Method and device for authenticating security area of solid state disk and electronic equipment

Abstract

The invention discloses a solid state disk safety area authentication method and device and electronic equipment, and the method comprises the steps: when a safety area of a solid state disk is in an unlocking state, if a secret key setting or modifying instruction sent by a host is received, setting or modifying a secret key of the safety area according to the secret key setting or modifying instruction; the numerical value of the security area state information of the namespace characteristic data structure of the solid state disk is set to be a first preset numerical value, and the first preset numerical value represents that the solid state disk supports security area authentication, the security area is provided with authentication, and the security area state is a non-locking state; if a locking instruction sent by the host is received, the safe area is locked according to the locking instruction, and the safe area is in a locked state; and setting the value of the security area state information of the namespace characteristic data structure of the solid state disk as a second preset value. By adopting the method, the data security of the solid state disk security area can be ensured.

Description

Technical Field

[0001] The present application relates to the field of computer software technology, and in particular to a method, device and electronic device for authenticating a solid state hard disk security zone. Background Art

[0002] The existing SSD security zone operation scheme is not authenticated. If the SSD security zone command is leaked, the SSD security zone and the information in the security zone can be cleared through terminal commands, which may cause data loss in the SSD security zone and pose a security risk. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a method, device and electronic device for authenticating the security zone of a solid-state hard disk, so as to solve the problem in the prior art that the existing security zone of a solid-state hard disk is not authenticated, which may lead to data loss in the security zone of the solid-state hard disk.

[0004] In a first aspect, an embodiment of the present application provides a method for authenticating a security zone of a solid state drive, comprising:

[0005] When the security zone of the solid state drive is in an unlocked state, if a setting or modifying key instruction sent from the host is received, the key of the security zone is set or modified according to the setting or modifying key instruction;

[0006] Setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a first preset value, wherein the first preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone state is unlocked;

[0007] If a locking instruction is received from the host, the security zone is locked according to the locking instruction, and the security zone is in a locked state;

[0008] The value of the security zone status information of the namespace characteristic data structure of the solid state drive is set to a second preset value, wherein the second preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is a locked state.

[0009] In a possible implementation, before the security area of ​​the solid state drive is in an unlocked state, the method further includes:

[0010] If an unlock command is received from the host, the unlock command is verified;

[0011] If the unlock instruction meets the preset conditions, the security zone is unlocked according to the unlock instruction, and the security zone is in an unlocked state.

[0012] In a possible implementation, before the security area of ​​the solid state drive is in an unlocked state, the method further includes:

[0013] Determine whether there is a secure zone on the SSD;

[0014] If it is determined that the SSD has a security zone, set the security zone to be invisible;

[0015] If a locking instruction is received from the host, the security zone is locked according to the locking instruction, and the security zone is in a locked state;

[0016] The value of the security zone status information of the namespace characteristic data structure of the solid state drive is set to a second preset value, wherein the second preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is a locked state.

[0017] In a possible implementation, the method further includes:

[0018] If it is determined that the solid state drive does not have a security zone, and a security zone setting instruction sent from the host is received, configuring the security zone according to the security zone setting instruction;

[0019] If a key setting or modification instruction is received from the host, the key is set or modified in the security zone according to the key setting or modification instruction;

[0020] Setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a first preset value, wherein the first preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone state is unlocked;

[0021] If a locking instruction is received from the host, the security zone is locked according to the locking instruction, and the security zone is in a locked state;

[0022] The value of the security zone status information of the namespace characteristic data structure of the solid state drive is set to a second preset value, wherein the second preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is a locked state.

[0023] In a possible implementation, after setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a second preset value, the method further includes:

[0024] If an unlock command is received from the host, the unlock command is verified;

[0025] If the unlock instruction meets the preset conditions, the security zone is unlocked according to the unlock instruction, and the security zone is in unlocked state;

[0026] If a key deletion instruction is received from the host, the key of the security zone is deleted according to the key deletion instruction;

[0027] The value of the security zone status information of the namespace characteristic data structure of the solid state drive is set to a third preset value, wherein the third preset value indicates that the solid state drive supports security zone authentication, authentication is not set for the security zone, and the security zone status is unlocked.

[0028] In a possible implementation, it also includes:

[0029] When the security zone of the solid state drive is in an unlocked state, if a security zone setting instruction sent from the host is received, the security zone is set according to the security zone setting instruction;

[0030] Setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a first preset value, wherein the first preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone state is unlocked;

[0031] If a locking instruction is received from the host, the security zone is locked according to the locking instruction, and the security zone is in a locked state;

[0032] The value of the security zone status information of the namespace characteristic data structure of the solid state drive is set to a second preset value, wherein the second preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is a locked state.

[0033] In a possible implementation, if a locking instruction sent from the host is received, a locking operation is performed on the security zone according to the locking instruction, and the security zone is in a locked state, including:

[0034] If a locking instruction is received from the host, the locking instruction is verified;

[0035] If the locking instruction meets the preset conditions, the safety zone is locked according to the locking instruction, and the safety zone is in a locked state.

