Host data access control method and device, equipment, chip and medium

Abstract

The invention provides a host data access control method and device, equipment, a chip and a medium, and the method comprises the steps: receiving a first access request which is used for requesting to access host data; a register index is obtained, the register index is used for indexing a key register, and the key register is used for storing key data of a host; based on the first access request and the register index, a second access request is generated, and the second access request is used for requesting to use the key data to encrypt and decrypt the host data; and sending the second access request to the controller. The technical problem of poor host data access performance in the prior art is solved.

Description

Technical Field

[0001] The present disclosure relates to the field of virtualization technology, and in particular to a host data access control method, device, equipment, chip and medium. Background Art

[0002] Virtualization is a resource management technology that refers to the abstraction, conversion, presentation, and segmentation and combination of various hardware resources of a computer (such as the central processing unit (CPU), memory, storage, and network) into one or more configurable environments. This breaks down the inseparable barriers between physical structures, allowing users to apply these hardware resources in a more flexible way. In some application scenarios, multiple hosts share a single or multiple Universal Flash Storage (UFS) hardware. Therefore, the input and output (IO) of each host data (such as virtual machine images, hardware resources, etc.) needs to be isolated.

[0003] In the related art, the performance of host data access is poor. Summary of the invention

[0004] The present disclosure aims to solve one of the technical problems in the related art at least to some extent.

[0005] To this end, the present disclosure proposes a host data access control method, device, electronic device, computer-readable storage medium, computer program product, chip and processor to improve the performance of host data access.

[0006] To achieve the above-mentioned purpose, the first aspect of the present disclosure proposes a host data access control method, which is executed by the host; it includes: receiving a first access request, wherein the first access request is used to request access to host data; obtaining a register index, wherein the register index is used to index a key register, and the key register is used to store the host's key data; based on the first access request and the register index, generating a second access request, wherein the second access request is used to request the use of the key data to encrypt and decrypt the host data; and sending the second access request to the controller.

[0007] To achieve the above-mentioned purpose, the second aspect of the present disclosure proposes a host data access control method, which is executed by a controller; it includes: receiving a second access request sent by the host, wherein the second access request is generated based on a first access request and a register index, the first access request is used to request access to the host data, the register index is used to index a key register, and the key register is used to store the host's key data; when it is determined based on the register index that the host meets the authentication conditions, obtaining the key data from the key register; and using the key data to encrypt and decrypt the host data.

[0008] To achieve the above-mentioned purpose, the third aspect embodiment of the present disclosure proposes a host data access control method, which is executed by a trusted application; it includes: allocating a register index, wherein the register index is used to index a key register, the key register is used to store the host's key data, and the key data is used to encrypt and decrypt the host data.

[0009] To achieve the above-mentioned purpose, the fourth aspect embodiment of the present disclosure proposes a host data access control device, including: a first receiving module, used to receive a first access request, wherein the first access request is used to request access to host data; a first acquisition module, used to obtain a register index, wherein the register index is used to index a key register, and the key register is used to store the host's key data; a generation module, used to generate a second access request based on the first access request and the register index, wherein the second access request is used to request the use of the key data to encrypt and decrypt the host data; a sending module, used to send the second access request to the controller.

[0010] To achieve the above-mentioned purpose, the fifth aspect embodiment of the present disclosure proposes a host data access control device, including: a second receiving module, used to receive a second access request sent by the host, wherein the second access request is generated based on the first access request and the register index, the first access request is used to request access to the host data, the register index is used to index the key register, and the key register is used to store the host's key data; a second acquisition module, used to obtain the key data from the key register when it is determined based on the register index that the host meets the authentication conditions; a processing module, used to use the key data to encrypt and decrypt the host data.

[0011] To achieve the above-mentioned purpose, the sixth aspect embodiment of the present disclosure proposes a host data access control device, including: an allocation module for allocating register indexes, wherein the register index is used to index a key register, the key register is used to store the host's key data, and the key data is used to encrypt and decrypt the host data.

[0012] To achieve the above-mentioned purpose, the seventh aspect embodiment of the present disclosure proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the host data access control method proposed in the above-mentioned aspect embodiment of the present disclosure.

[0013] To achieve the above-mentioned purpose, the eighth embodiment of the present disclosure proposes a computer-readable storage medium, in which computer execution instructions are stored. When the computer execution instructions are executed by the processor, they are used to implement the host data access control method proposed in the above-mentioned embodiment of the present disclosure.

[0014] To achieve the above objectives, a ninth aspect of the present disclosure proposes a computer program product, including a computer program, which, when executed by a processor, implements the host data access control method proposed in the above-mentioned embodiment of the present disclosure.

[0015] To achieve the above objectives, a tenth aspect of the present disclosure proposes a chip, which includes a processing circuit, and the processing circuit is configured to execute the host data access control method proposed in the above-mentioned embodiment of the present disclosure.

[0016] To achieve the above objectives, an eleventh embodiment of the present disclosure proposes a processor, which is used to call a computer to execute instructions to execute the host data access control method proposed in the above-mentioned embodiments of the present disclosure.

[0017] The present disclosure provides a host data access control method, device, electronic device, computer-readable storage medium, computer program product, chip and processor. The host receives a first access request, wherein the first access request is used to request access to host data and obtain a register index, wherein the register index is used to index a key register, and the key register is used to store the key data of the host. Based on the first access request and the register index, a second access request is generated, wherein the second access request is used to request encryption and decryption of the host data using the key data, and the second access request is sent to the controller. While supporting effective isolation of host data IO access, the host is supported to directly access the storage hardware in the controller. In this way, the performance of host data access is improved.

