storage unit 111 and the interactive module 51 of the interactive device can be in a one-to-one mapping relationship, which can simplify the efficiency of identifying the storage unit 111 as the target when obtaining management instructions / control requests, which is conducive to further improving the response efficiency of the hard disk, and further conducive to improving the performance of the hard disk. In this way, the process of the user identifying the storage unit 111 can be simplified, and the interactive module 51 can adapt to the naming of the storage unit 111 when naming or be defined by the user.

[0070] For the specific definition of the control and driving module, please refer to the definition of the hard disk control method below, which will not be repeated here. Each module in the above control and driving module can be implemented in whole or in part by software, hardware and a combination thereof. The above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0071] See also Figure 6 , Figure 6 It is a flowchart of an embodiment of the hard disk control method of the present application.

[0072] S101: Obtain a hard disk access request.

[0073] In this embodiment, as the name implies, the hard disk access request requests access to data stored in the hard disk, which can be considered as a request to read data stored in the hard disk.

[0074] S102: Identify the spatial status of the target address of the hard disk access request; wherein the spatial status includes an encrypted state and a non-encrypted state, and the hard disk includes multiple storage units; the spatial status of at least one storage unit is pre-set to an encrypted state, and the spatial status of at least one storage unit is pre-set to a non-encrypted state; and / or, the spatial status of at least one storage unit is configurable.

[0075] In this embodiment, as described above, the hard disk is compatible with storage units whose space status is encrypted and storage units whose space status is non-encrypted. When a hard disk access request is obtained, it can be identified whether the storage unit targeted by the hard disk access request is in an encrypted state.

[0076] By the way, in this embodiment, there are two naming methods for the target storage unit. When obtaining control requests such as hard disk access requests and hard disk write requests, the target storage unit is called the target address; when obtaining management instructions such as new instructions and update instructions for configuring the access mode / space status, the target storage unit is called the target storage unit, so as to make naming distinctions for different functions.

[0077] In this embodiment, the space state of the storage unit can be formed in the following ways: the space state of at least one storage unit can be pre-specified as an encrypted state, and the space state of at least one storage unit can be pre-specified as a non-encrypted state during the hard disk generation process, such as pre-configuring the encrypted storage unit and the non-encrypted storage unit. And / or, at least one storage unit can be reserved without pre-configured space state, so that the user can configure the space state of the reserved storage unit to meet his own data storage security needs, and other storage units in the hard disk can be pre-configured as an encrypted state or a non-encrypted state.

[0078] For example, all storage units in the first storage module are pre-set, and the space status of some storage units can be set to an encrypted state, that is, the access mode is a media mode that requires encrypted media for decryption, and the space status of other storage units can be set to a non-encrypted state, that is, the access mode is a pass-through mode that does not require encrypted media for decryption, allowing direct access to data stored in the storage unit without authentication.

[0079] Alternatively, some storage units in the first storage module are pre-set, and some storage units are reserved for self-configuration. That is, the space status of some storage units can be pre-set to an encrypted state, or the space status of some storage units can be set to a non-encrypted state, or the space status of some storage units can be pre-set to an encrypted state, and the space status of some storage units can be pre-set to a non-encrypted state; other storage units are reserved without pre-setting the space status, and their space status can be freely selected to be set to an encrypted state or a non-encrypted state.

[0080] Alternatively, all storage units in the first storage module may not have a preset space status.

[0081] S103: In response to the storage unit to which the target address belongs being in an encrypted state, identity verification is performed on the requester of the hard disk access request, so that the hard disk access request is allowed to be responded to when the requester passes the identity verification.

[0082] In this embodiment, in response to the storage unit to which the target address belongs being in an encrypted state, the data at the target address is considered to have a certain degree of confidentiality, and the identity of the requester requesting access to the target address needs to be verified. When the requester passes the identity authentication, the hard disk access request is responded to to ensure the security of the confidential data.

[0083] It can be seen that in this embodiment, the hard disk can be divided into multiple storage units. In addition, the spatial state of at least one storage unit is pre-set to an encrypted state, and the spatial state of at least one storage unit is pre-set to a non-encrypted state; and / or, the spatial state of at least one storage unit is configurable. In this way, encrypted storage units and non-encrypted storage units can be stored in the hard disk at the same time, making it compatible with encrypted storage units and non-encrypted storage units to adapt to data storage with different encryption requirements. After obtaining a hard disk access request, whether access to the data is allowed can be verified based on the spatial state of the target address and the identity of the requester, so as to ensure data security while taking into account data storage flexibility.

[0084] See also Figure 7 , Figure 7 It is a flowchart of another embodiment of the hard disk control method of the present application.

[0085] In one embodiment, the hard disk includes a control drive module and a plurality of storage units; wherein the hard disk drive of the control drive module can create a plurality of virtual units, each of which is respectively connected to the hard disk drive and associated with the storage unit. Based on this, the hard disk control method can be as follows:

[0086] S201: In response to a virtual unit obtaining a control request, the virtual unit that obtains the control request is used as a current virtual unit.

[0087] In this embodiment, the virtual unit that obtains the control request is used as the current virtual unit.

[0088] As explained in the above examples, the control request may include at least one of a hard disk access request and a hard disk write request. For example, a hard disk modification request may be considered to include two steps, namely, a hard disk access process and a hard disk write process. In this embodiment, the hard disk write process may include two processes: deleting data and specifically writing data.

[0089] S202: Parse the storage unit associated with the current virtual unit and use it as the target address.

[0090] In this embodiment, as described above, the virtual unit has been pre-associated with the storage unit. Therefore, when the current virtual unit obtains the control request, the storage unit associated with the current virtual unit can be regarded as the target storage unit, that is, the target address.

[0091] S203: Drive the target address to execute the control request.

[0092] In this embodiment, in response to parsing the target address, the target address may be driven to execute a control request.

