Encrypted hard disk control method and device, equipment and program product

Abstract

The invention discloses a hard disk encryption control method and device, equipment and a program product, and the method comprises the steps: responding to the configuration of an encrypted hard disk to trigger a system interruption management mode under the condition that an operating system enters a running stage; in the system interrupt management mode, calling a password management program loaded in a power-on self-test stage so as to obtain a password of the encrypted hard disk by utilizing the password management program; and configuring the encrypted hard disk by using the password.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of electronic technology, and relate to but are not limited to a control method, device, equipment and program product for an encrypted hard disk. Background Art

[0002] According to the Peripheral Component Interconnect express (PCIe) specification, the maximum readiness time for a non-volatile memory express (NVMe) device is 127.5 seconds, which means that the field programmable gate array (FPGA) needs to wait 127.5 seconds to ensure that the drive is ready. 对 Without disk array (RedundantArra y s o f Inde p endent D i s k s ， The SED can be hot-swapped, but the user needs to wait 127.5 seconds to unlock the SED without any warning message or notification. Waiting for more than 2 minutes may prevent the user from performing any recovery operation, resulting in a poor user experience. Summary of the invention

[0003] In view of this, embodiments of the present application provide a control method, device, equipment and program product for an encrypted hard disk.

[0004] The technical solution of the embodiment of the present application is implemented as follows:

[0005] In a first aspect, an embodiment of the present application provides a method for controlling an encrypted hard disk, including:

[0006] When the operating system enters the running stage, triggering the system interrupt management mode in response to configuring the encrypted hard disk;

[0007] In the system interrupt management mode, the password management program loaded during the power-on self-test phase is called to obtain the password of the encrypted hard disk by using the password management program;

[0008] Configure encrypted hard disk with password.

[0009] In a second aspect, an embodiment of the present application provides a control device for an encrypted hard disk, comprising:

[0010] A trigger module, used for triggering a system interrupt management mode in response to configuring an encrypted hard disk when the operating system enters a running stage;

[0011] The acquisition module is used to call the password management program loaded in the power-on self-test phase in the system interrupt management mode to obtain the password of the encrypted hard disk by using the password management program;

[0012] A configuration module is used to configure an encrypted hard disk using a password.

[0013] In a third aspect, an embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and the above method is implemented when the processor executes the program.

[0014] In a fourth aspect, an embodiment of the present application provides a storage medium storing executable instructions for implementing the above method when executed by a processor.

[0015] In a fifth aspect, a computer program product includes a computer program or instructions, and when the computer program or instructions are executed by a processor, the steps in the above method are implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic diagram of an implementation flow of a control method for an encrypted hard disk provided in an embodiment of the present application;

[0017] Figure 2 A schematic diagram of an implementation flow of obtaining a password for an encrypted hard disk provided in an embodiment of the present application;

[0018] Figure 3 A schematic diagram of an implementation flow of obtaining a password for an encrypted hard disk provided in an embodiment of the present application;

[0019] Figure 4A A schematic diagram of component connection of a self-encrypting hard disk in direct connection mode is provided for an embodiment of the present application;

[0020] Figure 4B A schematic diagram of component connection of a self-encrypting hard disk in direct connection mode is provided for an embodiment of the present application;

[0021] Figure 4C A schematic diagram of the unlocking and configuration process of a self-encrypting hard disk provided in an embodiment of the present application;

[0022] Figure 5 A schematic diagram of the structure of a control device for an encrypted hard disk provided in an embodiment of the present application;

[0023] Figure 6 A hardware entity schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the specific technical solution of the embodiments of the present application will be further described in detail below in conjunction with the drawings in the embodiments of the present application. The following embodiments are used to illustrate the present application, but are not used to limit the scope of the present application.

[0025] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0026] In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0027] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0028] The present application embodiment provides a control method for an encrypted hard disk, such as Figure 1 As shown, the method includes:

[0029] Step S110: When the operating system enters the running stage, triggering the system interrupt management mode in response to configuring the encrypted hard disk;

[0030] Here, the Run Time is the operation phase after the operating system is successfully started. In this phase, the execution of the main tasks has been transferred to the operating system. In the Run Time, the operating system is the core of the electronic device, used to coordinate the operation of various hardware devices and software applications to ensure that the entire system can work stably and efficiently.