[0018] Additional aspects and advantages of the present disclosure will be given in part in the following description and in part will be obvious from the following description or learned through practice of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above and / or additional aspects and advantages of the present disclosure will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0020] Figure 1 A flowchart of a host data access control method provided by an embodiment of the present disclosure;

[0021] Figure 2 is a schematic diagram of the architecture of an electronic device in an embodiment of the present disclosure;

[0022] Figure 3 A flowchart of another host data access control method provided by an embodiment of the present disclosure;

[0023] Figure 4 A flowchart of another host data access control method provided by an embodiment of the present disclosure;

[0024] Figure 5 A flowchart of another host data access control method provided by an embodiment of the present disclosure;

[0025] Figure 6 A flowchart of another host data access control method provided by an embodiment of the present disclosure;

[0026] Figure 7 is a schematic diagram of the application architecture of an embodiment of the present disclosure;

[0027] Figure 8 A schematic diagram of the structure of a host data access control device provided by an embodiment of the present disclosure;

[0028] Fig. 9 A schematic diagram of the structure of another host data access control device provided by an embodiment of the present disclosure;

[0029] Fig.10 A schematic diagram of the structure of another host data access control device provided by an embodiment of the present disclosure;

[0030] Fig.11 A block diagram of an exemplary electronic device suitable for implementing the embodiments of the present disclosure is shown;

[0031] Fig.12 It is a schematic diagram of the structure of the chip proposed in the embodiment of the present disclosure. DETAILED DESCRIPTION

[0032] Some embodiments of the present disclosure will be described in detail here, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. Various changes, modifications and equivalents of the methods, devices and / or systems described herein will become apparent after understanding the present disclosure. For example, the order of operations described herein is merely an example and is not limited to those orders set forth herein, but can be changed as becomes apparent after understanding the present disclosure, except for operations that must be performed in a specific order. In addition, for clarity and brevity, descriptions of features known in the art may be omitted.

[0033] The embodiments described in some embodiments of the present disclosure below do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0034] It should be noted that all actions of acquiring signals, information or data in the present disclosure are carried out in compliance with the relevant data protection laws and policies of the country where the device is located and with the authorization given by the owner of the corresponding device.

[0035] The host data access control method, apparatus, electronic device, computer-readable storage medium, computer program product, chip, and processor of the embodiments of the present disclosure are described below with reference to the accompanying drawings.

[0036] Figure 1 A flowchart of a host data access control method provided by an embodiment of the present disclosure.

[0037] This embodiment takes the host data access control method being configured in a host data access control device as an example. In this embodiment, the host data access control method can be configured in a host data access control device, and the host data access control device can be set in a server, or can also be set in an electronic device, without limitation.

[0038] This embodiment takes the host data access control method configured in an electronic device as an example, wherein the electronic device is a hardware device such as a smart phone, a tablet computer, a personal digital assistant, an e-book, etc. having various operating systems.

[0039] like Figure 2 As shown, Figure 2It is a schematic diagram of the architecture of the electronic device in the embodiment of the present disclosure. The electronic device may include hardware (Hardware), a host host (also referred to as a host operating system (Host Operating System, HostOS)), the host host includes a hypervisor (Hypervisor), and the electronic device also includes multiple client hosts (also referred to as client operating systems (Guest OS)), and each host has the need to store host data on the hardware. In the embodiment of the present disclosure, the host data of each host that needs to be access-isolated can be encrypted and stored in the hardware. The key data used for encryption can also be uniformly managed through the Trusted Execution Environment (TEE), and each host cannot directly access the key data. One or more applications (Application, APP) can also be run on each host of the electronic device.

[0040] This embodiment can be specifically applied in a host. The host can be the host host described above, or any one of one or more client hosts, and each host can use the method provided by the embodiment of the present disclosure to access its own host data, thereby supporting effective isolation of host data IO access while supporting each host to directly access the storage hardware in the controller, thereby improving the performance of host data access.

[0041] like Figure 1 As shown, the host data access control method includes the following steps:

[0042] Step S101: receiving a first access request, wherein the first access request is used to request access to host data.

[0043] The access request for requesting access to host data may be referred to as a first access request. The first access request may be, for example, an IO request. Host data may be acquired based on the first access request, or host data may be requested to be written. When requesting to acquire host data, the requested host data may be decrypted, and when requesting to write host data, the requested host data may be encrypted, without limitation.

[0044] In some embodiments, the upper-layer APP may send a first access request to the host to request access to host data of the host, and the host may receive the first access request sent by the upper-layer APP.

[0045] In some embodiments, the number of hosts may be one or more, and each host may receive a first access request sent by its upper-layer APP to access the host data of the host. IO access to host data between different hosts is isolated.

[0046] In some embodiments, after receiving the first access request, the host may re-encapsulate the first access request, see subsequent steps for details.

[0047] Step S102, obtaining a register index, wherein the register index is used to index a key register, and the key register is used to store key data of the host.

[0048] Among them, the register index is used to uniquely index and identify the key register, and the key register can store the key data of the host, and the key data is used to encrypt and decrypt the host data of the host. In other words, a key register can be allocated to each host in advance, and other hosts cannot access the key register of the host. Different hosts have different key registers, and the key data of different hosts are different.

[0049] In some embodiments, the key register can be deployed in the controller and support configuration in the trusted execution environment TEE. After the key register is assigned to each host, the corresponding register index can also be configured for each key register. In addition, a set of register bits can be added to mark which host the key register belongs to.