[0093] It can be seen that the control drive module of the hard disk in this embodiment can create several virtual units, and the virtual units are connected to the hard disk drive and associated with the storage unit. As such, in this application, it is possible to receive a control request for the hard disk through the virtual unit, and locate the storage unit associated with it according to the current virtual unit that receives the control request, and execute the corresponding control request. In other words, when controlling the hard disk, it is possible to demand to know the storage address or intended storage address of specific data, and the address can be located relatively simply and clearly through the virtual unit, so as to optimize the working principle of the hard disk and improve the convenience and response efficiency of the hard disk.

[0094] Specifically, when parsing the storage unit associated with the current virtual unit, the configuration information of the current virtual unit can be obtained, and the unit information associated with the current virtual unit in the configuration information is identified, wherein the unit information belongs to the storage unit associated with the current virtual unit.

[0095] That is, the unit information of the storage unit is obtained, wherein the unit information includes an access mode and a unit identifier. A virtual unit associated with the storage unit is created based on the unit information, wherein the virtual unit is used to receive a control request for the storage unit.

[0096] Optionally, the unit identifier may be a unit number and / or a storage address range of a storage unit, which is not limited here.

[0097] Accordingly, the principle of creating several virtual units may be to obtain the unit information of the storage units in the hard disk respectively, wherein the unit information includes the unit identification, create a virtual unit for each storage unit respectively, and configure the created virtual unit using the unit information of the storage unit.

[0098] Furthermore, the virtual unit may be configured based on an access mode of the storage unit. For example, the access mode may include a pass-through mode and a medium mode.

[0099] Specifically, the unit identification of the storage unit may be written into the configuration information of the virtual unit.

[0100] The access mode of the storage unit is written into the configuration information of the virtual unit to identify the space status of the storage unit based on the access mode. When the virtual unit obtains a control request, it determines whether to authenticate the requester based on the access mode.

[0101] In the present application, an encryption configuration table can be constructed in the hard disk to manage the access mode of the storage unit based on the encryption configuration table. That is, the encryption configuration table includes the access mode of the storage unit in the hard disk; when the storage unit is in an encrypted state, the encryption configuration table also includes encryption data for encrypting the storage unit.

[0102] Further, as described above, the hard disk includes a first storage module and a second storage module. The first storage module includes a plurality of storage units that are allowed to be accessed, and the second storage module hides an access channel relative to the outside of the hard disk.

[0103] The encryption configuration table can be stored in the second storage module. In other words, the encryption configuration table is not visible or accessible from the outside of the hard disk, which can reduce the risk of the encryption configuration table being tampered with, thereby helping to improve the security of the encryption configuration table. In this way, the second storage module can be accessed to perform a read operation on the encryption configuration table stored in the second storage module.

[0104] Optionally, the hard disk may obtain or generate a management instruction for managing the storage unit, such as adjusting information associated with the target storage unit in the encryption configuration table based on the management instruction to modify the control method of the storage unit.

[0105] For example, the management instruction may include at least one of a new creation instruction, an update instruction, and a discard instruction. The new creation instruction may be used to create a new storage unit or set a free storage unit; the update instruction may be used to modify the encrypted data of the target storage unit; and the discard instruction may be used to instruct the discard of the target storage unit. The following is an example of the execution working principle of each management instruction.

[0106] See also Figure 8 , Figure 8 It is a flowchart of an embodiment of executing a new instruction of the present application.

[0107] S301: Obtain a new creation instruction.

[0108] S302: Identify that the newly created instruction carries an encrypted medium.

[0109] In this embodiment, the target storage unit of the new creation instruction may be encrypted using the encryption medium carried by the new creation instruction.

[0110] S303: Determine whether the encrypted medium includes an access password.

[0111] In this embodiment, when it is determined that the encrypted medium includes an access password, step S304 is executed; when it is determined that the encrypted medium does not include an access password, step S306 is executed.

[0112] S304: Obtain a root key, and use the root key to encrypt the access password.

[0113] In this embodiment, the root key generated by the hard disk can be obtained, and the access password can be encrypted using the root key. In this way, the access password can be used to lock the target storage unit during the actual use of the hard disk.

[0114] Optionally, a key protection unit located in the second storage module may be called to obtain a root key stored in the key protection unit.

[0115] S305: Write the encrypted access password into the encryption configuration table.

[0116] In this embodiment, the access password encrypted by the root key may be written into the encryption configuration table.

[0117] For example, the header of the encryption configuration table includes the unit label category, storage address range category, access mode category, access password category, encryption key category and random key category of the storage unit. In this way, the encrypted medium can be written into the body of the corresponding header in the encryption configuration table based on the category of the encrypted medium and the target storage unit.

[0118] S306: Determine whether the encrypted medium includes an encryption key.

[0119] In this embodiment, when it is determined that the encrypted medium includes an encryption key, step S307 is executed; when it is determined that the encrypted medium does not include an encryption key, step S311 is executed (eg, Figure 8 ) or the process ends.

[0120] S307: Obtain a root key, and use the root key to encrypt the encryption key.

[0121] In this embodiment, a root key generated by the hard disk is obtained, and the encryption key is encrypted using the root key.

[0122] S308: Obtain a random key randomly generated by the hard disk.

[0123] In this embodiment, as described above, the hard disk may include a random key unit, and a random key may be generated by the random key unit. In this way, the random key and the encryption key may be used together to encrypt the target storage unit to further improve the security of data encryption.

[0124] S309: Obtain a root key, and use the root key to encrypt the random key.

[0125] In this embodiment, a root key generated by the hard disk is obtained, and the encryption key is encrypted using the root key.

[0126] S310: Write the encrypted encryption key and the random key into the encryption configuration table.

[0127] In this embodiment, the encrypted root key and the random key may be written into the encryption configuration table as encryption data.