[0031] System Management Interrupt (SMI) is a system interrupt that has priority over all other interrupts and exceptions. SMI can be used to put the CPU into System Management Mode (SMM).

[0032] A Self-Encrypting Drive (SED) is a hard drive with encryption hardware built into the hard drive controller. SED can automatically encrypt all data when writing data to the hard drive, and automatically decrypt all data when reading data from the hard drive.

[0033] During implementation, when the operating system enters the running stage, the system interrupt management mode may be triggered in response to an event of configuring an encrypted hard disk.

[0034] Step S120: in the system interrupt management mode, calling the password management program loaded in the power-on self-test phase to obtain the password of the encrypted hard disk by using the password management program;

[0035] Here, the POST phase occurs when the electronic device is just started, and this phase is performed by the Basic Input Output System (BIOS) on the motherboard. The POST phase ensures that all key hardware devices of the electronic device are in normal state before the operating system is started, thereby avoiding unpredictable errors or crashes during the operation of the operating system.

[0036] The password manager, namely the software key manager (SWKeyManagement handler), is a program loaded during the power-on self-test phase and used to obtain the password of the encrypted hard disk.

[0037] Calling a program can refer to the act of executing or activating another program within a program, or the process of executing or starting another program or function.

[0038] During implementation, the password management program can be used to obtain the password of the encrypted hard disk by running or activating the password management program in the system interrupt management mode.

[0039] Step S130: Use the password to configure the encrypted hard disk.

[0040] Here, the password can be the password corresponding to the encrypted hard disk, that is, encrypted hard disks with different identifications correspond to different passwords; it can also be the system password of the electronic device, that is, the password of the encrypted hard disk set on the same electronic device can use the system password.

[0041] During implementation, the password may be used to configure the encrypted hard disk, so that the encrypted hard disk can be normally used on the electronic device.

[0042] In the embodiment of the present application, first, when the operating system enters the running stage, the system interrupt management mode is triggered in response to the configuration of the encrypted hard disk; then, in the system interrupt management mode, the password management program loaded in the power-on self-test stage is called to obtain the password of the encrypted hard disk using the password management program; finally, the encrypted hard disk is configured using the password. In this way, the operating system triggers the system management interrupt by software, so that the system management interrupt handler can unlock the self-encrypting hard disk while initializing the self-encrypting hard disk. The self-encrypting hard disk can be unlocked immediately after the drive initialization is completed at runtime. The waiting time for configuring the self-encrypting hard disk is saved, which greatly improves the user experience. And because the configuration of the self-encrypting hard disk is performed in a safe system management mode, there is no security issue.

[0043] In some embodiments, the above step S120 "in the system interrupt management mode, calling the password management program loaded in the power-on self-test phase to use the password management program to obtain the password of the encrypted hard disk" is as follows Figure 2 As shown, this can be achieved by following the steps below:

[0044] Step S210: During the power-on self-test phase, obtaining the password of the encrypted hard disk from the password management unit;

[0045] Here, the password management unit may be a baseboard management controller (BMC) provided on the electronic device, which may be a controller that provides intelligent management for the motherboard based on the intelligent platform management interface (IPMI) technical design specification. It may also be other management units provided on the electronic device that can store and manage passwords. It may also be a password management server provided on the network.

[0046] During the implementation process, the password of the encrypted hard disk can be obtained from the BMC during the power-on self-test phase; the password of the encrypted hard disk can also be obtained from a password server set up on the network. The corresponding password can be obtained using the identifier of the encrypted hard disk.

[0047] Step S220, adding the password of the encrypted hard disk to the first password management program;

[0048] Here, the first password manager stores the password of the encrypted hard disk. During the power-on self-test phase, the first password manager can be loaded into the basic input and output system. The basic input and output system can be BIOS, which is the first software in the electronic device startup process, responsible for hardware detection, configuration and startup sequence, etc.; it can also be Unified Extensible Firmware Interface (UEFI), which is an electronic device system specification used to define the software interface between the operating system and the system firmware. As an alternative to BIOS, it can provide a faster, more efficient and safer startup method.

[0049] Step S230, loading the first password management program into the basic input and output system;

[0050] Here, the first password management program may be preloaded into the basic input and output system during the power-on self-test phase, so that the first password management program can be called in the system interrupt management mode.

[0051] Step S240: In the system interrupt management mode, calling the first password management program to obtain the password of the encrypted hard disk by using the first password management program.