[0050] In some embodiments, after receiving the first access request, the host can determine the register index of the key register configured for the host, and then directly access the storage hardware in the controller based on the register index to request the controller to use the key data to encrypt and decrypt the host data.

[0051] In some embodiments, in the process of obtaining the register index, it is possible to determine whether a key register has been allocated to the key data, obtain a determination result, and obtain the register index according to the determination result. Thus, it is possible to ensure that an accurate register index is obtained, thereby improving the security of IO access control.

[0052] For example, the host may include a UFS driver, and the UFS driver may query in the memory whether there is a configuration tag of the host, the configuration tag is used to indicate that a key register has been assigned to the host's key data. If the configuration tag of the host exists in the memory, it means that a key register has been assigned to the key data. If the configuration tag of the host does not exist in the memory, it means that a key register has not been assigned to the key data. The register index can be obtained by referring to the determination result.

[0053] Step S103: Generate a second access request based on the first access request and the register index, wherein the second access request is used to request encryption and decryption processing of host data using key data.

[0054] Step S104: Send a second access request to the controller.

[0055] In some embodiments, after determining the register index, the host may generate a second access request based on the first access request and the register index. For example, the register index may be configured in the second access request, and the second access request may be sent to the controller to request the controller to use the key data to encrypt and decrypt the host data.

[0056] The controller may be, for example, a UFS controller, in which UFS hardware may be deployed and host data may be stored. The key register allocated to each host may also be deployed in the UFS controller, and there is no limitation on this.

[0057] For example, the host may include a UFS driver, and the UFS driver may add a register index to an IO request (an optional example of a first access request) to obtain a new IO request (an optional example of a second access request). The UFS driver may send the new IO request to a UFS controller, and the UFS controller may obtain the register index from the new IO request, use the register index to find the key data of the host, and use the key data to encrypt and decrypt the host data.

[0058] In this embodiment, the host receives a first access request, wherein the first access request is used to request access to host data, and obtains a register index, wherein the register index is used to index a key register, and the key register is used to store the key data of the host, and based on the first access request and the register index, generates a second access request, wherein the second access request is used to request encryption and decryption of the host data using the key data, and sends the second access request to the controller. While supporting effective isolation of host data IO access, the host is supported to directly access the storage hardware in the controller. Thus, the performance of host data access is improved.

[0059] Figure 3 A flowchart of another host data access control method provided by an embodiment of the present disclosure.

[0060] This embodiment can be specifically applied in a host.

[0061] like Figure 3 As shown, the host data access control method includes the following steps:

[0062] Step S301: receiving a first access request, wherein the first access request is used to request access to host data.

[0063] The description of step S301 can be found in the above embodiment and will not be repeated here.

[0064] Step S302, determine whether a key register has been allocated for the key data, and obtain a determination result.

[0065] For example, the host may include a UFS driver, and the UFS driver may query in the memory whether there is a configuration tag of the host, the configuration tag is used to indicate that a key register has been assigned to the host's key data. If the configuration tag of the host exists in the memory, it means that a key register has been assigned to the key data. If the configuration tag of the host does not exist in the memory, it means that a key register has not been assigned to the key data. The register index can be obtained by referring to the determination result.

[0066] Step S303, when the determination result indicates that a key register has been allocated for the key data, determine the host address and obtain a register index corresponding to the host address, wherein the register index is used to index the key register, and the key register is used to store the key data of the host.

[0067] In some embodiments, when the determination result indicates that a key register has been allocated for the key data, a host address is determined, and a register index corresponding to the host address is determined.

[0068] The host address may be an Internet Protocol (IP) address of the host, etc., and there is no limitation on this.

[0069] In some embodiments, after allocating a key register to each host in advance, a corresponding register index may be configured for each key register. In addition, a group of register bits may be added, and the register bits may be used to mark which host the key register belongs to. In this process, the register index of the key register and the host address may be saved in correspondence, so that after determining the host address, the register bit may be directly used to determine the register index corresponding to the host address.

[0070] Step S304: when the determination result indicates that no key register is allocated for the key data, a register index is obtained according to the key index, wherein the key index is used to index the key data.

[0071] In some embodiments, when the determination result indicates that a key register is not allocated for the key data, a step of allocating a key register for the key data may be triggered.

[0072] For example, the host may include a UFS driver, and the UFS driver may use a key index request to allocate a key register for the key data. After the key register is allocated, the register index of the key register may be obtained.

[0073] In some embodiments, in the process of obtaining the register index according to the key index, an allocation request may be generated and sent to the trusted application according to the key index, wherein the allocation request is used to request the trusted application to allocate a key register for the key data, and an allocation response sent by the trusted application is received, wherein the allocation response includes: the register index, and the register index obtained from the allocation response. Thus, in the case where the key register is not allocated for the key data, the process of triggering the key register allocation in a timely manner is implemented to ensure the security of the host data IO access.

[0074] In some embodiments, the trusted application can be deployed in a trusted execution environment (TEE), thereby improving the security of key register allocation.

[0075] Step S305: Generate a second access request based on the first access request and the register index, wherein the second access request is used to request encryption and decryption processing of host data using key data.

[0076] Step S306: Send a second access request to the controller.

[0077] The description of steps S305 - S306 can be found in the above embodiment and will not be repeated here.

