A storage device access method, product, device and readable storage medium

Abstract

The present invention discloses a storage device access method, product, device and readable storage medium, which relates to the field of solid-state hard disks. In order to solve the problem of limitations in security access control and data encryption and decryption for solid-state hard disks, the method includes verifying the validity of a user digital certificate including a user public key sent by a virtual machine system based on a device public key of the storage device, and generating a first random number when the user digital certificate is valid; the user digital certificate is a digital certificate signed by a device private key that cooperates with the device public key; encrypting the first random number using the user public key to obtain encrypted data and outputting it; when receiving data to be verified, decrypting the data to be verified using the first random number to obtain plaintext data, and when the plaintext data is valid, responding to a request to load a hard disk drive sent by the virtual machine system. The present invention can achieve refined control of individual virtual functions, while ensuring data security, optimizing the performance of data transmission.

Description

Technical Field

[0001] The present invention relates to the field of solid state hard disks, and in particular to a storage device access method, product, equipment and readable storage medium. Background Art

[0002] With the rapid development of technologies such as the Internet and cloud computing, solid-state drives (SSDs) have become the mainstream storage medium due to their good performance and high reliability. At present, the capacity of SSDs is getting larger and larger, and the capacity of an SSD can reach 8T, 16T or even larger. However, some users only need a small storage space to store data. If the user uses the entire SSD alone, it will cause a waste of capacity. Solid-state drives that support SR-IOV (Single Root I / O Virtualization) provide a solution to this problem. This technology enables SSDs to create multiple virtual functions (Virtual Functions, VFs). Different users can mount different VFs through virtual machines, thereby realizing independent reading and writing of data. However, existing technologies have limitations in SSD security access control and data encryption and decryption. On the one hand, most of the current security access measures apply to the entire SSD, and it is impossible to perform fine-grained control over individual virtual functions (VFs), making it difficult to meet the personalized access needs of different users. On the other hand, although data transmission through encryption can ensure data security, encryption and decryption operations must be performed every time data is read or written, which will have a significant impact on system performance.

[0003] Therefore, how to provide a solution to the above technical problems is a problem that those skilled in the art need to solve at present. Summary of the invention

[0004] The purpose of the present invention is to provide a storage device access method, product, equipment and readable storage medium, which can achieve refined control of individual virtual functions, optimize the performance of data transmission while ensuring data security.

[0005] In order to solve the above technical problems, the present invention provides a storage device access method, wherein the storage device is virtualized into multiple virtual functions, and the storage device access method comprises:

[0006] Based on the device public key of the storage device, verify the validity of the user digital certificate including the user public key sent by the virtual machine system, and generate a first random number when the user digital certificate is valid; the user digital certificate is a digital certificate signed by the device private key matched with the device public key;

[0007] Encrypting the first random number using the user public key to obtain encrypted data and outputting it, so that the virtual machine system can decrypt the encrypted data using the user private key that cooperates with the user public key to obtain a second random number;

[0008] When receiving the data to be verified output by the virtual machine system and encrypted by the second random number, the data to be verified is decrypted using the first random number to obtain plaintext data. When the plaintext data is valid, the request to load the hard disk drive sent by the virtual machine system is responded to so that the virtual machine system can identify the sub-storage device corresponding to the virtual function in the storage device.

[0009] Optionally, each of the virtual functions is configured with a security authentication capability register, and the structure of the security authentication capability register includes a capability identifier, a base address register, a command register, an offset register and a data register.

[0010] Optionally, the storage device access method further includes:

[0011] In response to not receiving the user digital certificate sent by the virtual machine system within a preset time period after detecting that there is data in the base address register corresponding to the virtual function, resetting the security authentication capability register corresponding to the virtual function so that the virtual function is not recognized by the virtual machine system.

[0012] Optionally, verifying the validity of the user digital certificate including the user public key sent by the virtual machine system based on the device public key of the storage device includes:

[0013] In response to detecting that there is a digital certificate command in the command register corresponding to the virtual function, organizing the certificate data in the data register corresponding to the virtual function into a complete user digital certificate using an offset value in the offset register corresponding to the virtual function;

[0014] Verifying whether the signature value of the user digital certificate is a preset signature value based on the device public key of the storage device;

[0015] If so, determining that the user digital certificate is valid;

[0016] If not, it is determined that the user digital certificate is invalid.

[0017] Optionally, a mapping relationship table is stored in the storage device, and the mapping relationship table is used to represent the association relationship between the user information and the function identifier of the virtual function, and the user digital certificate also includes the user information and the function identifier of the virtual function;

[0018] Generating a first random number when the user digital certificate is valid includes:

[0019] When the user digital certificate is valid, determining whether the function identifier of the virtual function associated with the user information in the user digital certificate in the mapping relationship table is a target identifier;

[0020] If yes, generate a first random number;

[0021] If not, reset the security authentication capability register corresponding to the virtual function so that the virtual function is not recognized by the virtual machine system.

[0022] Optionally, before resetting the security authentication capability register corresponding to the virtual function, the storage device access method further includes:

[0023] A verification failure value is written into a data register corresponding to the virtual function, so that the virtual machine system displays an error message after obtaining the verification failure value from the data register.

[0024] Optionally, encrypting the first random number using the user public key to obtain encrypted data and outputting the encrypted data includes:

[0025] Encrypting the first random number using the user public key to obtain encrypted data;

[0026] In response to detecting that there is a random number acquisition command in the command register corresponding to the virtual function, the encrypted data is written into the data register so that the virtual machine system acquires the encrypted data from the data register.