[0052] During implementation, the first password management program loaded into the basic input and output system can be called in the system interrupt management mode to obtain the password of the encrypted hard disk by using the first password management program.

[0053] In the embodiment of the present application, firstly, in the power-on self-test stage, the password of the encrypted hard disk is obtained from the password management unit; then the password of the encrypted hard disk is added to the first password management program; the first password management program is loaded into the basic input and output system; finally, in the system interrupt management mode, the first password management program is called to obtain the password of the encrypted hard disk by using the first password management program. In this way, the password of the encrypted hard disk can be obtained by using the first password management program loaded in the power-on self-test stage in the system interrupt mode.

[0054] In some embodiments, the above step S210 "obtaining the password of the encrypted hard disk from the password management unit during the power-on self-test phase" can be implemented by the following steps:

[0055] Step 211: During the power-on self-test phase, a password request message is sent to the password management unit through the intelligent platform management interface;

[0056] Here, the password management unit may be a BMC, which may be a controller that provides intelligent management for the motherboard based on the Intelligent Platform Management Interface (IPMI) technical design specification.

[0057] During the implementation process, a password request message may be sent to the BMC via IPMI during the power-on self-test phase.

[0058] Step 212: The password management unit sends the password of the encrypted hard disk to the first password management program in response to the password request message.

[0059] Here, the password request message may include the identifier of the encrypted hard disk.

[0060] During implementation, when the BMC receives the password request message, it may obtain the corresponding password based on the identifier of the encrypted hard disk and send the password to the first password management program.

[0061] In the embodiment of the present application, firstly, during the power-on self-test phase, a password request message is sent to the password management unit through the intelligent platform management interface; then, in response to the password request message, the password management unit sends the password of the encrypted hard disk to the first password management program. In this way, during the power-on self-test phase, the password obtained from the password management unit can be sent to the first password management program.

[0062] In some embodiments, the above step S120 "in the system interrupt management mode, calling the password management program loaded in the power-on self-test phase to use the password management program to obtain the password of the encrypted hard disk" is as follows Figure 3 As shown, this can be achieved by following the steps below:

[0063] Step S310: During the power-on self-test phase, a second password management program is loaded into the basic input and output system;

[0064] Here, different from the first password management program, the second password management program can obtain the password of the encrypted hard disk from the password management server through network interaction information in the system interrupt management mode.

[0065] During implementation, the second password management program may be preloaded into the basic input and output system during the power-on self-test phase.

[0066] Step S320: In the system interrupt management mode, calling the second password management program;

[0067] During implementation, in the system interrupt management mode, the second password management program may be run, or the second password management program may be started in the basic input and output system.

[0068] Step S330: Utilize the second password management program to obtain the password of the encrypted hard disk from the password management server through network interaction information.

[0069] Here, the second password management program can obtain the password of the encrypted hard disk from the password management server on the network side (cloud) through network interaction information.

[0070] In the embodiment of the present application, firstly, in the power-on self-test phase, the second password management program is loaded into the basic input and output system; then in the system interrupt management mode, the second password management program is called; finally, the second password management program is used to obtain the password of the encrypted hard disk from the password management server through network interaction information. In this way, it is possible to obtain the password of the encrypted hard disk from the password management server on the network end (cloud) in the system interrupt management mode, and obtain the password when the password is needed, thereby improving the security of password management.

[0071] In some embodiments, the above step S330 "obtaining the password of the encrypted hard disk from the password management server through network interaction information using the second password management program" can be implemented by the following steps:

[0072] Step 331: using the second password management program to obtain the identifier of the encrypted hard disk;

[0073] Here, the identifier of the encrypted hard disk may be a serial number that uniquely identifies the encrypted hard disk.

[0074] During implementation, the second password management program may read the identifier of the encrypted hard disk.

[0075] Step 332: using the second password management program to send the identifier of the encrypted hard disk to the password management server;

[0076] Here, a network sending function can be set in the second password management program to send the identifier of the encrypted hard disk to the password management server through network interaction information.

[0077] During implementation, the network sending function can be used to send the identifier of the encrypted hard disk to the password management server.

[0078] Step 333: Use the second password management program to obtain the password of the encrypted hard disk sent by the password management server, wherein the password of the encrypted hard disk is determined based on the identifier of the encrypted hard disk.

[0079] Here, the mapping relationship between the identifier of the encrypted hard disk and the corresponding password may be stored in the password management server.