[0128] In this way, the random key of the encrypted target storage unit can be saved, so that when the data in the target storage unit is subsequently decrypted, the random key saved in the encryption configuration table can be parsed to decrypt the data in the target storage unit using the random key and the encryption key.

[0129] That is to say, when the encryption medium includes an encryption key, when encrypting the target storage unit, the encryption key and the random key can be fused to obtain a fused key; the fused key is used to encrypt the data in the target storage unit. The specific working principle will be explained in detail later and will not be repeated here.

[0130] S311: Write other attributes into the encryption configuration table.

[0131] As such, in this embodiment, the encrypted medium may be written into the encryption configuration table and associated with the target storage unit, so as to authenticate the requesting party for accessing the target storage unit based on the encryption configuration table.

[0132] Furthermore, in this embodiment, after the encryption medium is encrypted using the root key, the root key stored in the first storage module may be deleted to reduce the risk of the root key being obtained, thereby further improving the security and reliability of the hard disk.

[0133] For example, you can identify the access mode of the target storage unit and fill it into the corresponding access mode category, or you can extract the corresponding field in the new instruction and write it into the table body corresponding to each table header in the encryption configuration table. I will not go into details here.

[0134] Optionally, the header in the encryption configuration table can be hidden or not set, and the header corresponding to each column / row can be specified by code or the like; or, the header is clearly specified in the encryption configuration table, which is not limited here.

[0135] The encryption configuration table can be shown as an example in the following table:

[0136] Table 1 Encryption configuration table

[0137]

[0138] That is to say, in this application, the user's control request can be received through the virtual unit to reduce the tedious steps of confirming the detailed storage address of the specific control request target; the hard disk can also be compatible with encrypted storage units and non-encrypted storage units to improve the flexibility of the data storage security level. Furthermore, in this application, the encryption level can be further set for the storage unit whose space state is encrypted, while adaptively ensuring data security, reducing the encryption burden of data with relatively low security requirements in the encrypted data.

[0139] That is, based on different combinations of encryption media, the access mode of the storage unit in this embodiment may include at least a pass-through mode, a first medium mode, a second medium mode, and a third medium mode, wherein the pass-through mode means that access is allowed without identity verification.

[0140] The encrypted medium of the first media mode includes an access password. In combination with the configuration of the storage unit through the management instruction (new instruction) described in the above embodiment, the encrypted medium carried by the management instruction can be identified and recorded. In response to the encrypted medium carried by the management instruction including the access password, it is determined that the access mode of the target storage unit is the first media mode.

[0141] The encrypted medium of the second media mode may include an access password and an encryption key. In combination with the configuration of the storage unit through the management instruction (new creation instruction) described in the above embodiment, the encrypted medium carried by the management instruction may be identified and recorded. In response to the encrypted medium carried by the management instruction including the access password and the encryption key, it is determined that the access mode of the target storage unit is the second media mode.

[0142] The encryption medium of the third media mode may include an encryption key. In combination with the configuration of the storage unit through the management instruction (new instruction) described in the above embodiment, the encryption medium carried by the management instruction can be identified and recorded. In response to the encryption medium carried by the management instruction including the encryption key, it is determined that the access mode of the target storage unit is the third media mode.

[0143] When the access mode of the target storage unit is the second medium mode or the third medium mode, the root key can be obtained and the encryption medium can be encrypted using the root key. The random key unit is controlled to generate a random key. The random key is encrypted using the root key. The encrypted encryption medium and the random key are recorded. The random key can be used to encrypt data after being merged with the encryption key.

[0144] In other words, in this embodiment, the storage space of the hard disk is preset as a plurality of storage units. At least one of the storage units can be configured with an access mode through a management instruction. That is, in response to obtaining a management instruction, the target storage unit can be configured based on the management instruction; wherein the management instruction is used to configure at least one of the access mode of the storage unit and the encryption medium. A virtual unit associated with the target storage unit is configured. The specific configuration principle is as described in the example above, and will not be repeated here.

[0145] See also Fig. 9 , Fig. 9 It is a flowchart of an embodiment of executing an update instruction of the present application.

[0146] S401: Get update instructions.

[0147] S402: Query the access mode of the target storage unit in the encryption configuration table.

[0148] In this embodiment, when the access mode is the pass-through mode, step S406 may be executed; when the access mode is the medium mode, step S403 may be executed.

[0149] S403: Authentication is performed on the party issuing the update instruction.

[0150] In this embodiment,

[0151] In response to the space status of the target storage unit being an encrypted state, an identity authentication is performed on a party that issues the update instruction.

[0152] S404: Determine whether the original encrypted data in the encryption configuration table includes an encryption key.

[0153] In this embodiment,

[0154] S405: Decrypt the data stored in the target storage unit using the original encryption key.

[0155] S406: Process the target storage unit according to the update instruction.

[0156] In this embodiment, taking the case where the encryption medium indicated by the update instruction includes an encryption key as an example, the decrypted data may be encrypted using the target encryption key.

[0157] S407: Update the encryption data of the target storage unit in the encryption configuration table to the target encryption data.

[0158] In this embodiment, the target encrypted data is the encrypted data to be updated according to the update instruction.

[0159] The encrypted data is the encrypted medium encrypted by the root key stored in the encryption configuration table. That is, the encrypted data may include the access password encrypted by the root key and / or the encryption key encrypted by the root key. Furthermore, when the encrypted medium includes the encryption key, it may further include a random key encrypted by the root key.

[0160] See also Fig.10 , Fig.10 It is a flowchart of an embodiment of executing a discard instruction of the present application.

[0161] S501: Get a discard instruction.

[0162] In this embodiment, the discard instruction may come from outside the hard disk, that is, the user inputs the discard instruction to instruct to discard the target storage unit.

[0163] And / or, the storage unit may be monitored inside the hard disk to determine whether to discard the storage unit.