[0078] In this embodiment, the host receives a first access request, wherein the first access request is used to request access to host data, and obtain a register index, wherein the register index is used to index a key register, and the key register is used to store the key data of the host. Based on the first access request and the register index, a second access request is generated, wherein the second access request is used to request encryption and decryption of the host data using the key data, and the second access request is sent to the controller. While supporting effective isolation of host data IO access, the host is supported to directly access the storage hardware in the controller. Thus, the performance of host data access is improved. By determining whether a key register has been assigned to the key data, a determination result is obtained, and when the determination result indicates that a key register has been assigned to the key data, the host address is determined, and the register index corresponding to the host address is obtained; when the determination result indicates that a key register has not been assigned to the key data, the register index is obtained according to the key index, wherein the key index is used to index the key data, thereby ensuring that the register index is obtained in a timely manner to ensure the security of the host data IO access.

[0079] In some embodiments of the present disclosure, before receiving the first access request, the host may send a key generation request to the trusted application, wherein the key generation request includes: first credential information, and the key generation request is used to request the trusted application to generate key data based on the first credential information, so as to timely generate key data for the host to ensure encryption and decryption processing of host data IO access.

[0080] In some embodiments of the present disclosure, before receiving the first access request, the host may send a key acquisition request to the trusted application, wherein the key acquisition request includes: second credential information, the key acquisition request is used to request the trusted application to feedback a key index, and receive a key acquisition response sent by the trusted application, wherein the key acquisition response includes: a key index, and a stored key index. Thus, when receiving an access request from an upper-layer application, the register index can be quickly acquired based on the stored key index, supporting efficient triggering of the controller to perform encryption and decryption processing on the IO access of the host data.

[0081] It should be noted that, for the description of the same or corresponding terms and method steps in the following embodiments as those in the above embodiments, please refer to the above embodiments for details and will not be repeated here.

[0082] Figure 4 A flowchart of another host data access control method provided by an embodiment of the present disclosure.

[0083] This embodiment can be specifically applied in a controller. The controller can be, for example, a UFS controller, in which UFS hardware can be deployed and host data can be stored. The key register allocated to each host can also be deployed in the UFS controller, without limitation.

[0084] like Figure 4 As shown, the host data access control method includes the following steps:

[0085] Step S401, receiving a second access request sent by a host, wherein the second access request is generated based on a first access request and a register index, the first access request is used to request access to host data, the register index is used to index a key register, and the key register is used to store key data of the host.

[0086] In some embodiments, the controller may receive a second access request sent by the host, and obtain a register index from the second access request, wherein the key data of the host is stored in the key register corresponding to the register index.

[0087] Step S402: When it is determined based on the register index that the host meets the authentication condition, key data is obtained from the key register.

[0088] In some embodiments, after obtaining the register index, the controller may use the register index to authenticate the host, and obtain key data from the key register when determining that the host meets the authentication condition based on the register index, so as to ensure the security of the key data.

[0089] In some embodiments, the host has a host address. In the process of determining that the host meets the authentication condition based on the register index, a reference address corresponding to the register index may be obtained, and when the host address and the reference address are the same, it is determined that the host meets the authentication condition.

[0090] In some embodiments, the register index of the key register and the host address can be saved in correspondence. After obtaining the register index, the controller can determine the address corresponding to the register index based on the saved correspondence (the corresponding address can be called a reference address, that is, the host address used as a reference for authentication), and then determine the host address for sending the second access request, and compare the reference address with the host address. When the host address and the reference address are the same, it is determined that the host meets the authentication condition. When the host address and the reference address are not the same, it is determined that the host does not meet the authentication condition.

[0091] Step S403: Use the key data to encrypt and decrypt the host data.

[0092] In some embodiments, the controller can use the register index to obtain key data from the key register, obtain host data from the storage hardware, and use the key data to encrypt and decrypt the host data. The controller can then feed back the encrypted and decrypted data results to the host, and the host can receive the encrypted and decrypted data results and use the encrypted and decrypted data results to respond to the access request of the upper-layer APP.

[0093] In this embodiment, the controller can receive a second access request sent by the host, wherein the second access request is generated based on the first access request and the register index, the first access request is used to request access to the host data, the register index is used to index the key register, the key register is used to store the host's key data, and when it is determined based on the register index that the host meets the authentication conditions, the controller obtains the key data from the key register, and uses the key data to encrypt and decrypt the host data, thereby improving the performance of host data access.

[0094] Figure 5 A flowchart of another host data access control method provided by an embodiment of the present disclosure.

[0095] This embodiment can be specifically applied in a trusted application (TA). The trusted application is deployed in a trusted execution environment TEE. For example, a trusted application may be a Keymaster TA, which is software running in a TEE environment and provides all secure keystore operations: access to keys, and verification of all access rights control on keys.

[0096] like Figure 5 As shown, the host data access control method includes the following steps:

[0097] Step S501, assigning a register index, wherein the register index is used to index a key register, the key register is used to store key data of a host, and the key data is used to perform encryption and decryption processing on host data.

[0098] In some embodiments, the trusted application may allocate a register index to the host. For example, the trusted application may allocate a register index to the host by calling a key management service (KMS).

[0099] In this embodiment, the trusted application can allocate a register index for the host, wherein the register index is used to index a key register, the key register is used to store the host's key data, and the key data is used to encrypt and decrypt the host data, thereby improving the performance of host data access.

[0100] Figure 6 A flowchart of another host data access control method provided by an embodiment of the present disclosure.

[0101] This embodiment can be specifically applied in a trusted application (TA).

[0102] like Figure 6 As shown, the host data access control method includes the following steps:

[0103] Step S601: receiving an allocation request sent by a host, wherein the allocation request includes: a key index, and the key index is used to index key data.

[0104] In some embodiments, the trusted application may receive an allocation request sent by the host and obtain a key index from the allocation request. The trusted application may determine corresponding key data based on the key index.