[0080] During implementation, the password management server may determine the password corresponding to the encrypted hard disk based on the received identifier of the encrypted hard disk and the mapping relationship, and send the password to the corresponding electronic device when the second password management program requests to obtain the password.

[0081] In the embodiment of the present application, the second password management program is first used to obtain the identifier of the encrypted hard disk; then the second password management program is used to send the identifier of the encrypted hard disk to the password management server; finally, the second password management program is used to obtain the password of the encrypted hard disk sent by the password management server. In this way, the corresponding password can be obtained from the password management server based on the identifier of the encrypted hard disk.

[0082] In some embodiments, the above step S120 "in the system interrupt management mode, calling the password management program loaded in the power-on self-test phase to obtain the password of the encrypted hard disk by using the password management program" can be implemented by the following steps:

[0083] Step 121, during the power-on self-test phase, loading an encrypted hard disk management protocol into the encrypted hard disk controller;

[0084] Here, the SED Management Protocol is used to unlock the encrypted hard disk.

[0085] During the power-on self-test phase, the SED management protocol is pre-configured in the SED controller driver.

[0086] Step 122: In the system interrupt management mode, the password management program loaded in the power-on self-test phase and the encrypted hard disk management protocol are run, so that the encrypted hard disk management protocol obtains the password of the encrypted hard disk through the password management program;

[0087] In the system interrupt management mode, the password management program (SWKeyManagement) and the encrypted hard disk management protocol are run. The SWKeyManagement handler will pass the system password (or the password corresponding to the encrypted hard disk) through the SEDManagement protocol and request the SEDManagement protocol to uninstall / configure the encrypted hard disk (SED drive).

[0088] Correspondingly, the above step S130 "using the password to configure the encrypted hard disk" can be implemented by the following process:

[0089] The encrypted hard disk management protocol configures the encrypted hard disk using the password.

[0090] During implementation, the SEDManagement protocol will use the system password (or the password corresponding to the encrypted hard disk) to unlock / configure the encrypted hard disk (SED drive).

[0091] In the embodiment of the present application, firstly, in the power-on self-test stage, the encrypted hard disk management protocol is loaded in the controller of the encrypted hard disk; then, in the system interrupt management mode, the password management program and the encrypted hard disk management protocol loaded in the power-on self-test stage are called, so that the encrypted hard disk management protocol obtains the password of the encrypted hard disk through the password management program; finally, the encrypted hard disk management protocol configures the encrypted hard disk using the password. In this way, it is possible to complete the configuration of the encrypted hard disk based on the obtained password using the encrypted hard disk management protocol loaded in the power-on self-test stage in the system interrupt management mode.

[0092] In some embodiments, the above step S110 "when the operating system enters the running stage, in response to configuring the encrypted hard disk to trigger the system interrupt management mode" can be implemented by the following steps:

[0093] Step 111, when the operating system enters the running stage, initializing the encrypted hard disk;

[0094] When an encrypted hard disk is inserted into the system, the device driver of the operating system performs a series of operations to initialize and detect the device to confirm whether it is an encrypted hard disk.

[0095] Step 112: The operating system triggers the system interrupt management mode via software.

[0096] Here, the way software triggers SMI is by writing a specific value to a specific I / O port. Software triggers SMI interrupt by writing a specific value to a specific I / O port (such as 0xB2 or 0xB0, depending on the CPU architecture and platform). This allows system software (such as BIOS, operating system, or driver) to trigger SMI when needed to perform some important system management tasks, such as hardware error handling, system updates, or configuration changes.

[0097] During the implementation process, using software to trigger the system interrupt management mode can effectively avoid the problem of long hard disk trigger waiting time.

[0098] In the embodiment of the present application, when the operating system enters the running stage, the encrypted hard disk is initialized; the operating system triggers the system interrupt management mode by software. In this way, the problem of long hard disk trigger waiting time can be effectively avoided by using software to trigger the system interrupt management mode.

[0099] Figure 4A A schematic diagram of component connection of a self-encrypting hard disk in direct connection mode is provided for an embodiment of the present application. Figure 4A As shown, the schematic diagram includes the following components: a self-encrypting hard disk 41, a backplane 42, a field programmable logic gate array 43, a central processing unit 44, a south bridge chip 45, an operating system 46 and a unified extensible firmware interface 47, wherein:

[0100] During implementation, you can perform the following steps to implement hot swapping of SEDs:

[0101] Step 1: When the self-encrypting hard disk 41 is inserted into the backplane 42, hot plugging based on the transmission protocol NVMe is started.