[0164] Specifically, the storage unit in the hard disk may be monitored, and whether the storage unit meets the preset discarding condition may be determined based on the monitoring result.

[0165] In response to the storage unit meeting a preset discarding condition, the storage unit is taken as a target storage unit and a discarding instruction is generated.

[0166] In response to the absence of a storage unit that meets the preset discarding condition, no action is taken or a preset time interval is passed before detecting again whether there is a storage unit that meets the preset discarding condition, so as to manage the stability of the hard disk and discard the storage unit that may affect the stability of the hard disk, thereby improving the stability of the hard disk.

[0167] S502: Obtain a temporary key randomly generated by the hard disk.

[0168] S503: Encrypt the target storage unit using the temporary key.

[0169] In this embodiment, when the target storage unit is no longer needed through the discard instruction, the temporary key randomly generated by encrypting the target storage unit is not saved, and the temporary key can be the same as the random key. In this way, since the temporary key of the encrypted target storage unit is not saved and the temporary key is randomly generated, it is almost impossible to decrypt the target storage unit and discard the target storage unit.

[0170] S504: Clear the encrypted data of the target storage unit in the encryption configuration table.

[0171] See also Fig.11 , Fig.11 It is a flowchart of an embodiment of executing a hard disk access request of the present application.

[0172] S601: Obtain a hard disk access request.

[0173] S602: Parse the target address of the hard disk access request.

[0174] S603: Query the encryption configuration table to obtain the access mode of the storage unit to which the target address belongs.

[0175] In this embodiment, the encryption configuration table includes access modes of storage units in the hard disk.

[0176] Further, as described above, the hard disk includes a first storage module and a second storage module. The first storage module includes a plurality of storage units that are allowed to be accessed, and the second storage module hides an access channel relative to the outside of the hard disk.

[0177] The encryption configuration table can be stored in the second storage module. In other words, the encryption configuration table is not visible or accessible from the outside of the hard disk, which can reduce the risk of the encryption configuration table being tampered with, thereby helping to improve the security of the encryption configuration table. In this way, the second storage module can be accessed to perform a read operation on the encryption configuration table stored in the second storage module.

[0178] S604: Determine the spatial status of the target address based on the access mode.

[0179] In this embodiment, when it is determined that the spatial state of the target address is an encrypted state, step S605 is executed; when it is determined that the spatial state of the target address is a non-encrypted state, step S616 is executed.

[0180] The access mode of the storage unit may include at least a pass-through mode, a first medium mode, and a second medium mode; wherein the encryption and decryption complexity of the first medium mode is higher than the encryption and decryption complexity of the second medium mode.

[0181] If so, in response to the access mode being the pass-through mode, the spatial state of the target address can be determined to be an unencrypted state; in response to the access mode being the first medium mode or the second medium mode, the spatial state of the target address can be determined to be an encrypted state.

[0182] S605: Obtain verification parameters from the requester.

[0183] S606: Obtain the encrypted data of the target address in the encryption configuration table.

[0184] In this embodiment, the encrypted data includes the encrypted medium encrypted by the root key.

[0185] S607: Determine whether the encrypted data in the encryption configuration table includes an access password.

[0186] In this embodiment, when it is determined that the encrypted data in the encryption configuration table includes an access password, step S608 is executed; when it is determined that the encrypted data in the encryption configuration table does not include an access password, step S610 is executed.

[0187] S608: Obtain the root key and decrypt the access password in the encrypted data.

[0188] S609: Compare the access passwords of the verification parameter and the encrypted data to ensure they match.

[0189] In this embodiment, when it is determined that the access passwords of the verification parameter and the encrypted data match, step S610 is executed; when it is determined that the access passwords of the verification parameter and the encrypted data do not match, it can be considered that the access password sent by the requesting party is wrong, and it can be considered that it does not have the authority to access the target address, so the process can end.

[0190] S610: Determine whether the encrypted data in the encryption configuration table includes an encryption key.

[0191] In this embodiment, when it is determined that the encrypted data in the encryption configuration table includes an encryption key, step S611 is executed; when it is determined that the encrypted data in the encryption configuration table does not include an encryption key, step S616 is executed.

[0192] S611: Obtain the root key of the hard disk and decrypt the encryption key in the encrypted data.

[0193] S612: Compare and verify the encryption key of the parameter and the encrypted data to ensure they match.

[0194] In this embodiment, when it is determined that the encryption keys of the verification parameters and the encrypted data match, step S613 is executed; when it is determined that the encryption keys of the verification parameters and the encrypted data do not match, it can be considered that the encryption key sent by the requesting party is wrong, and it can be considered that it does not have the authority to access the target address, so the process can end.

[0195] S613: Obtain the root key of the hard disk and decrypt the random key in the encrypted data.

[0196] In this embodiment, the root key is used to decrypt the encrypted data to obtain a random key.

[0197] S614: The encryption key and the random key are merged to obtain a merged key.

[0198] S615: Decrypt the data stored at the target address.

[0199] In this embodiment, the fusion key can be used to decrypt the data stored in the target address.

[0200] S616: Read the data requested by the hard disk access request.

[0201] That is to say, in this embodiment, the encrypted data is an encrypted medium encrypted by the root key, and the root key can be used to decrypt the encrypted data to obtain the encrypted medium. By comparing whether the encrypted medium matches the verification parameter, the identity of the requester of the hard disk access request is authenticated. That is, it can be analyzed whether the verification parameter matches the encrypted data. In response to the verification parameter matching the encrypted data, it can be considered that the requester has the authority to access the target address, and it is determined that the requester has passed the identity authentication, and the control request is allowed to be executed.

[0202] See also Fig.12 , Fig.12 It is a flowchart of an embodiment of the present application executing a hard disk write request.

[0203] S701: Obtain a hard disk write request.