[0105] Step S602, allocate a key register for the key data and determine the register index.

[0106] In some embodiments, the trusted application may allocate a key register for key data by calling the KMS and feedback the register index to the host.

[0107] Step S603: Send an allocation response to the host, wherein the allocation response includes: a register index.

[0108] In some embodiments, the trusted application may feedback the register index to the host by sending an allocation response to the host.

[0109] In this embodiment, the trusted application can receive an allocation request sent by the host, wherein the allocation request includes: a key index, the key index is used to index key data, and allocates a key register for the key data, and determines the register index, and sends an allocation response to the host, wherein the allocation response includes: the register index. Thus, the register index is allocated to the host in a timely manner, supporting the improvement of the performance of the host data access.

[0110] In some embodiments of the present disclosure, the trusted application may determine the host address and generate a correspondence between the host address and the register index. In addition, the trusted application may also write the correspondence between the host address and the register index into the memory. And after the trusted application assigns the register index, it may also generate a configuration tag for the host in the memory, using the configuration tag to indicate that the key register has been assigned to the key data of the host.

[0111] In some embodiments of the present disclosure, a trusted application may receive a key generation request sent by a host, wherein the key generation request includes: first credential information; and generate key data based on the first credential information, thereby timely generating key data for the host and supporting effective isolation of host data IO access.

[0112] In some embodiments of the present disclosure, a trusted application may receive a key acquisition request sent by a host, wherein the key acquisition request includes: second credential information, and when it is determined that the first credential information and the second credential information meet the verification condition, a key index is assigned to the key data, and a key acquisition response is sent to the host, wherein the key acquisition response includes: the key index. Thus, the key index is assigned to the host in a timely manner, supporting the improvement of the IO access efficiency of the host data.

[0113] The examples for the above embodiment are as follows:

[0114] like Figure 7 As shown, Figure 7It is a schematic diagram of the application architecture of an embodiment of the present disclosure. It includes a UFS controller and a host host. The host host includes a hypervisor and a client host. Each host has the need to store host data on hardware. It also includes a trusted execution environment (TEE), and multiple applications (APPs) can be run on each host. In the TEE, it can include a trusted application (KeymasterTA), KMS, and an encryption driver (for example, a crypto driver is a driver for specifying key hardware and / or software. The Crypto Driver can be at the bottom layer of the encryption stack and is responsible for abstracting the chip hardware key function or the key function based on software encapsulation, etc.). A key register (crypto keyslot) can be included in the UFS controller. The architecture inside each host can be similar. The client host includes: vold (a system service that is responsible for encryption functions and provides convenience and security in storing data), key management hardware abstraction layer (Keymaster Hardware Abstraction Layer, Keymaster HAL), file system, keyring (key ring, used to manage and store various types of keys and security-related data), UFS driver (ufs driver), TEE driver (TEE driver).

[0115] In the following description, key data may also be referred to as a key, without limitation.

[0116] See also above Figure 7, the processes within each host are the same, and they interact with TEE in a unified manner. TEE assigns unique key data to each host to achieve IO access isolation. Key registers (such as crypto keyslots) are hardware registers used to store key data, which can support isolated access by each host. When IO access isolation is enabled, the crypto keyslot can be configured in the TEE environment. During configuration, an independent crypto keyslot is assigned to each host, and other hosts cannot access it. A new set of register bits is added to mark which host the crypto keyslot belongs to. The UFS controller can support the System Memory Management Unit (SMMU) and add an identification bit to the device configuration table of the SMMU to identify which host the host address belongs to. When IO access isolation is enabled, the identification bit can be configured in the TEE environment. When the UFS controller performs encryption and decryption, it determines the host to which the address belongs based on the address of the host data read and written, and then queries the crypto keyslot to check whether the key data to be used matches the host for authentication.

[0117] In addition, on a single host, when the system starts for the first time, the system service vold can generate credential information and call Keymaster HAL to generate key data. Keymaset HAL can communicate with TEE through TEE driver and submit key generation request to Keymaster TA. Keymaster TA sends a key generation request to Key manager service to generate unique key data for the host based on the credential information. After the key data is successfully generated, or when the system starts again, the system service vold calls Keymaster HAL to request key data according to the credential information corresponding to the key data. KeymasetHAL communicates with TEE through TEE driver and submits the key acquisition request to Keymaster TA.

[0118] In addition, the Keymaster TA sends a key acquisition request to the Key manager service to obtain the key data corresponding to the host. It also performs credential verification. If the verification is successful, it returns the key index and initializes the key register for the host.

[0119] In addition, after Vold obtains the key index, it configures it into the keyring. When the application initiates an IO request (an optional example of the first access request), it obtains the key index from the keyring, configures it into the IO request, and submits the configured IO request (an optional example of the second access request) to the UFS driver. The UFS driver queries the register index corresponding to the key index. If the key data is not configured in the key register, the key index is passed to the TEE. The TEE configures the key data into the key register (crypto keyslot) of the UFS controller and returns the corresponding register index. The UFS driver then adds the register index to the IO request and submits it to the UFS controller. The UFS controller finds the corresponding key data based on the register index and uses the key data to encrypt and decrypt the host data.

[0120] The method provided by the embodiment of the present disclosure makes it impossible for each host to obtain host data of other hosts in an offline single-machine environment. The client host can directly access the storage hardware, and the storage performance is similar to that of the host host.

[0121] Figure 8 A schematic diagram of the structure of a host data access control device provided by an embodiment of the present disclosure.