[0102] Here, from a hardware perspective, when a hard drive is inserted into the system, the hardware can support the recognition of this insertion action. Therefore, a present pin is defined, which is used by the hardware to determine whether the card is inserted. When the card is inserted, this pin is pulled low. NVMe is a high-performance storage access and transmission protocol designed for solid-state drives (SSDs) based on Peripheral Component Interconnect Express (PCI-Express, PCIe). The PRSNT signal is usually related to the hot-swap function of PCIe devices. In the PCIe specification, the PRSNT signal can be used to determine whether the device has been correctly inserted into the slot.

[0103] PRSNT1# of the card slot on the backplane 42 is grounded, and PRSNT2# is connected to the hot-swap controller and pulled up. The PRSNT#1 signal of the PCIe board is connected to the PRSNT2# pin farthest from it (there may be multiple PRSNT2#s). Here, the PRSNT pin is 1mm shorter than the other pins, which ensures a 1ms time difference between insertion and removal, thereby ensuring that the power-on and power-off timings meet the specifications. When the NVMe hard drive 41 is inserted, after the other pins are in contact, PRSNT#1 is pulled low first, and PRSNT#2 is pulled low last. Then the hot-swap controller on the backplane 42 considers that the self-encrypting hard drive 41 has been fully inserted and starts to enable related signals.

[0104] Step 2: The FPGA 43 writes the virtual pin port (VPP) of the CPU 44 via the serial communication bus.

[0105] Here, the serial communication bus I2C is used to connect the low-speed peripheral device (self-encrypting hard disk 41) to the central processing unit (CPU) 44. VPP can be used to manage the self-encrypting hard disk 41 on the hot-swap backplane 42.

[0106] During implementation, the FPGA 43 can write the signal inserted by the SED 41 into the VPP via I2C to trigger the CPU to generate a message signaled interrupt (MSI).

[0107] Step 3: The CPU generates a message signaled interrupt (MSI).

[0108] Here, MSI is an interrupt mechanism used by PCI devices to trigger a CPU interrupt by writing a message to a specific address.

[0109] In the implementation process, since the field programmable logic gate array 43 writes VPP through I2C, the CPU can generate an MSI interrupt.

[0110] Step 4: The operating system 46 receives the MSI and the hot-swap driver to initialize the self-encrypting hard disk 41.

[0111] During implementation, when the operating system 46 receives the MSI, the hot-swap driver installed in the operating system 46 performs an initialization operation on the self-encrypting hard disk 41 .

[0112] Step 5: The FPGA 43 calls the GPIO after 127.5 seconds to ensure that the SED 41 is ready for configuration.

[0113] During the implementation, the FPGA 43 calls the general purpose input output (GPIO) of the south bridge chip (PCH) 45, and the south bridge chip 45 is connected to the central processing unit 44 via a direct media interface (DMI).

[0114] Here, according to the PCIe specification, the maximum value of the NVMe device ready time is 127.5 seconds, which means that the FPGA needs to wait for 127.5 seconds to ensure that the NVMe hard disk 41 is ready.

[0115] Step 6: The CPU triggers an SMI.

[0116] Here, the process of the CPU triggering a system management interrupt (System Management Interrupt, SMI) is a key system-level operation, which can be used to provide extended functions, such as hot-plugging hardware devices, implementing system management tasks, etc. SMI is a non-maskable external interrupt, and its priority is higher than all debug interrupts, non-maskable interrupts (NMI), maskable interrupts and soft interrupts. When SMI is triggered, the CPU will suspend the currently executing task and enter the system management mode (System Management Mode, SMM) to perform specific management tasks, such as the task of configuring the newly inserted self-encrypting hard disk 41.

[0117] Step 7: The system management interrupt handler (SMI Handler) unlocks the drive.

[0118] Here, the System Management Interrupt Handler (SMI Handler) is a part of the system firmware (such as BIOS or UEFI) that is specifically used to handle tasks triggered by SMI. When SMI occurs, the processor saves the current state and switches to SMM to execute the SMI Handler code. The SMI Handler is responsible for performing various system management tasks, such as power management, system hardware control, and executing specific OEM design code.