[0027] Optionally, when receiving the data to be verified output by the virtual machine system and encrypted by the second random number, decrypting the data to be verified by using the first random number to obtain plaintext data includes:

[0028] In response to detecting that there is a verification data command in the command register corresponding to the virtual function, sub-data in the data register corresponding to the virtual function is organized into complete data to be verified using an offset value in an offset register corresponding to the virtual function; the sub-data is data of a preset length in the data to be verified output by the virtual machine system and encrypted by the second random number;

[0029] The data to be verified is decrypted using the first random number to obtain plaintext data.

[0030] Optionally, after decrypting the data to be verified by using the first random number to obtain plaintext data, the storage device access method further includes:

[0031] If the plaintext data is invalid, reset the security authentication capability register corresponding to the virtual function.

[0032] Optionally, the security authentication capability register corresponding to each of the virtual functions is configured to be selectively enabled according to a user command;

[0033] Verifying the validity of the user digital certificate including the user public key sent by the virtual machine system based on the device public key of the storage device includes:

[0034] When the security authentication capability register corresponding to the virtual function is enabled, based on the device public key of the storage device, verifying the validity of the user digital certificate including the user public key sent by the virtual machine system;

[0035] The storage device access method further includes:

[0036] If the security authentication capability register corresponding to the virtual function is not enabled, when a request to load a hard disk drive is received from the virtual machine system, an operation of loading a hard disk drive is performed so that the virtual machine system can identify the sub-storage device corresponding to the virtual function in the storage device.

[0037] In order to solve the above technical problems, the present invention further provides a storage device access method, wherein the storage device is virtualized into multiple virtual functions, and the storage device access method comprises:

[0038] Obtaining a user public key, a user private key and a user digital certificate including the user public key in the virtual machine system; the user digital certificate is a digital certificate signed by the device private key of the storage device;

[0039] Sending the user digital certificate to a target virtual function corresponding to the virtual machine system so that the target virtual function verifies the validity of the user digital certificate based on a device public key that cooperates with the device private key;

[0040] decrypting the random number returned by the target virtual function when verifying the validity of the user digital certificate by using the user private key, and sending the user verification data encrypted by the random number to the target virtual function, so that the target virtual function verifies the validity of the user verification data based on the random number generated by itself;

[0041] In response to the user authentication data being valid, a read and write operation is performed on a sub-storage device corresponding to the identified target virtual function in the storage device.

[0042] In order to solve the above technical problems, the present invention further provides a storage device access method, wherein the storage device is virtualized into multiple virtual functions, each of the virtual functions is configured with a security authentication capability register, and the storage device access method comprises:

[0043] Obtain a user configuration command, and adjust the security authentication state value corresponding to each of the virtual functions in the global array according to the user configuration command, wherein the security authentication state value includes an on state value and a off state value;

[0044] For each of the virtual functions, if the security authentication state value of the virtual function is the enabled state value, control the security authentication capability register of the virtual function to be visible to the virtual machine system, so that after the virtual machine system traverses the security authentication capability register, it performs security authentication with the virtual function, and when the security authentication passes, identifies and mounts the virtual function;

[0045] For each of the virtual functions, if the security authentication state value of the virtual function is the closed state value, the security authentication capability register controlling the virtual function is invisible to the virtual machine system.

[0046] To solve the above technical problem, the present invention further provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the storage device access method as described in any one of the above items.

[0047] In order to solve the above technical problems, the present invention further provides an electronic device, comprising:

[0048] Memory for storing computer programs;

[0049] A processor is used to implement the steps of the storage device access method as described in any one of the above items when executing the computer program.

[0050] To solve the above technical problem, the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the storage device access method as described in any one of the above items are implemented.

[0051] The present application provides a storage device access method, which verifies the user digital certificate sent by the virtual machine system by using the device public key of the storage device, ensuring that only users holding valid certificates can access specific virtual functions. This verification mechanism can be accurate to each virtual function, thereby realizing refined control of individual virtual functions, generating a first random number when the user digital certificate is valid, and encrypting the random number using the user public key. The virtual machine system uses the user's private key to decrypt the encrypted data to obtain a second random number, ensuring that the access request of each virtual function is independently verified. Only when the data to be verified in the user's digital certificate is valid, the virtual function can be mounted and identified by the virtual machine system, enhancing security. By generating and using random numbers in the initial verification stage, encryption and decryption operations are avoided every time data is read and written, while ensuring data security, the performance of data transmission is optimized.

[0052] The present invention also provides two other storage device access methods, computer program products, electronic devices and computer-readable storage media, which have the same beneficial effects as the above storage device access method. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0054] Figure 1 A flowchart of the steps of the first storage device access method provided by the present invention;

[0055] Figure 2 A schematic diagram of a configuration space of a virtual function provided by the present invention;

[0056] Figure 3 A schematic diagram of the structure of a security authentication capability register provided by the present invention;

[0057] Figure 4 A flowchart of a virtual machine system for virtual function verification mounting provided by the present invention;

[0058] Figure 5 A flowchart of the steps of a second storage device access method provided by the present invention;

[0059] Figure 6 A flowchart of the steps of a third storage device access method provided by the present invention;

[0060] Figure 7 A schematic diagram of the structure of an electronic device provided by the present invention;

[0061] Figure 8 This is a schematic diagram of the structure of a computer-readable storage medium provided by the present invention. DETAILED DESCRIPTION

[0062] The core of the present invention is to provide a storage device access method, product, equipment and readable storage medium, which can realize refined control of individual virtual functions, optimize the performance of data transmission while ensuring data security.