[0204] S702: Obtain write data carried by the hard disk write request.

[0205] S703: Query the access mode of the target address of the hard disk write request.

[0206] S704: Determine whether the encryption medium at the target address includes an encryption key.

[0207] In this embodiment, when it is determined that the encrypted medium of the target address includes an encryption key, step S705 is executed; when it is determined that the encrypted medium of the target address does not include an encryption key, step S707 is executed.

[0208] S705: Obtain the encryption key stored at the target address of the hard disk.

[0209] In this embodiment, in response to the access mode of the target address being the media mode and the encrypted medium including the encryption key, the encryption key stored in the target address of the hard disk may be acquired.

[0210] S706: Encrypt the write data using the encryption key.

[0211] In this embodiment, the written data may be encrypted using an encryption key.

[0212] Alternatively, as described in the above embodiments, the written data may be further encrypted in combination with a random key. Specifically, the random key stored at the target address of the hard disk may be obtained; the random key and the encryption key may be merged to obtain a merged key; and the written data may be encrypted using the merged key.

[0213] S707: Write the write data into the target address.

[0214] In this embodiment, if the access mode of the hard disk is the direct mode or the first medium mode as described above, that is, the decryption medium does not include the encryption key and there is no need to encrypt the write data using the encryption key, the write data can be written to the target address. If the access mode of the hard disk is the second medium mode or the third medium mode as described above, that is, the decryption medium includes the encryption key, the write data is encrypted using the obtained encryption key, and the encrypted write data is written to the target address.

[0215] That is, in this embodiment, when the space state of the target address is encrypted, the request category of the control request can be identified. That is, in response to the space state of the target address being encrypted, before driving the target address to execute the control request, the type of the control request can be distinguished.

[0216] In response to the request type of the control request being a hard disk access request, it may be determined to authenticate the identity of the requesting party to ensure the security of confidential data in the hard disk.

[0217] In response to the control request being a hard disk write request, it can be determined that the hard disk write request is allowed to be executed, and the requester does not need to be authenticated, thereby improving data writing efficiency and reducing verification operations when writing data. Furthermore, when the requester does not need to be authenticated, the storage unit can be monitored in combination with the preset discarding conditions described above. When it is determined that the requester writes a large amount of data in a short period of time and even causes the storage space of the storage unit to be exhausted or almost exhausted, a discarding instruction can be generated to discard the storage unit.

[0218] In an alternative embodiment, the requester of the hard disk write request may also be authenticated to screen the requester to a certain extent and reduce the risk of situations affecting the stability of the hard disk.

[0219] In layman's terms, the original components in hard disks such as NVMe (Non Volatile Memory Host Controller Interface Specification) SSDs can remain unchanged, and the main control chip executes the hard disk firmware code. Temporary data run by the main control chip is stored in volatile memory, and persistently stored data is stored in the medium space of NAND (Non-Linear Macrocell Mode Memory) particles. In this application, NVMe SSD disks can add encryption units, random key units, and key protection units. The encryption unit can provide symmetric encryption and decryption capabilities for the hard disk; the random key unit provides the hard disk with the ability to generate true random numbers; the key protection unit can use random key units such as a true random number generator to generate a root key before leaving the factory, provide the hard disk with access to the root key, and restrict external access to the root key from the hard disk.

[0220] An encryption configuration table is maintained in the hard disk firmware. The content in the encryption configuration table includes data such as the unit number, address range, access mode, access password, encryption key, random key, etc. of each storage unit. The encryption configuration table can be stored in a NAND space that is not accessible to users. When a user creates a sub-hard disk (i.e., a storage unit) through the management software, the attribute parameters are sequentially passed through the virtual device, physical device, and hard disk firmware logic of the operating system custom driver, and finally saved in the encryption configuration table of the firmware. When a user reads the encrypted data stored on the sub-hard disk through the management software, he needs to enter the access password and / or encryption key. The firmware obtains the access password, encryption key, and random key written during creation or configuration from the encryption configuration table.

[0221] For example, the confidential media includes both the access password and the encryption key. First, the access password is used for authentication, then the encryption key is used for secondary authentication, and finally the encryption key and random key are used to generate a fusion key to decrypt the data in the hard disk and return it to the user, thus ensuring the security of the confidential data as much as possible. The user writes through the management software

[0222] When the sub-hard disk data is encrypted, the hard disk firmware obtains the encryption key and random key written during creation or configuration from the encryption configuration table, generates a fusion key, and uses the fusion key to encrypt the written user data and store it on the hard disk. When the user no longer needs the data on a sub-hard disk, the discard instruction can be triggered, and the hard disk firmware generates a temporary and random temporary key to encrypt the data in the corresponding sub-hard disk and restore the security attributes in the encryption configuration table to the no security access level.

[0223] In summary, the present application sets up a storage unit mechanism through a hard disk, configures security attributes for the storage unit, maintains and manages the security access attributes of the storage unit, and performs targeted processing on the reading and writing of data in the storage unit according to the security access attributes. This can ensure both the classified storage of data (different types of data are stored in different storage units) and the hierarchical protection of data (different storage units are set with different security protection levels), thereby ensuring convenience and security on a single hard disk.

[0224] It should be understood that although Figure 6-Figure 12 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 6-Figure 12At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0225] In one embodiment, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the steps of the hard disk control method described above are implemented, which will not be described in detail here.

[0226] See also Fig.13 , Fig.13 It is a structural diagram of an embodiment of a computer device of the present application.

[0227] In one embodiment, the computer device may be a terminal, and its internal structure diagram may be as follows: Fig.13 As shown in the example.

[0228] The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a hard disk control method is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0229] Those skilled in the art will understand that Fig.13 The structure shown as an example is merely a block diagram of a portion of the structure related to the present application solution, and does not constitute a limitation on the computer device to which the present application solution is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0230] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0231] S201: In response to a virtual unit obtaining a control request, the virtual unit that obtains the control request is used as a current virtual unit.