[0122] like Figure 8 As shown, the host data access control device 80 includes:

[0123] The first receiving module 801 is used to receive a first access request, wherein the first access request is used to request access to host data.

[0124] The first acquisition module 802 is used to acquire a register index, wherein the register index is used to index a key register, and the key register is used to store key data of the host.

[0125] The generating module 803 is used to generate a second access request based on the first access request and the register index, wherein the second access request is used to request to use the key data to perform encryption and decryption processing on the host data.

[0126] The sending module 804 is configured to send a second access request to the controller.

[0127] In some embodiments of the present disclosure, the first acquisition module 802 is specifically configured to:

[0128] determining whether a key register has been allocated for the key data, and obtaining a determination result;

[0129] Get the register index according to the determination result.

[0130] In some embodiments of the present disclosure, the first acquisition module 802 is specifically configured to:

[0131] In the case where the determination result indicates that a key register has been allocated for the key data, determining a host address and obtaining a register index corresponding to the host address;

[0132] In a case where the determination result indicates that a key register is not allocated for the key data, a register index is obtained according to a key index, wherein the key index is used to index the key data.

[0133] In some embodiments of the present disclosure, the first acquisition module 802 is specifically configured to:

[0134] generating and sending an allocation request to a trusted application according to the key index, wherein the allocation request is used to request the trusted application to allocate a key register for the key data;

[0135] receiving an allocation response sent by a trusted application, wherein the allocation response includes: a register index;

[0136] Get the register index from the allocation response.

[0137] In some embodiments of the present disclosure,

[0138] The sending module 804 is used to send a key generation request to the trusted application before receiving the first access request, wherein the key generation request includes: first credential information, and the key generation request is used to request the trusted application to generate key data based on the first credential information.

[0139] In some embodiments of the present disclosure,

[0140] The sending module 804 is used to send a key acquisition request to the trusted application before receiving the first access request, wherein the key acquisition request includes: second credential information, and the key acquisition request is used to request the trusted application to feedback a key index;

[0141] The first receiving module 801 is used to receive a key acquisition response sent by a trusted application, wherein the key acquisition response includes: a key index;

[0142] The first acquisition module 802 is also used to store the key index.

[0143] In some embodiments of the present disclosure, a trusted application is deployed in a trusted execution environment (TEE).

[0144] It should be noted that the above explanation of the host data access control method is also applicable to the host data access control device of this embodiment, and will not be repeated here.

[0145] In this embodiment, the host receives a first access request, wherein the first access request is used to request access to host data, and obtains a register index, wherein the register index is used to index a key register, and the key register is used to store the key data of the host, and based on the first access request and the register index, generates a second access request, wherein the second access request is used to request encryption and decryption of the host data using the key data, and sends the second access request to the controller. While supporting effective isolation of host data IO access, the host is supported to directly access the storage hardware in the controller. Thus, the performance of host data access is improved.

[0146] Fig. 9 A schematic diagram of the structure of another host data access control device provided by an embodiment of the present disclosure.

[0147] like Fig. 9 As shown, the host data access control device 90 includes:

[0148] The second receiving module 901 is used to receive a second access request sent by the host, wherein the second access request is generated based on the first access request and the register index, the first access request is used to request access to host data, the register index is used to index the key register, and the key register is used to store the host's key data.

[0149] The second acquisition module 902 is used to acquire key data from the key register when it is determined based on the register index that the host meets the authentication condition.

[0150] The processing module 903 is used to use the key data to perform encryption and decryption processing on the host data.

[0151] In some embodiments of the present disclosure, the host has a host address; the second acquisition module 902 is used to:

[0152] Get the reference address corresponding to the register index;

[0153] When the host address and the reference address are the same, it is determined that the host meets the authentication condition.

[0154] It should be noted that the above explanation of the host data access control method is also applicable to the host data access control device of this embodiment, and will not be repeated here.

[0155] In this embodiment, the controller can receive a second access request sent by the host, wherein the second access request is generated based on the first access request and the register index, the first access request is used to request access to the host data, the register index is used to index the key register, the key register is used to store the host's key data, and when it is determined based on the register index that the host meets the authentication conditions, the controller obtains the key data from the key register, and uses the key data to encrypt and decrypt the host data, thereby improving the performance of host data access.

[0156] Fig.10 A schematic diagram of the structure of another host data access control device provided by an embodiment of the present disclosure.

[0157] like Fig.10 As shown, the host data access control device 100 includes:

[0158] The allocation module 1001 is used to allocate a register index, wherein the register index is used to index a key register, the key register is used to store key data of the host, and the key data is used to encrypt and decrypt host data.

[0159] In some embodiments of the present disclosure, the allocation module 1001 is specifically configured to:

[0160] receiving an allocation request sent by a host, wherein the allocation request includes: a key index, the key index is used to index the key data;

[0161] Allocating a key register for the key data and determining a register index;

[0162] An allocation response is sent to the host, wherein the allocation response includes: a register index.

[0163] In some embodiments of the present disclosure, the apparatus further comprises:

[0164] The processing module is used to determine the host address and generate a corresponding relationship between the host address and the register index.

[0165] In some embodiments of the present disclosure, the apparatus further comprises:

[0166] The third receiving module is used to receive a key generation request sent by the host, wherein the key generation request includes: first credential information; and generate key data based on the first credential information.

[0167] In some embodiments of the present disclosure,

[0168] A third receiving module is used to receive a key acquisition request sent by the host, wherein the key acquisition request includes: second credential information;

[0169] The processing module is used to determine whether the first credential information and the second credential information meet the verification condition, assign a key index to the key data, and send a key acquisition response to the host, wherein the key acquisition response includes: the key index.