[0063] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] First, please refer to Figure 1 The present invention provides a storage device access method, comprising:

[0065] S101: Based on the device public key of the storage device, verify the validity of the user digital certificate including the user public key sent by the virtual machine system, and generate a first random number when the user digital certificate is valid; the user digital certificate is a digital certificate signed by the device private key matched with the device public key;

[0066] In this embodiment, the storage device is a storage device that supports the SR-IOV function. SR-IOV is a hardware I / O virtualization technology standard. As a hardware I / O virtualization solution, SR-IOV defines that I / O devices are natively shareable. An SR-IOV device can create multiple virtual devices. These virtual devices are assigned to different virtual machines to achieve the sharing of physical hardware. It can be understood that a storage device that supports the SR-IOV function can create multiple virtual functions VF, and different users can mount different virtual functions through virtual machines for data read and write operations. In this embodiment, a virtual machine system can mount one or more virtual functions, and a user can use one or more virtual machine systems. Among them, the storage device that supports the SR-IOV function can be specifically an SSD. The storage device access method in this embodiment can be specifically executed by each virtual function virtualized by the storage device. The following takes a virtual function as an example to illustrate the process of verifying the mounted virtual machine system of the virtual function, and the same is true for other virtual functions.

[0067] It can be understood that when the storage device leaves the factory, a private command will be used to notify the storage device to generate a pair of public and private keys inside it, namely the device public key and device private key in this embodiment. The storage device saves this pair of public and private keys to the internal non-volatile secure memory. For the convenience of description and distinction, the device public key is named SSD_pubkey and the device private key is named SSD_prikey. This public and private key pair cannot be exported in any way.

[0068] Correspondingly, the user generates a pair of public and private keys inside the virtual machine system, which are the user public key and user private key in this embodiment. For the convenience of description and distinction, the user public key is named user_pubkey and the user private key is named user_priksy below. User_priksy is saved in a secure area and cannot be exported in any way. After exporting user_pubkey, the user sends the user information (including but not limited to the user name) and user_pubkey to the device administrator. The device administrator sends the user information, user_pubkey, and the PCIe (Peripheral Component Interconnect Express, external device interconnection standard high-speed serial bus) number corresponding to the virtual function (that is, the functional identifier of the virtual function) to the storage device through a private command. The storage device organizes the user information and the user public key into a preset digital certificate, signs the preset digital certificate with SSD_prikey, obtains a user digital certificate (named user_cert here) and returns it to the device administrator. The device administrator sends the generated user digital certificate to the user, and the user installs user_cert in a specific location in the virtual machine system.

[0069] It can be understood that after the virtual machine system is started, it obtains the user digital certificate containing user_pubkey from the above-mentioned specific location and transmits it to the corresponding virtual function. After the virtual function receives the user digital certificate, it uses SSD_prikey to verify the validity of the user digital certificate. SSD_prikey is pre-stored by the virtual function and corresponds to the SSD_prikey signed for the user digital certificate. If the user digital certificate is verified to be valid, it means that the user who transmits and uses the virtual machine system has the right to access the virtual function, thereby ensuring that only users with valid certificates can access specific virtual functions. Using digital certificates and asymmetric key encryption and decryption verification is safer than using password-based symmetric key encryption and decryption authentication, and can also prevent data from being cracked and information data from being lost due to the loss of user passwords.

[0070] When verifying that the user digital certificate is valid, the virtual function generates a first random number. The first random number is dynamically generated, that is, each time the virtual machine system is started and the security authentication is performed with the virtual function, an independent first random number is generated. The first random number generated in each security authentication process is different. Even if an attacker intercepts the encrypted data in a security authentication process, the data cannot be replayed in subsequent authentications, because each security authentication uses a different random number, which further enhances the security of the system and prevents attackers from obtaining access rights through replay attacks.

[0071] S102: Encrypt the first random number using the user public key to obtain encrypted data and output it, so that the virtual machine system can decrypt the encrypted data using the user private key that cooperates with the user public key to obtain a second random number;

[0072] In this embodiment, the first random number is encrypted according to the user public key in the user digital certificate to obtain encrypted data and output it. This encryption process ensures that only the user with the corresponding user private key can decrypt and obtain the original random number (that is, the first random number). After obtaining the encrypted data, the virtual machine system decrypts the encrypted data based on its own pre-stored user private key to obtain a second random number. It can be understood that different virtual machine systems or different users have different user public and user private keys. Therefore, even if multiple virtual machine systems or users use the same virtual function, the encrypted data generated by each system or user and the second random number obtained by decryption are different. The second random number obtained by decryption for each virtual machine system or user is unique, ensuring the independence and security of each session, so that the second random number can be used to perform secondary verification on the virtual machine system later.

[0073] S103: When receiving the data to be verified encrypted by the second random number output by the virtual machine system, use the first random number to decrypt the data to be verified to obtain plaintext data. When the plaintext data is valid, respond to the request to load the hard disk drive sent by the virtual machine system so that the virtual machine system can identify the sub-storage device corresponding to the virtual function in the storage device.