[0232] S202: Parse the storage unit associated with the current virtual unit and use it as the target address.

[0233] S203: Drive the target address to execute the control request.

[0234] In one embodiment, when parsing a storage unit associated with the current virtual unit, the processor may also implement the following steps when executing a computer program: obtaining configuration information of the current virtual unit; identifying unit information associated with the current virtual unit in the configuration information; wherein the unit information belongs to the storage unit associated with the current virtual unit.

[0235] In one embodiment, when creating several virtual units, the processor can also implement the following steps when executing the computer program: respectively obtain the unit information of the storage units in the hard disk; wherein the unit information includes the unit identification; respectively create a virtual unit for each storage unit, and configure the created virtual unit using the unit information of the storage unit.

[0236] In one embodiment, the unit information also includes an access mode, and the access mode includes a pass-through mode and a medium mode; when the virtual unit created is configured using the unit information of the storage unit, the processor can also implement the following steps when executing the computer program: write the unit identifier of the storage unit into the configuration information of the virtual unit; write the access mode of the storage unit into the configuration information of the virtual unit to identify the spatial status of the storage unit based on the access mode, and when the virtual unit obtains a control request, determine whether to authenticate the requester based on the access mode.

[0237] In one embodiment, in response to the spatial state of the target address being an encrypted state, before driving the target address to execute a control request, the processor may also implement the following steps when executing the computer program: identifying the request category of the control request; in response to the request category of the control request being a hard disk access request, determining to authenticate the requesting party; in response to the request category of the control request being a hard disk write request, determining to allow the hard disk write request to be executed.

[0238] In one embodiment, in response to the spatial state of the target address being an encrypted state, before driving the target address to execute a control request, the processor may also implement the following steps when executing the computer program: obtaining the encrypted data of the target address in the encryption configuration table; obtaining the verification parameters from the requester; parsing whether the verification parameters match the encrypted data, and in response to the verification parameters matching the encrypted data, determining that the requester has passed the identity authentication and allowing the execution of the control request.

[0239] In one embodiment, the encrypted data includes an encrypted medium encrypted by a root key; when parsing whether the verification parameters match the encrypted data, the processor can also implement the following steps when executing the computer program: obtaining the root key of the hard disk; using the root key to decrypt the encrypted data to obtain the encrypted medium; comparing the encrypted medium with the verification parameters.

[0240] In one embodiment, in response to the encryption medium including an encryption key, the encrypted data also includes a random key encrypted by a root key; when executing a control request, the processor can also implement the following steps when executing a computer program: in response to the control request being a hard disk access request, decrypting the encrypted data using the root key to obtain a random key; fusing the random key and the encryption key to obtain a fused key; and decrypting the data stored at the target address using the fused key.

[0241] In one embodiment, when the hard disk control method is used, the processor can also implement the following steps when executing the computer program: presetting the storage space of the hard disk to multiple storage units; in response to obtaining a management instruction, configuring the target storage unit based on the management instruction; wherein the management instruction is used to configure the access mode of the storage unit, at least one of the encryption medium; configuring a virtual unit associated with the target storage unit.

[0242] In one embodiment, when configuring the target storage unit based on the management instruction, the processor may also implement the following steps when executing the computer program: identifying and recording the encryption medium carried by the management instruction; wherein the encryption medium includes an access password and / or an encryption key; in response to the encryption medium carried by the management instruction including the access password, determining that the access mode of the target storage unit is a first medium mode; in response to the encryption medium carried by the management instruction including the access password and the encryption key, determining that the access mode of the target storage unit is a second medium mode; in response to the encryption medium carried by the management instruction including the encryption key, determining that the access mode of the target storage unit is a third medium mode.

[0243] In one embodiment, in response to determining that the access mode of the target storage unit is the second media mode or the third media mode, when recording the encrypted medium carried by the management instruction, the processor can also implement the following steps when executing the computer program: obtaining a root key, and encrypting the encrypted medium using the root key; controlling the generation of a random key, and encrypting the random key using the root key; recording the encrypted encrypted medium and the random key; wherein the random key is used to encrypt data after being merged with the encryption key.

[0244] In one embodiment, when recording the encrypted medium carried by the management instruction, the processor may further implement the following steps when executing the computer program: calling an encryption configuration table stored on the hard disk; wherein the header of the encryption configuration table includes a unit label category, a storage address range category, an access mode category, an access password category, an encryption key category, and a random key category of the storage unit; based on the category of the encrypted medium and the target storage unit, writing the encrypted medium into the body of the corresponding header in the encryption configuration table.

[0245] In one embodiment, when the drive target address executes a control request, the processor may also implement the following steps when executing the computer program: in response to the control request being a hard disk write request, obtaining the write data carried by the hard disk write request; and writing the write data to the target address.

[0246] In one embodiment, when writing write data to a target address, the processor may further implement the following steps when executing a computer program: querying an access mode of the target address; in response to the access mode of the target address being a media mode and the encrypted media including an encryption key, obtaining the encryption key of the target address stored on the hard disk; encrypting the write data using the obtained encryption key, and writing the encrypted write data to the target address.

[0247] In one embodiment, when the written data is encrypted using the obtained encryption key, the processor can also implement the following steps when executing the computer program: obtain a random key stored at the target address of the hard disk; fuse the random key and the encryption key to obtain a fused key; and encrypt the written data using the fused key.

[0248] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0249] S201: In response to a virtual unit obtaining a control request, the virtual unit that obtains the control request is used as a current virtual unit.

[0250] S202: Parse the storage unit associated with the current virtual unit and use it as the target address.

[0251] S203: Drive the target address to execute the control request.