[0119] In the embodiment of the present application, since there is no interaction between the operating system and the unified extensible firmware interface, it takes 127.5 seconds to wait for the self-encrypting hard disk to be ready and start the configuration when configuring the inserted NVMe hard disk using the system management interrupt handler. The waiting time for configuration exceeds 2 minutes, which will cause many unnecessary operation problems and poor user experience. Shortening the waiting time for configuring the self-encrypting hard disk has become a technical problem that needs to be solved urgently.

[0120] Figure 4B A schematic diagram of component connection of a self-encrypting application in a direct connection mode is provided for an embodiment of the present application, such as Figure 4B As shown, the schematic diagram includes the following components: a self-encrypting hard disk 41, a backplane 42, a field programmable logic gate array 43, a central processing unit 44, an operating system 46 and a unified extensible firmware interface 47, wherein:

[0121] During implementation, you can perform the following steps to implement hot swapping of SEDs:

[0122] Step 1: When the self-encrypting hard disk 41 is inserted into the backplane 42, hot plugging based on the transmission protocol NVMe is started.

[0123] Step 2: The FPGA 43 writes the virtual pin port (VPP) of the CPU 44 via the serial communication bus.

[0124] Step 3: The CPU generates a message signaled interrupt (MSI).

[0125] Step 4: The operating system 46 receives the MSI and the hot-swap driver to initialize the self-encrypting hard disk 41.

[0126] Step 5: The operating system 46 starts a hot-plug driver to trigger a system management interrupt SMI in a software manner.

[0127] Step 6. The system management interrupt handler unlocks the drive.

[0128] In the embodiment of the present application, the operating system triggers a system management interrupt by software, so that the system management interrupt handler can unlock the self-encrypting hard disk while initializing the self-encrypting hard disk. That is, there is no need to wait for 127.5 seconds. The self-encrypting hard disk can be unlocked immediately after the drive initialization is completed at runtime. This saves the waiting time for configuring the self-encrypting hard disk and greatly improves the user experience. And because the configuration of the self-encrypting hard disk is performed in a secure system management mode, there is no security issue.

[0129] Figure 4C A schematic diagram of the unlocking and configuration process of a self-encrypting hard disk provided in an embodiment of the present application is shown in FIG. Figure 4C As shown,

[0130] Perform the following steps during the POST phase:

[0131] Step 1. The system is powered on.

[0132] Step 2: The SW key management driver requests the system key through the KMS protocol.

[0133] Here, both the software key management program and the key management service protocol program exist in UEFI.

[0134] Step 3: The key management service protocol program queries the baseboard manager for the system password through an intelligent platform management interface (IPMI) command.

[0135] Here, the system password is saved in the baseboard manager.

[0136] Step 4: The baseboard manager obtains the request and passes the system password to the Key Management Service Protocol (KMSprotocol) program.

[0137] Step 5: The key management service protocol program passes the system password to the software key management program (SW Keymanagement driver).

[0138] Step 6: When the system management interrupt is triggered by software, the software key management program registers the system password obtained during the power-on self-test phase to the key management program.

[0139] Step 7: In the system management interrupt, the controller driver of the automatic encryption drive installs the encryption drive management protocol (SED Management Protocol).

[0140] During the run phase, perform the following steps:

[0141] Step 8: When the self-encrypting hard disk is inserted into the system, the device driver of the operating system performs a series of operations to initialize and detect the device to confirm whether it is a self-encrypting hard disk.

[0142] Step 9: If the device is a self-encrypting hard disk, the device driver of the operating system triggers a software system management interrupt to cause the system to enter a system management mode.

[0143] Step 10: The SW Key Management handler will pass the system key through the automatic encryption drive management protocol and request the automatic encryption drive management protocol to uninstall / configure the SED drive.

[0144] Step 11. The Auto-Encrypted Drive Management Protocol will unlock / configure the Auto-Encrypted Drive using the system password.

[0145] In the embodiment of the present application, the operating system triggers a system management interrupt by software, so that the system management interrupt handler can unlock the self-encrypting hard disk while initializing the self-encrypting hard disk. The self-encrypting hard disk can be unlocked immediately after the drive initialization is completed at runtime. This saves the waiting time for configuring the self-encrypting hard disk and greatly improves the user experience. And because the configuration of the self-encrypting hard disk is performed in a secure system management mode, there is no security issue.