[0074] In this embodiment, after the virtual machine system obtains the second random number through decryption, it encrypts the data to be verified based on the second random number and outputs it to the virtual function. The data to be verified can be some data pre-agreed by the virtual machine system and the virtual function. After receiving the data to be verified, the virtual function uses the first random number generated by itself to decrypt the data to be verified to obtain the plaintext data, and judges the validity of the plaintext data, that is, whether the plaintext data is the data pre-agreed by itself and the virtual machine system. If so, the plaintext data is determined to be valid, which indicates that the virtual machine system has the correct user private key and is a verified legal user. Once the plaintext data is verified to be valid, if the virtual function receives a request to load the hard disk drive from the virtual machine system, the virtual function will load the hard disk drive. If the request to load the hard disk drive sent by the virtual machine system is received, the hard disk drive is loaded. After the hard disk drive is loaded, the virtual machine system can identify the sub-storage device (nvme (Non-Volatile Memory Express, a high-speed communication protocol for non-volatile memory) device) corresponding to the virtual function in the storage device (such as SSD), and finally, the virtual machine system can read and write to the sub-storage device. It can be seen that in this embodiment, by using the device public key of the storage device to verify the user digital certificate sent by the virtual machine system, it is ensured that only users holding valid certificates can access specific virtual functions. This verification mechanism can be accurate to each virtual function, thereby realizing refined control of individual virtual functions. When the user digital certificate is valid, a first random number is generated, and the random number is encrypted using the user public key. The virtual machine system uses the user's private key to decrypt the encrypted data to obtain a second random number, ensuring that the access request for each virtual function is independently verified. Only when the data to be verified in the user's digital certificate is valid, the virtual function can be mounted and identified by the virtual machine system, which enhances security. By generating and using random numbers in the initial verification stage, encryption and decryption operations are avoided every time data is read and written, while ensuring data security, the performance of data transmission is optimized.

[0075] Based on the above embodiments:

[0076] In an exemplary embodiment, each virtual function is configured with a security authentication capability register, and the structure of the security authentication capability register includes a capability identifier, a base address register, a command register, an offset register, and a data register.

[0077] It can be understood that each PCIe device has a 4K configuration space. In the configuration space, there are many registers that describe PCIe related capabilities. This space is called the PCIe capability register space. The PCIe extended capability structure is stored after 0x100 in the PCI configuration space, as shown in the following figure. Figure 2The example of capability register in the 4k configuration space of the PCIe device shown in the figure, this embodiment implements a PCIe security authentication capability register in the PCIe extended capability structure configuration space of each virtual function, that is, the security authentication capability register in this embodiment, Figure 2 The medium capability structure is located in the low address area of ​​the configuration space (0 to 0xFF). The capability structure header includes the following fields: Bit15:0 Capability ID: Identifies the type of capability, Bit19:16 Capability Version: Identifies the version of the capability, Bit31:20 Next Capability Offset: Points to the offset address of the next capability structure in the configuration space. The extended capability structure is located in the high address area of ​​the configuration space (0x100 to 0xFFF). The structure of the security authentication capability register is as follows: Figure 3 As shown, the first 4 bytes are the PCIe extended capability register header, which conforms to the definition in the PCIe basic protocol. Among these 4 bytes, bit 0-16 is the capability identifier of the PCIe extended register of the register (the value of the capability identifier cannot be the same as the capability ID (Identification) of the capability register defined in the PCIe protocol. The value is a custom value. When the virtual machine system is started, the PCIe driver of the virtual machine system detects the capability identifier when traversing the capability register of the virtual function, and determines that this is the PCIe security authentication capability register). Figure 3 The capability identifier of the extended register in is host read-only (i.e., the host can only read), the capability version is host read-only, and the next capability register offset is host read-only. Command register (host read and write, i.e., the host can read and write): The virtual machine system writes different control commands to the command register to notify the storage device of the next operation. The control commands are mainly divided into: digital certificate command WRITE_CERT, get random number command GET_RANDOM, verify data command VERIFY, get verification result GET_RESULT. Offset register (host read and write): The virtual machine system reads or writes 4 bytes of data from the data register each time. The value in the offset register is the offset of the entire data where the 4 bytes of data are located, and the unit is Dword (unsigned 32-bit integer). Data register (host read and write): The virtual machine reads or writes data through this register according to different commands. The structure of the security authentication capability register also includes Figure 3 The base address register is not shown.

[0078] In an exemplary embodiment, the storage device access method further includes:

[0079] In response to not receiving a user digital certificate sent by the virtual machine system within a preset time period after detecting that there is data in the base address register corresponding to the virtual function, the security authentication capability register corresponding to the virtual function is reset so that the virtual function is not recognized by the virtual machine system.

[0080] It can be understood that before the virtual machine system starts to communicate with the virtual function, the virtual machine system needs to configure the base address register (Base Address Register, BAR) of the virtual function before sending the TLP (Transaction Layer Packet) message. Therefore, in this embodiment, after the virtual function detects that the base address register is written with data, it starts a timer with a timing time of T. This timer is configured to monitor whether the virtual machine system completes the security authentication within the specified time. The virtual function does not process the virtual machine's loading nvme driver instruction (i.e., the hard disk drive request) before the security authentication is passed, thereby ensuring that only authenticated virtual machine systems can access storage resources. Within the T time after power-on, the virtual function will wait for the virtual machine system to send a user digital certificate. If the user digital certificate is not received within this time, the virtual function will regard the virtual machine system as a virtual machine system of a non-secure system platform because it did not provide the necessary authentication information within the specified time. The virtual function will set an authentication failure flag to indicate that the authentication process was unsuccessful, and reset its security authentication capability register to prevent unauthenticated virtual machine systems from trying to use virtual functions, ensuring that virtual functions will not be recognized or used on non-secure system platforms, thereby improving the overall security of the system.