[0252] In one embodiment, when parsing a storage unit associated with the current virtual unit, the computer program can also implement the following steps when executed by the processor: obtaining configuration information of the current virtual unit; identifying unit information associated with the current virtual unit in the configuration information; wherein the unit information belongs to the storage unit associated with the current virtual unit.

[0253] In one embodiment, when creating several virtual units, the computer program can also implement the following steps when executed by the processor: respectively obtain the unit information of the storage units in the hard disk; wherein the unit information includes the unit identification; respectively create a virtual unit for each storage unit, and configure the created virtual unit using the unit information of the storage unit.

[0254] In one embodiment, the unit information also includes an access mode, and the access mode includes a pass-through mode and a medium mode; when the virtual unit created is configured using the unit information of the storage unit, the computer program can also implement the following steps when executed by the processor: write the unit identifier of the storage unit into the configuration information of the virtual unit; write the access mode of the storage unit into the configuration information of the virtual unit to identify the spatial status of the storage unit based on the access mode, and when the virtual unit obtains a control request, determine whether to authenticate the requester based on the access mode.

[0255] In one embodiment, in response to the spatial state of the target address being an encrypted state, before driving the target address to execute a control request, the computer program can also implement the following steps when being executed by the processor: identifying the request category of the control request; in response to the request category of the control request being a hard disk access request, determining to authenticate the requesting party; in response to the request category of the control request being a hard disk write request, determining to allow the hard disk write request to be executed.

[0256] In one embodiment, in response to the spatial state of the target address being an encrypted state, before driving the target address to execute a control request, the computer program can also implement the following steps when executed by the processor: obtaining the encrypted data of the target address in the encryption configuration table; obtaining the verification parameters from the requester; parsing whether the verification parameters match the encrypted data, and in response to the verification parameters matching the encrypted data, determining that the requester has passed the identity authentication and allowing the execution of the control request.

[0257] In one embodiment, the encrypted data includes an encrypted medium encrypted by a root key; when parsing whether the verification parameters match the encrypted data, the computer program can also implement the following steps when executed by the processor: obtain the root key of the hard disk; use the root key to decrypt the encrypted data to obtain the encrypted medium; compare the encrypted medium with the verification parameters.

[0258] In one embodiment, in response to the encryption medium including an encryption key, the encrypted data also includes a random key encrypted by a root key; when executing a control request, the computer program can also implement the following steps when executed by the processor: in response to the control request being a hard disk access request, decrypting the encrypted data using the root key to obtain a random key; fusing the random key and the encryption key to obtain a fused key; and decrypting the data stored at the target address using the fused key.

[0259] In one embodiment, when a hard disk control method is used, the following steps may also be implemented when the computer program is executed by a processor: presetting the storage space of the hard disk to multiple storage units; in response to obtaining a management instruction, configuring a target storage unit based on the management instruction; wherein the management instruction is used to configure an access mode of the storage unit, at least one of an encryption medium; and configuring a virtual unit associated with the target storage unit.

[0260] In one embodiment, when configuring the target storage unit based on the management instruction, the following steps may also be implemented when the computer program is executed by the processor: identifying and recording the encryption medium carried by the management instruction; wherein the encryption medium includes an access password and / or an encryption key; in response to the encryption medium carried by the management instruction including the access password, determining that the access mode of the target storage unit is a first medium mode; in response to the encryption medium carried by the management instruction including the access password and the encryption key, determining that the access mode of the target storage unit is a second medium mode; in response to the encryption medium carried by the management instruction including the encryption key, determining that the access mode of the target storage unit is a third medium mode.

[0261] In one embodiment, in response to determining that the access mode of the target storage unit is the second media mode or the third media mode, when recording the encrypted medium carried by the management instruction, the computer program can also implement the following steps when executed by the processor: obtain the root key, and encrypt the encrypted medium using the root key; control the generation of a random key, and encrypt the random key using the root key; record the encrypted encrypted medium and the random key; wherein the random key is used to encrypt the data after being merged with the encryption key.

[0262] In one embodiment, when recording the encrypted medium carried by the management instruction, the following steps may also be implemented when the computer program is executed by the processor: calling an encryption configuration table stored on the hard disk; wherein the header of the encryption configuration table includes a unit label category, a storage address range category, an access mode category, an access password category, an encryption key category, and a random key category of the storage unit; based on the category of the encrypted medium and the target storage unit, writing the encrypted medium into the body of the corresponding header in the encryption configuration table.

[0263] In one embodiment, when the drive target address executes a control request, the computer program can also implement the following steps when executed by the processor: in response to the control request being a hard disk write request, obtaining the write data carried by the hard disk write request; and writing the write data to the target address.

[0264] In one embodiment, when writing write data to a target address, the computer program can also implement the following steps when executed by a processor: querying the access mode of the target address; in response to the access mode of the target address being a media mode and the encrypted medium including an encryption key, obtaining the encryption key of the target address stored on the hard disk; encrypting the write data using the obtained encryption key, and writing the encrypted write data to the target address.

[0265] In one embodiment, when the written data is encrypted using the acquired encryption key, the following steps can also be implemented when the computer program is executed by the processor: obtaining a random key stored at the target address of the hard disk; fusing the random key and the encryption key to obtain a fused key; and encrypting the written data using the fused key.

[0266] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0267] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0268] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application.

Claims

1. A hard disk control method, characterized in that: The hard disk includes a control drive module and a plurality of storage units; wherein the hard disk drive of the control drive module can create a plurality of virtual units, each of which is respectively connected to the hard disk drive and associated with the storage unit; the hard disk control method includes: Presetting the storage space of the hard disk into a plurality of the storage units; In response to obtaining a management instruction, configuring a target storage unit based on the management instruction; wherein the management instruction is used to configure at least one of an access mode and an encryption medium of the storage unit; configuring the virtual unit associated with the target storage unit; In response to a virtual unit acquisition control request, taking the virtual unit that acquires the control request as a current virtual unit; Resolving a storage unit associated with the current virtual unit and using it as a target address; The target address is driven to execute the control request.