[0146] Based on the foregoing embodiments, the embodiments of the present application provide a control device for an encrypted hard disk, which includes the modules included, each module includes sub-modules, and can be implemented by a processor in an electronic device; of course, it can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA), etc.

[0147] Figure 5 A schematic diagram of the structure of the control device for the encrypted hard disk provided in the embodiment of the present application is shown in FIG. Figure 5 As shown, the device 500 includes:

[0148] A trigger module 510 triggers a system interrupt management mode in response to configuring the encrypted hard disk when the operating system enters the running stage;

[0149] The acquisition module 520 is used to call the password management program loaded in the power-on self-test phase in the system interrupt management mode to obtain the password of the encrypted hard disk by using the password management program;

[0150] The configuration module 530 is used to configure the encrypted hard disk using the password.

[0151] In some embodiments, the acquisition module 520 includes a first acquisition submodule, an adding submodule, a first loading submodule and a first running submodule, wherein the first acquisition submodule is used to obtain the password of the encrypted hard disk from the password management unit during the power-on self-test phase; the adding submodule is used to add the password of the encrypted hard disk to the first password management program; the first loading submodule is used to load the first password management program into the basic input and output system; the running submodule is used to call the first password management program in the system interrupt management mode to use the first password management program to obtain the password of the encrypted hard disk.

[0152] In some embodiments, the acquisition submodule is also used to send a password request message to the password management unit through the intelligent platform management interface during the power-on self-test phase; the password management unit sends the password of the encrypted hard disk to the first password management program in response to the password request message.

[0153] In some embodiments, the acquisition module 520 includes a second loading submodule, a second running submodule and a second acquisition submodule, wherein the second loading submodule is used to load a second password management program to a basic input and output system during the power-on self-test phase; the second running submodule is used to call the second password management program in the system interrupt management mode; and the second acquisition submodule is used to use the second password management program to obtain the password of the encrypted hard disk from a password management server through network interaction information.

[0154] In some embodiments, the acquisition submodule is further used to use the second password management program to obtain the identifier of the encrypted hard disk; use the second password management program to send the identifier of the encrypted hard disk to the password management server; use the second password management program to obtain the password of the encrypted hard disk sent by the password management server, wherein the password of the encrypted hard disk is determined based on the identifier of the encrypted hard disk.

[0155] In some embodiments, the acquisition module 520 includes a third loading submodule and a third running submodule, wherein the third loading submodule is used to load the encrypted hard disk management protocol in the controller of the encrypted hard disk during the power-on self-test phase; the third running submodule is used to run the password management program and the encrypted hard disk management protocol loaded during the power-on self-test phase in the system interrupt management mode, so that the encrypted hard disk management protocol obtains the password of the encrypted hard disk through the password management program. Correspondingly, the configuration module 530 is used for the encrypted hard disk management protocol to configure the encrypted hard disk using the password.

[0156] In some embodiments, the trigger module includes an initialization submodule and a trigger submodule, wherein the initialization submodule is used to initialize the encrypted hard disk when the operating system enters the running stage; the trigger submodule is used for the operating system to trigger the system interrupt management mode through software.

[0157] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0158] It should be noted that in the embodiment of the present application, if the above method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable an electronic device (which can be a mobile phone, a tablet computer, a laptop computer, a desktop computer, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a disk or an optical disk. In this way, the embodiment of the present application is not limited to any specific combination of hardware and software.

[0159] Correspondingly, an embodiment of the present application provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps in the control method of the encrypted hard disk provided in the above embodiment are implemented.

[0160] Correspondingly, an embodiment of the present application provides an electronic device, Figure 6 A hardware entity diagram of an electronic device provided in an embodiment of the present application, such as Figure 6 As shown, the hardware entity of the device 600 includes: a memory 601 and a processor 602, wherein the memory 601 stores a computer program that can be run on the processor 602, and when the processor 602 executes the program, the steps in the control method of the encrypted hard disk provided in the above embodiment are implemented.

[0161] The memory 601 is configured to store instructions and applications executable by the processor 602, and can also cache data to be processed or processed by the processor 602 and various modules in the electronic device 600 (for example, image data, audio data, voice communication data, and video communication data), which can be implemented through flash memory (FLASH) or random access memory (Random Access Memory, RAM).

[0162] It should be noted here that the description of the above storage medium and device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0163] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The above-mentioned sequence numbers of the embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments.