[0081] In an exemplary embodiment, based on the device public key of the storage device, verifying the validity of the user digital certificate including the user public key sent by the virtual machine system includes:

[0082] In response to detecting that there is a digital certificate command in the command register corresponding to the virtual function, organizing the certificate data in the data register corresponding to the virtual function into a complete user digital certificate using an offset value in the offset register corresponding to the virtual function;

[0083] Verifying whether the signature value of the user digital certificate is a preset signature value based on the device public key of the storage device;

[0084] If so, determine that the user's digital certificate is valid;

[0085] If not, the user's digital certificate is determined to be invalid.

[0086] In this embodiment, when the PCIe driver of the virtual machine system traverses the PCIe capability register of the solid state drive and traverses to the security authentication capability register, the PCIe driver reads the user digital certificate user_cert from a specific position of the virtual machine system, writes the value of the WRITE_CERT command to the command register of the virtual function, and sends the certificate data to the virtual function through the offset register and the data register through the TLP message. The virtual function continuously organizes the certificate data in the data register through the offset value in the offset register. When the virtual function detects that the offset value of the offset register is 0xFFFF and the value of the data register is 0, it indicates that the user digital certificate transmission is completed. At this time, the signature value and the preset signature value of the user digital certificate are verified based on SSD_pubkey. If the two are the same, the user digital certificate is valid. If the two are different, the user digital certificate is invalid.

[0087] If the verification is invalid, the virtual function sets a failure flag and no longer responds to the subsequent process of loading the nvme driver.

[0088] In an exemplary embodiment, a mapping relationship table is stored in the storage device, and the mapping relationship table is used to characterize the association relationship between the user information and the function identifier of the virtual function, and the user digital certificate also includes the user information and the function identifier of the virtual function;

[0089] Generating a first random number when the user digital certificate is valid includes:

[0090] When the user digital certificate is valid, determining whether the function identifier of the virtual function associated with the user information in the user digital certificate in the mapping relationship table is the target identifier;

[0091] If yes, generate a first random number;

[0092] If not, reset the security authentication capability register corresponding to the virtual function so that the virtual function is not recognized by the virtual machine system.

[0093] In this embodiment, when the storage device uses SSD_prikey to sign the preset digital certificate to obtain the user digital certificate and returns it to the device administrator, a mapping relationship table is established inside the SSD to map the user information and the PCIe number of the virtual function (i.e., the function identifier in this embodiment) so that in the subsequent process of verifying the user digital certificate, it is also verified whether the user accessing this virtual function is the user assigned by the administrator, thereby preventing the virtual function from being randomly mounted by other users.

[0094] Specifically, when the user digital certificate is successfully verified, the mapping relationship table is searched according to the user information in the user digital certificate to find the PCIe number associated with the user information in the user digital certificate, and it is determined whether the PCIe number is the PCIe number corresponding to this virtual function. If not, the failure flag is set and the subsequent process of loading the nvme driver will no longer respond.

[0095] In an exemplary embodiment, before resetting the security authentication capability register corresponding to the virtual function, the storage device access method further includes:

[0096] The verification failure value is written to the data register corresponding to the virtual function, so that the virtual machine system displays an error message after obtaining the verification failure value from the data register.

[0097] The PCIe driver of the virtual machine system writes the value of the verification result GET_RESULT to the command register. If the virtual function verification is successful, the verification result value 0 is written to the data register. If the verification fails, the verification result value 0xFFFFFFFF is written to the data register. The virtual function resets its security authentication capability register and no longer responds to any TLP message.

[0098] After both the user information and the user digital certificate are successfully verified, the virtual function generates a 16-byte first random number, and uses the user public key in the user_cert to encrypt the first random number to obtain encrypted data enc_random_data.

[0099] In an exemplary embodiment, the first random number is encrypted using the user's public key to obtain encrypted data and output the encrypted data including:

[0100] Encrypting the first random number using the user public key to obtain encrypted data;

[0101] In response to detecting that there is a random number acquisition command in the command register corresponding to the virtual function, the encrypted data is written into the data register so that the virtual machine system acquires the encrypted data from the data register.

[0102] The PCIe driver of the virtual machine system determines whether the verification is successful based on the value of the GET_RESULT command. If successful, the PCIe driver of the virtual machine system writes the value of the random number GET_RANDOM to the command register, and writes the offset register to specify the data at the offset position to be obtained. The virtual function returns the data at the corresponding position of the encrypted data enc_random_data to the virtual machine through the data register. If the PCIe driver finds that the verification fails, it displays an error message to prompt the user.

[0103] In an exemplary embodiment, when receiving the to-be-verified data encrypted by the second random number output by the virtual machine system, decrypting the to-be-verified data by using the first random number to obtain the plaintext data includes:

[0104] In response to detecting that there is a verification data command in the command register corresponding to the virtual function, sub-data in the data register corresponding to the virtual function is organized into complete data to be verified using an offset value in the offset register corresponding to the virtual function; the sub-data is data of a preset length in the data to be verified output by the virtual machine system and encrypted by the second random number;

[0105] The first random number is used to decrypt the data to be verified to obtain plaintext data.