[0170] In some embodiments of the present disclosure, a trusted application is deployed in a trusted execution environment (TEE).

[0171] It should be noted that the above explanation of the host data access control method is also applicable to the host data access control device of this embodiment, and will not be repeated here.

[0172] In this embodiment, the trusted application can allocate a register index for the host, wherein the register index is used to index a key register, the key register is used to store the host's key data, and the key data is used to encrypt and decrypt the host data, thereby improving the performance of host data access.

[0173] Fig.11 A block diagram of an exemplary electronic device suitable for implementing embodiments of the present disclosure is shown. Fig.11 The electronic device 12 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0174] like Fig.11 As shown, the electronic device 12 is in the form of a general purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, a memory 28, and a bus 18 that connects various system components (including the memory 28 and the processing unit 16).

[0175] The bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor or a local bus using any of a variety of bus structures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnection (PCI) bus.

[0176] The electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0177] The memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache 32. The electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Fig.11 Not shown, often called a "hard drive").

[0178] although Fig.11 Not shown in the figure, a disk drive for reading and writing a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing a removable non-volatile optical disk (e.g., a compact disc read only memory (hereinafter referred to as: CD-ROM), a digital versatile disc read only memory (hereinafter referred to as: DVD-ROM) or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present disclosure.

[0179] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in the memory 28, such program modules 42 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 42 generally perform the functions and / or methods of the embodiments described in the present disclosure.

[0180] The electronic device 12 may also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, etc.), may also communicate with one or more devices that enable the human body to interact with the electronic device 12, and / or communicate with any device that enables the electronic device 12 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed through an input / output (I / O) interface 22. In addition, the electronic device 12 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 20. As shown, the network adapter 20 communicates with other modules of the electronic device 12 through a bus 18. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0181] The processing unit 16 executes various functional applications and data processing by running the programs stored in the memory 28, such as implementing the host data access control method mentioned in the above embodiment.

[0182] In order to implement the above embodiments, the present disclosure also proposes an electronic device, including: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method provided by the above embodiments.

[0183] In order to implement the above embodiments, the present disclosure further proposes a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the methods provided by the above embodiments.

[0184] In order to implement the above embodiments, the present disclosure also proposes a computer program product, including a computer program, which implements the methods provided by the above embodiments when executed by a processor.

[0185] In order to implement the above embodiments, the present disclosure further proposes a processor, which is used to call a computer to execute instructions to execute the methods provided by the above embodiments.

[0186] In some embodiments of the present disclosure, the processor may be, for example, a CPU, an ISP, etc., without limitation.

[0187] Fig.12 is a schematic diagram of the structure of the chip proposed in the embodiment of the present disclosure. Fig.12 The structure of the chip 1200 is shown, but is not limited to this.

[0188] The chip 1200 includes a processing circuit 1201 , and the processing circuit 1201 is configured to execute any of the above methods.

[0189] In some embodiments, the chip 1200 further includes one or more interface circuits 1202. Optionally, the interface circuit 1202 is connected to the memory 1203. The interface circuit 1202 can be used to receive signals from the memory 1203 or other devices, and the interface circuit 1202 can be used to send signals to the memory 1203 or other devices. For example, the interface circuit 1202 can read instructions stored in the memory 1203 and send the instructions to the processing circuit 1201.

[0190] In some embodiments, the interface circuit 1202 performs at least one of the communication steps such as sending and / or receiving in the above method, and the processing circuit 1201 performs other steps.

[0191] In some embodiments, terms such as interface circuit, interface, transceiver pin, and transceiver may be used interchangeably.

[0192] In some embodiments, the chip 1200 further includes one or more memories 1203 for storing instructions. Alternatively, all or part of the memory 1203 may be outside the chip 1200.

[0193] Those skilled in the art may also understand that the various illustrative logical blocks and steps listed in the embodiments of the present disclosure may be implemented by electronic hardware, computer software, or a combination of the two. Whether such functions are implemented by hardware or software depends on the specific application and the design requirements of the entire system. Those skilled in the art may use various methods to implement the functions described for each specific application, but such implementation should not be understood as exceeding the scope of protection of the embodiments of the present disclosure.

[0194] In addition, the word "exemplary" is used herein to indicate serving as an example, instance, or diagram. Any aspect or design described as "exemplary" in this article is not necessarily understood to be advantageous compared to other aspects or designs. On the contrary, the use of the word exemplary is intended to present concepts in a specific way. As used herein, the term "or" is intended to represent an inclusive "or" rather than an exclusive "or". That is, unless otherwise specified or clear from the context, "X applies A or B" is intended to represent any one of the natural inclusive arrangements. That is, if X applies A; X applies B; or X applies both A and B, "X applies A or B" is satisfied under any of the aforementioned examples. In addition, unless otherwise specified or clearly pointed to a singular form from the context, the articles "one" and "an" as used in this application and the appended claims are generally understood to mean "one or more".

[0195] Likewise, although the present disclosure has been shown and described with respect to one or more implementations, equivalent variations and modifications will occur to those skilled in the art after reading and understanding the specification and drawings. The present disclosure includes all such modifications and variations and is limited only by the scope of the claims. In particular, with respect to the various functions performed by the components (e.g., elements, resources, etc.) described above, unless otherwise noted, the terms used to describe such components are intended to correspond to any component (functionally equivalent) that performs the specific functions of the described components, even if the structure is not equivalent to the disclosed structure. In addition, although the specific features of the present disclosure may have been disclosed with respect to only one of several implementations, such features may be combined with one or more other features of other implementations as may be desired and conducive to any given or specific application. In addition, with respect to "including", "having", "having", "having", or variations thereof used in the specific embodiments or claims, such terms are intended to be inclusive in a manner similar to the term "comprising".