2. The hard disk control method according to claim 1, characterized in that: The parsing of the storage unit associated with the current virtual unit includes: Obtaining configuration information of the current virtual unit; Unit information associated with the current virtual unit within the configuration information is identified; wherein the unit information belongs to a storage unit associated with the current virtual unit.

3. The hard disk control method according to claim 2, characterized in that: The step of creating a plurality of virtual units includes: Respectively obtaining unit information of the storage units in the hard disk; wherein the unit information includes a unit identifier; A virtual unit is created for each storage unit, and the created virtual unit is configured using the unit information of the storage unit.

4. The hard disk control method according to claim 3, characterized in that: The unit information also includes an access mode, and the access mode includes a pass-through mode and a medium mode; the virtual unit created by configuring the unit information of the storage unit includes: Writing the unit identification of the storage unit into the configuration information of the virtual unit; The access mode of the storage unit is written into the configuration information of the virtual unit to identify the space status of the storage unit based on the access mode. When the virtual unit obtains the control request, it determines whether to authenticate the requester based on the access mode.

5. The hard disk control method according to claim 1, characterized in that: In response to the space state of the target address being an encrypted state, before driving the target address to execute the control request, the method includes: identifying a request category of the control request; In response to the request type of the control request being a hard disk access request, determining to authenticate the requester; in response to the request type of the control request being a hard disk write request, determining to allow the hard disk write request to be executed.

6. The hard disk control method according to claim 1 or 5, characterized in that: In response to the space state of the target address being an encrypted state, before driving the target address to execute the control request, the method includes: Obtaining the encrypted data of the target address in the encryption configuration table; Obtain authentication parameters from the requester; The verification parameter is parsed to determine whether it matches the encrypted data. In response to the verification parameter matching the encrypted data, it is determined that the requesting party has passed the identity authentication, and the control request is allowed to be executed.

7. The hard disk control method according to claim 6, characterized in that: The encrypted data includes an encrypted medium encrypted by a root key; and the analyzing whether the verification parameter matches the encrypted data includes: Obtaining a root key of the hard disk; Decrypting the encrypted data using the root key to obtain the encrypted medium; The encryption medium is compared with the verification parameter.

8. The hard disk control method according to claim 7, characterized in that: In response to the encryption medium including an encryption key, the encrypted data also including a random key encrypted by a root key; the executing the control request includes: In response to the control request being a hard disk access request, decrypting the encrypted data using the root key to obtain the random key; Merging the random key with the encryption key to obtain a fused key; The data stored at the target address is decrypted using the fusion key.

9. The hard disk control method according to claim 1, characterized in that: The configuring the target storage unit based on the management instruction comprises: Identifying and recording the encryption medium carried by the management instruction; wherein the encryption medium includes an access password and / or an encryption key; In response to the encrypted medium carried by the management instruction including an access password, determining that the access mode of the target storage unit is a first medium mode; In response to the encrypted medium carried by the management instruction including an access password and an encryption key, determining that the access mode of the target storage unit is a second medium mode; In response to the encryption medium carried by the management instruction including an encryption key, it is determined that the access mode of the target storage unit is a third medium mode.

10. The hard disk control method according to claim 9, characterized in that: In response to determining that the access mode of the target storage unit is the second medium mode or the third medium mode, the encrypted medium carrying the management instruction includes: Obtaining a root key, and encrypting the encrypted medium using the root key; Controlling the generation of a random key, and encrypting the random key using the root key; The encrypted encryption medium and the random key are recorded; wherein the random key is used to encrypt data after being merged with the encryption key.

11. The hard disk control method according to claim 10, characterized in that: The encrypted medium carrying the management instruction includes: Calling an encryption configuration table stored in the hard disk; wherein the table header of the encryption configuration table includes a unit label category of the storage unit, a storage address range category, an access mode category, an access password category, an encryption key category, and a random key category; Based on the type of the encryption medium and the target storage unit, the encryption medium is written into the body of the corresponding table header in the encryption configuration table.

12. The hard disk control method according to claim 1, characterized in that: The driving the target address to execute the control request comprises: In response to the control request being a hard disk write request, acquiring write data carried by the hard disk write request; The write data is written to the target address.

13. The hard disk control method according to claim 12, characterized in that: Writing the write data into the target address comprises: Querying the access mode of the target address; In response to the access mode of the target address being a media mode and the encrypted medium including an encryption key, acquiring the encryption key stored at the target address of the hard disk; The write data is encrypted using the acquired encryption key, and the encrypted write data is written into the target address.

14. The hard disk control method according to claim 13, characterized in that: The step of encrypting the write data by using the acquired encryption key comprises: Obtaining a random key stored at the target address of the hard disk; Merging the random key and the encryption key to obtain a fused key; The write data is encrypted using the merge key.

15. A hard disk, characterized in that: The hard disk comprises: Multiple storage units; A control drive module is connected to the storage unit; the control drive module includes a hard disk drive, and the hard disk drive can create a plurality of virtual units, each of which is respectively connected to the hard disk drive and associated with the storage unit; the control drive module is used to implement the hard disk control method as described in any one of claims 1-14.

16. A storage system, characterized in that: The storage system comprises: An interactive device, comprising an interactive module and an interactive channel, wherein the interactive module comprises a plurality of sub-interactive units, and each of the interactive units is respectively connected to one of the interactive channels; The hard disk as claimed in claim 15, wherein the virtual units of the hard disk are respectively connected to one of the interactive channels.

17. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the hard disk control method described in any one of claims 1-14 are implemented.

18. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the hard disk control method described in any one of claims 1-14 are implemented.

19. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the hard disk control method described in any one of claims 1-14 are implemented.

Images