[0106] The PCIe driver of the virtual machine system uses user_prikey to decrypt the encrypted data to obtain the second random number, and uses the 16-byte second random number as the key to encrypt the following organized data, including but not limited to user information, the PCIe number of the virtual function, the capacity of the virtual function, the SN of the SSD, and the MN of the SSD. The PCIe driver of the virtual machine system writes the value of the verification data command VERIFY to the command register, and sends the encrypted data to be verified to the virtual function by continuously writing the offset register and the data register. After the virtual function obtains the complete data to be verified, it uses the first random number generated by itself to decrypt and obtain the plaintext data.

[0107] Verify whether the plaintext data is correct. If the verification is successful, set the verification success flag and continue to process the TLP messages sent by the subsequent virtual machine system.

[0108] In an exemplary embodiment, after decrypting the data to be verified using the first random number to obtain plaintext data, the storage device access method further includes:

[0109] If the plaintext data is invalid, reset the security authentication capability register corresponding to the virtual function.

[0110] If the plaintext data verification fails, that is, the plaintext data is invalid, the virtual function sets a failure flag and no longer responds to the subsequent process of loading the nvme driver.

[0111] The PCIe driver of the virtual machine system writes the value of the verification result GET_RESULT to the command register, and then reads the data register. If the virtual function verification is successful, it returns 0, and if the verification fails, it returns 0xFFFFFFFF, and the virtual function resets its security authentication capability register and no longer responds to any TLP message. The PCIe driver of the virtual machine system determines whether the verification is successful based on the value of the GET_RESULT command. If it is successful, it continues to send TLP messages that load information such as the nvme driver. Finally, the virtual machine can identify the nvme device of the VF and can perform read and write operations. In this embodiment, during the security authentication process, the transmission of data such as user digital certificates and encrypted data is through several registers in the PCIe security authentication capability register using TLP messages to read and write data, which does not depend on the host system kernel. Data transmission is performed without identifying the nvme device, which has high flexibility and convenient transmission.

[0112] In an exemplary embodiment, the security authentication capability register corresponding to each virtual function is configured to be selectively enabled according to a user command;

[0113] Verifying the validity of the user digital certificate including the user public key sent by the virtual machine system based on the device public key of the storage device includes:

[0114] When the security authentication capability register corresponding to the virtual function is turned on, the validity of the user digital certificate including the user public key sent by the virtual machine system is verified based on the device public key of the storage device;

[0115] The storage device access method further includes:

[0116] If the security authentication capability register corresponding to the virtual function is not enabled, when a request to load a hard disk driver is received from the virtual machine system, the operation of loading the hard disk driver is executed so that the virtual machine system can identify the sub-storage device corresponding to the virtual function in the storage device.

[0117] In this embodiment, the security authentication capability register corresponding to each virtual function is configured to be selectively enabled according to user commands. A global array is maintained for the security authentication functions of all virtual functions within the system's physical function PF (Physical Function). If a virtual function needs security authentication when mounted, the administrator sends a private command to the PF to set the virtual function to enable security authentication. The PF will set the corresponding index value in the array to 1. When the virtual machine system traverses the PCIe configuration space of the virtual function, it determines that the virtual function has security authentication enabled based on the global array, and allows the virtual machine system to traverse the security authentication capability register of the virtual function. When a virtual function does not require security authentication, a command can be sent to the PF to turn off security authentication. When the virtual machine system traverses the PCIe configuration space of the virtual function, it will not traverse the security authentication capability register.

[0118] Furthermore, the PCIe driver of the virtual machine system that needs to perform security authentication with the VF also needs to be modified synchronously. When the virtual machine system is started, the PCIe driver of the virtual machine system needs to recognize the PCIe security authentication capability register and be able to perform subsequent encryption and decryption operation verification.

[0119] A virtual machine without the PCIe driver for security authentication will not recognize the PCIe security authentication capability register and cannot perform security authentication within the specified time. It will not be able to access the VF with the security authentication function enabled and can only mount and identify the VF with this function disabled.

[0120] In summary, the present invention provides a method for enabling the SR-IOV function of a solid-state hard disk, by opening the PCIe security capability register, so that when the virtual machine system is started, the virtual function verifies the legitimacy of the virtual machine before allowing it to access. Figure 4After the virtual machine system finishes writing the base address register, the virtual function starts a timer with a timing time of T. The virtual machine system enumerates the device, identifies the security authentication capability register, and sends the WRITE_CERT command and certificate data to the virtual function. The virtual function uses SSD_pubkey to verify the certificate. If the verification fails, the corresponding operation of the verification failure described above is performed. If the verification succeeds, the virtual function generates information corresponding to the verification success. The virtual machine system sends a GET_RESULT command to obtain the verification result of the virtual function. If the verification is determined to be successful, the virtual machine system reads the security authentication counter and random number, and sends a GET_RANDOM command to the virtual function. The virtual function generates a random number , and use the user_pubkey in the certificate to encrypt the random number and send it to the virtual machine system. The virtual machine system uses the user_prikey to decrypt the random number, uses the random number to encrypt the relevant data, and sends the VERIFY command. The virtual function uses the random number to decrypt the data, compares the plaintext data to see if it is correct, sets the verification success flag after the verification is passed, and performs the operation corresponding to the verification failure as described above if the verification fails. The virtual machine system sends a GET_RESULT command. If the verification is successful, the virtual machine system sends a load driver message, writes the specified register, and the virtual function executes the load driver process, sets the sub-storage device to be ready, and the host on the virtual machine system side detects that it is ready and performs read and write operations. The present invention ensures that virtual functions that require security protection can only be mounted and used by authenticated virtual machine systems, thereby ensuring data security. For virtual functions that do not require security protection, the PCIe security capability register can be turned off, and can be accessed by virtual machines of any system. While ensuring security, it has high flexibility and is easy to operate.