[0196] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0197] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A host data access control method, characterized in that: Executed by a host; the method comprises: receiving a first access request, wherein the first access request is used to request access to host data; Obtaining a register index, wherein the register index is used to index a key register, and the key register is used to store key data of the host; generating a second access request based on the first access request and the register index, wherein the second access request is used to request to use the key data to perform encryption and decryption processing on the host data; and The second access request is sent to the controller.

2. The method according to claim 1, characterized in that: The obtaining of the register index comprises: Determining whether a key register has been allocated for the key data, and obtaining a determination result; The register index is obtained according to the determination result.

3. The method according to claim 2, characterized in that The obtaining the register index according to the determination result includes: In a case where the determination result indicates that a key register has been allocated for the key data, determining a host address and obtaining a register index corresponding to the host address; In a case where the determination result indicates that a key register is not allocated for the key data, the register index is obtained according to a key index, wherein the key index is used to index the key data.

4. The method according to claim 3, characterized in that The obtaining the register index according to the key index includes: Generate and send an allocation request to a trusted application according to the key index, wherein the allocation request is used to request the trusted application to allocate a key register for the key data; receiving an allocation response sent by the trusted application, wherein the allocation response includes: the register index; The register index is obtained from the allocation response.

5. The method according to claim 1, characterized in that Before receiving the first access request, the method further includes: A key generation request is sent to a trusted application, wherein the key generation request includes: first credential information, and the key generation request is used to request the trusted application to generate the key data based on the first credential information.

6. The method according to claim 5, characterized in that Before receiving the first access request, the method further includes: Sending a key acquisition request to a trusted application, wherein the key acquisition request includes: second credential information, and the key acquisition request is used to request the trusted application to feedback the key index; receiving a key acquisition response sent by the trusted application, wherein the key acquisition response includes: the key index; The key index is stored.

7. The method according to any one of claims 3 to 6, characterized in that: The trusted application is deployed in a trusted execution environment TEE.

8. A host data access control method, characterized in that: Executed by a controller; the method comprises: Receiving a second access request sent by the host, wherein the second access request is generated based on the first access request and a register index, the first access request is used to request access to host data, the register index is used to index a key register, and the key register is used to store key data of the host; In a case where it is determined based on the register index that the host satisfies an authentication condition, obtaining the key data from the key register; and The host data is encrypted and decrypted using the key data.

9. The method according to claim 8, characterized in that The host has a host address; and determining that the host meets an authentication condition based on the register index includes: Obtaining a reference address corresponding to the register index; In a case where the host address and the reference address are the same, it is determined that the host satisfies the authentication condition.

10. A host data access control method, characterized in that: Executed by a trusted application; the method comprising: A register index is allocated, wherein the register index is used to index a key register, the key register is used to store key data of a host, and the key data is used to perform encryption and decryption processing on host data.

11. The method according to claim 10, characterized in that The allocation register index comprises: receiving an allocation request sent by the host, wherein the allocation request includes: a key index, the key index being used to index the key data; Allocating a key register for the key data and determining the register index; An allocation response is sent to the host, wherein the allocation response includes: the register index.

12. The method according to claim 11, characterized in that The method further comprises: Determine the host address; A correspondence between the host address and the register index is generated.

13. The method according to claim 10, characterized in that The method further comprises: receiving a key generation request sent by the host, wherein the key generation request includes: first credential information; The key data is generated based on the first credential information.

14. The method according to claim 13, characterized in that The method further comprises: receiving a key acquisition request sent by the host, wherein the key acquisition request includes: second credential information; Determining that the first credential information and the second credential information satisfy a verification condition; assigning the key index to the key data; A key acquisition response is sent to the host, wherein the key acquisition response includes: the key index.

15. The method according to any one of claims 10 to 14, characterized in that: The trusted application is deployed in a trusted execution environment TEE.

16. A host data access control device, characterized in that: The device comprises: A first receiving module, configured to receive a first access request, wherein the first access request is used to request access to host data; A first acquisition module, used for acquiring a register index, wherein the register index is used for indexing a key register, and the key register is used for storing key data of the host; A generating module, configured to generate a second access request based on the first access request and the register index, wherein the second access request is used to request to use the key data to perform encryption and decryption processing on the host data; A sending module is used to send the second access request to the controller.

17. A host data access control device, characterized in that: The device comprises: A second receiving module, configured to receive a second access request sent by the host, wherein the second access request is generated based on the first access request and a register index, the first access request is used to request access to host data, the register index is used to index a key register, and the key register is used to store key data of the host; A second acquisition module, configured to acquire the key data from the key register when it is determined based on the register index that the host satisfies an authentication condition; A processing module is used to use the key data to perform encryption and decryption processing on the host data.

18. A host data access control device, characterized in that: The device comprises: The allocation module is used to allocate a register index, wherein the register index is used to index a key register, the key register is used to store key data of a host, and the key data is used to perform encryption and decryption processing on host data.

19. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 15.

20. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 15 when executed by a processor.

21. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 15 when being executed by a processor.

22. A chip, characterized in that: The chip comprises a processing circuit configured to perform the method according to any one of claims 1-15.

23. A processor, characterized in that: The processor is configured to call computer-executable instructions to perform the method according to any one of claims 1 to 15.

Images