[0164] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0165] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0166] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0167] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0168] A person skilled in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), magnetic disks or optical disks, etc., various media that can store program codes.

[0169] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can be essentially or partly reflected in the form of a software product that contributes to the relevant technology. The computer software product is stored in a storage medium, including several instructions to enable an electronic device (which can be a mobile phone, a tablet computer, a laptop computer, a desktop computer, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0170] The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0171] The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0172] The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0173] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for controlling an encrypted hard disk, the method comprising: When the operating system enters the running stage, triggering the system interrupt management mode in response to configuring the encrypted hard disk; In the system interrupt management mode, calling the password management program loaded in the power-on self-test phase to obtain the password of the encrypted hard disk by using the password management program; The encrypted hard disk is configured using the password.

2. The method according to claim 1, wherein in the system interrupt management mode, calling a password management program loaded in the power-on self-test phase to obtain the password of the encrypted hard disk by using the password management program comprises: During the power-on self-test phase, obtaining the password of the encrypted hard disk from the password management unit; Adding the password of the encrypted hard disk to the first password management program; loading the first password management program into a basic input and output system; In the system interrupt management mode, the first password management program is called to obtain the password of the encrypted hard disk by using the first password management program.

3. The method according to claim 2, wherein in the power-on self-test phase, obtaining the system password from the password management unit comprises: During the power-on self-test phase, a password request message is sent to the password management unit through the intelligent platform management interface; The password management unit sends the password of the encrypted hard disk to the first password management program in response to the password request message.

4. The method according to claim 1, wherein in the system interrupt management mode, calling the password management program loaded in the power-on self-test phase to obtain the password of the encrypted hard disk by using the password management program comprises: During the power-on self-test phase, loading a second password management program into a basic input and output system; In the system interrupt management mode, calling the second password management program; The second password management program is used to obtain the password of the encrypted hard disk from the password management server through network interaction information.

5. The method according to claim 4, wherein the step of obtaining the password of the encrypted hard disk from the password management server through network interaction information using the second password management program comprises: Using the second password management program to obtain the identifier of the encrypted hard disk; Using the second password management program to send the identifier of the encrypted hard disk to the password management server; The second password management program is used to obtain the password of the encrypted hard disk sent by the password management server, wherein the password of the encrypted hard disk is determined based on the identifier of the encrypted hard disk.

6. The method according to any one of claims 1 to 5, wherein in the system interrupt management mode, calling a password management program loaded in the power-on self-test phase to obtain the password of the encrypted hard disk by using the password management program comprises: During the power-on self-test phase, an encrypted hard disk management protocol is loaded into the encrypted hard disk controller; In the system interrupt management mode, calling the password management program and the encrypted hard disk management protocol loaded in the power-on self-test phase, so that the encrypted hard disk management protocol obtains the password of the encrypted hard disk through the password management program; Correspondingly, configuring the encrypted hard disk using the password includes: The encrypted hard disk management protocol configures the encrypted hard disk using the password.

7. The method according to any one of claims 1 to 5, wherein when the operating system enters the running stage, in response to configuring the encrypted hard disk to trigger the system interrupt management mode, comprises: When the operating system enters the running stage, initializing the encrypted hard disk; The operating system triggers the system interrupt management mode by software.

8. A control device for encrypting a hard disk, the device comprising: A trigger module, configured to trigger a system interrupt management mode in response to configuring the encrypted hard disk when the operating system enters a running stage; An acquisition module, used to call the password management program loaded in the power-on self-test phase in the system interrupt management mode, so as to obtain the password of the encrypted hard disk by using the password management program; A configuration module is used to configure the encrypted hard disk using the password.

9. An electronic device, comprising a memory, a processor and an encrypted hard disk, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the program, when the operating system enters the running stage, in response to the configuration of the encrypted hard disk, a system interrupt management mode is triggered; in the system interrupt management mode, a password management program loaded during the power-on self-test stage is called to obtain the password of the encrypted hard disk using the password management program; and the encrypted hard disk is configured using the password.

10. A computer program product, comprising a computer program or instructions, which, when executed by a processor, triggers a system interrupt management mode in response to configuring the encrypted hard disk when an operating system enters a running phase; in the system interrupt management mode, calls a password management program loaded during a power-on self-test phase to obtain a password for the encrypted hard disk using the password management program; and configures the encrypted hard disk using the password.

Images