[0121] Second, please refer to Figure 5 The present invention also provides a storage device access method, wherein the storage device is virtualized into multiple virtual functions, and the storage device access method comprises:

[0122] S201: Obtaining a user public key, a user private key, and a user digital certificate including the user public key in a virtual machine system; the user digital certificate is a digital certificate signed by a device private key of a storage device;

[0123] S202: Sending the user digital certificate to the target virtual function corresponding to the virtual machine system, so that the target virtual function verifies the validity of the user digital certificate based on the device public key matched with the device private key;

[0124] S203: using the user private key to decrypt the random number returned by the target virtual function when verifying the validity of the user digital certificate, and sending the user verification data encrypted by the random number to the target virtual function, so that the target virtual function verifies the validity of the user verification data based on the random number generated by itself;

[0125] S204: In response to the user verification data being valid, performing read and write operations on the sub-storage device corresponding to the identified target virtual function in the storage device.

[0126] In this embodiment, the above steps are implemented through a virtual machine system, which has the same beneficial effects as the first storage device access method.

[0127] Third, please refer to Figure 6 The present invention also provides a storage device access method, wherein the storage device is virtualized into multiple virtual functions, each virtual function is configured with a security authentication capability register, and the storage device access method comprises:

[0128] S301: Obtain a user configuration command, and adjust the security authentication state value corresponding to each virtual function in the global array according to the user configuration command, where the security authentication state value includes an on state value and a off state value;

[0129] S302: If the security authentication state value of the virtual function is an on state value, control the security authentication capability register of the virtual function to be visible to the virtual machine system, so that the virtual machine system performs security authentication with the virtual function after traversing the security authentication capability register, and when the security authentication passes, identify and mount the virtual function;

[0130] S303: If the security authentication state value of the virtual function is a closed state value, the security authentication capability register controlling the virtual function is invisible to the virtual machine system.

[0131] In this embodiment, the above steps are implemented through the physical function PF, which has the same beneficial effects as the first storage device access method.

[0132] In a fourth aspect, the present invention further provides a computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the storage device access method described in any of the above embodiments.

[0133] For an introduction to a computer program product provided by the present invention, please refer to the above embodiments, and the present invention will not be described in detail here.

[0134] A computer program product provided by the present invention has the same beneficial effects as the above storage device access method.

[0135] Fifth, please refer to Figure 7 The present invention also provides an electronic device, comprising:

[0136] A memory 21, used for storing computer programs;

[0137] The processor 22 is configured to implement the steps of the storage device access method described in any of the above embodiments when executing a computer program.

[0138] The electronic device also includes:

[0139] The input interface 23 is connected to the processor 22 via the communication bus 26, and is used to obtain the computer programs, parameters and instructions imported from the outside, and save them in the memory 21 under the control of the processor 22. The input interface can be connected to an input device to receive parameters or instructions manually input by the user. The input device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the terminal housing.

[0140] The display unit 24 is connected to the processor 22 via the communication bus 26 and is used to display the data sent by the processor 22. The display unit can be a liquid crystal display or an electronic ink display.

[0141] The network port 25 is connected to the processor 22 via the communication bus 26, and is used to communicate with various external terminal devices. The communication technology used in the communication connection can be a wired communication technology or a wireless communication technology, such as mobile high-definition link technology, universal serial bus, high-definition multimedia interface, wireless fidelity technology, Bluetooth communication technology, low-power Bluetooth communication technology, communication technology based on IEEE802.11s, etc.

[0142] For an introduction to an electronic device provided by the present invention, please refer to the above embodiments, and the present invention will not be described in detail here.

[0143] The electronic device provided by the present invention has the same beneficial effects as the above storage device access method.

[0144] For the sixth aspect, please refer to Figure 8 The present invention further provides a computer-readable storage medium 30, on which a computer program 31 is stored. When the computer program 31 is executed by a processor, the steps of the storage device access method described in any of the above embodiments are implemented.

[0145] The computer-readable storage medium 30 may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0146] For an introduction to a computer-readable storage medium 30 provided by the present invention, please refer to the above embodiment, and the present invention will not be described in detail here.

[0147] A computer-readable storage medium 30 provided by the present invention has the same beneficial effects as the above-mentioned storage device access method.

[0148] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0149] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A storage device access method, characterized in that: The storage device is virtualized into multiple virtual functions, and the storage device access method includes: Based on the device public key of the storage device, verify the validity of the user digital certificate including the user public key sent by the virtual machine system, and generate a first random number when the user digital certificate is valid; the user digital certificate is a digital certificate signed by the device private key matched with the device public key; Encrypting the first random number using the user public key to obtain encrypted data and outputting it, so that the virtual machine system can decrypt the encrypted data using the user private key that cooperates with the user public key to obtain a second random number; When receiving the data to be verified output by the virtual machine system and encrypted by the second random number, the data to be verified is decrypted using the first random number to obtain plaintext data. When the plaintext data is valid, the request to load the hard disk drive sent by the virtual machine system is responded to so that the virtual machine system can identify the sub-storage device corresponding to the virtual function in the storage device.

2. The storage device access method according to claim 1, characterized in that: Each of the virtual functions is configured with a security authentication capability register, and the structure of the security authentication capability register includes a capability identifier, a base address register, a command register, an offset register and a data register.

3. The storage device access method according to claim 2, characterized in that: The storage device access method further includes: In response to not receiving the user digital certificate sent by the virtual machine system within a preset time period after detecting that there is data in the base address register corresponding to the virtual function, resetting the security authentication capability register corresponding to the virtual function so that the virtual function is not recognized by the virtual machine system.

4. The storage device access method according to claim 2, characterized in that: Verifying the validity of the user digital certificate including the user public key sent by the virtual machine system based on the device public key of the storage device includes: In response to detecting that there is a digital certificate command in the command register corresponding to the virtual function, organizing the certificate data in the data register corresponding to the virtual function into a complete user digital certificate using an offset value in the offset register corresponding to the virtual function; Verifying whether the signature value of the user digital certificate is a preset signature value based on the device public key of the storage device; If so, determining that the user digital certificate is valid; If not, it is determined that the user digital certificate is invalid.

5. The storage device access method according to claim 4, characterized in that: The storage device stores a mapping relationship table, the mapping relationship table is used to represent the association relationship between the user information and the function identifier of the virtual function, and the user digital certificate also includes the user information and the function identifier of the virtual function; Generating a first random number when the user digital certificate is valid includes: When the user digital certificate is valid, determining whether the function identifier of the virtual function associated with the user information in the user digital certificate in the mapping relationship table is a target identifier; If yes, generate a first random number; If not, reset the security authentication capability register corresponding to the virtual function so that the virtual function is not recognized by the virtual machine system.

6. The storage device access method according to claim 5, characterized in that: Before resetting the security authentication capability register corresponding to the virtual function, the storage device access method further includes: A verification failure value is written into a data register corresponding to the virtual function, so that the virtual machine system displays an error message after obtaining the verification failure value from the data register.

7. The storage device access method according to claim 2, characterized in that: Encrypting the first random number using the user public key to obtain encrypted data and outputting the encrypted data includes: Encrypting the first random number using the user public key to obtain encrypted data; In response to detecting that there is a random number acquisition command in the command register corresponding to the virtual function, the encrypted data is written into the data register so that the virtual machine system acquires the encrypted data from the data register.

8. The storage device access method according to claim 2, characterized in that: When receiving the data to be verified output by the virtual machine system and encrypted by the second random number, decrypting the data to be verified by using the first random number to obtain plaintext data includes: In response to detecting that there is a verification data command in the command register corresponding to the virtual function, sub-data in the data register corresponding to the virtual function is organized into complete data to be verified using an offset value in an offset register corresponding to the virtual function; the sub-data is data of a preset length in the data to be verified output by the virtual machine system and encrypted by the second random number; The data to be verified is decrypted using the first random number to obtain plaintext data.

9. The storage device access method according to claim 8, characterized in that: After decrypting the data to be verified by using the first random number to obtain plaintext data, the storage device access method further includes: If the plaintext data is invalid, reset the security authentication capability register corresponding to the virtual function.

10. The storage device access method according to any one of claims 2 to 9, characterized in that: The security authentication capability register corresponding to each of the virtual functions is configured to be selectively enabled according to a user command; Verifying the validity of the user digital certificate including the user public key sent by the virtual machine system based on the device public key of the storage device includes: When the security authentication capability register corresponding to the virtual function is enabled, based on the device public key of the storage device, verifying the validity of the user digital certificate including the user public key sent by the virtual machine system; The storage device access method further includes: If the security authentication capability register corresponding to the virtual function is not enabled, when a request to load a hard disk drive is received from the virtual machine system, an operation of loading a hard disk drive is performed so that the virtual machine system can identify the sub-storage device corresponding to the virtual function in the storage device.

11. A storage device access method, characterized in that: The storage device is virtualized into multiple virtual functions, and the storage device access method includes: Obtaining a user public key, a user private key and a user digital certificate including the user public key in the virtual machine system; the user digital certificate is a digital certificate signed by the device private key of the storage device; Sending the user digital certificate to a target virtual function corresponding to the virtual machine system so that the target virtual function verifies the validity of the user digital certificate based on a device public key that cooperates with the device private key; decrypting the random number returned by the target virtual function when verifying the validity of the user digital certificate by using the user private key, and sending the user verification data encrypted by the random number to the target virtual function, so that the target virtual function verifies the validity of the user verification data based on the random number generated by itself; In response to the user authentication data being valid, a read and write operation is performed on a sub-storage device corresponding to the identified target virtual function in the storage device.

12. A computer program product comprising a computer program / instructions, characterized in that When the computer program / the instructions are executed by a processor, the steps of the storage device access method according to any one of claims 1 to 11 are implemented.

13. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the storage device access method as claimed in any one of claims 1 to 11 when executing the computer program.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the storage device access method according to any one of claims 1 to 11 are implemented.

Images