[0036] In a second aspect, an embodiment of the present application provides a device for authenticating a solid state hard disk security zone, including:

[0037] an authentication module configured to, when the security zone of the solid state drive is in an unlocked state, set or modify the key of the security zone according to the setting or modifying key instruction if a setting or modifying key instruction is received from the host;

[0038] A first status module is configured to set the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a first preset value, wherein the first preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone state is an unlocked state;

[0039] A locking module, configured to lock the security zone according to the locking instruction if a locking instruction is received from the host;

[0040] A second status module is configured to set the value of the security zone status information of the namespace characteristic data structure of the solid-state drive to a second preset value, wherein the second preset value indicates that the solid-state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is a locked state.

[0041] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the steps of the method in any of the above embodiments are implemented.

[0042] In a fourth aspect, an embodiment of the present application provides an electronic device, including a memory and a processor, wherein an executable program is stored in the memory, and the processor executes the executable program to perform the steps of the method of any of the above embodiments.

[0043] The embodiment of the present application provides a method for authenticating a security zone of a solid-state hard disk. By adding setting authentication to the security zone of the solid-state hard disk, when the security zone of the solid-state hard disk is in an unlocked state, if a setting or modifying key instruction sent from a host is received, the key of the security zone is set or modified according to the setting or modifying key instruction; the value of the security zone status information of the namespace characteristic data structure of the solid-state hard disk is set to a first preset value; if a locking instruction sent from the host is received, the security zone is locked according to the locking instruction, and the security zone is in a locked state; the value of the security zone status information of the namespace characteristic data structure of the solid-state hard disk is set to a second preset value. Even if the operation instruction of the security zone of the solid-state hard disk is leaked, the security zone of the solid-state hard disk and the data in the security zone cannot be cleared without authentication, and the data in the security zone of the solid-state hard disk will not be easily destroyed, thereby ensuring the data security of the security zone of the solid-state hard disk and the normal functional use of the security zone. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A flowchart of a method for authenticating a solid state drive security zone provided in an embodiment of the present application;

[0045] Figure 2 A flowchart for verifying an unlock instruction provided in an embodiment of the present application;

[0046] Figure 3 A flowchart of power-on initialization of a solid state drive provided in an embodiment of the present application;

[0047] Figure 4 A flowchart of setting up authentication for the first time on a solid state drive provided in an embodiment of the present application;

[0048] Figure 5 A flowchart of deleting a key in a solid state drive provided in an embodiment of the present application;

[0049] Figure 6 A flowchart of setting a security zone in a solid state drive provided in an embodiment of the present application;

[0050] Figure 7 A flowchart for checking a lock instruction provided in an embodiment of the present application;

[0051] Figure 8 This is a schematic diagram of the structure of the host communicating with the solid state drive in an embodiment of the present application;

[0052] Fig. 9 A schematic diagram of an operation flow of solid state hard disk security zone authentication provided in an embodiment of the present application;

[0053] Fig.10 A schematic diagram of the overall process of a solid state drive firmware provided by an embodiment of the present application;

[0054] Fig.11 A schematic diagram of the structure of a device for authenticating a solid-state hard disk security zone provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] Various aspects and features of the present application are described herein with reference to the accompanying drawings.

[0056] It should be understood that various modifications may be made to the embodiments of the present application. Therefore, the above description should not be considered as limiting, but only as an example of an embodiment. Other modifications within the scope and spirit of the present application will occur to those skilled in the art.

[0057] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present application and, together with the general description of the present application given above and the detailed description of the embodiments given below, serve to explain the principles of the present application.

[0058] These and other characteristics of the present application will become apparent from the following description of a preferred form of embodiment given as a non-limiting example with reference to the accompanying drawings.

[0059] It should also be understood that although the present application has been described with reference to some specific examples, those skilled in the art will be able to readily implement many other equivalent forms of the present application.

[0060] The above and other aspects, features and advantages of the present application will become more apparent in view of the following detailed description when taken in conjunction with the accompanying drawings.

[0061] Specific embodiments of the present application are described hereinafter with reference to the accompanying drawings; however, it should be understood that the embodiments applied for are merely examples of the present application, which may be implemented in a variety of ways. Well-known and / or repeated functions and structures are not described in detail to avoid unnecessary or redundant details that obscure the present application. Therefore, the specific structural and functional details applied for herein are not intended to be limiting, but merely serve as a basis and representative basis for the claims to teach those skilled in the art to use the present application in a variety of ways with substantially any suitable detailed structure.

[0062] This specification may use the phrases "in one embodiment," "in another embodiment," "in yet another embodiment," or "in other embodiments," all of which may refer to one or more of the same or different embodiments according to the present application.

[0063] An embodiment of the present application provides a method for authenticating a security zone of a solid-state hard disk. The execution subject of the method is a solid-state hard disk. The solid-state hard disk communicates with a host, and the solid-state hard disk performs corresponding operations by receiving instructions from the host.

[0064] The host refers to the host system or host controller, which is a computer system that communicates with and controls the operation of storage devices (such as NVMe SSDs). Specifically, the host refers to the device or system that initiates commands and processes data.

[0065] In the embodiment of the present application, the host sends relevant instructions to the solid-state drive, such as security zone instructions and authentication instructions, wherein the authentication instructions may include setting or modifying key instructions, deleting key instructions, locking instructions, unlocking instructions, etc. The security zone instructions may include opening the security zone instructions, setting the security zone invisible instructions, setting the security zone visible instructions, closing the security zone instructions, etc. The host sends instructions to the solid-state drive, and the solid-state drive performs corresponding operations according to the instructions.

[0066] Specifically, the embodiment of the present application implements the code (key) permission-related functions by expanding CDW13 (authority instruction control field) in the security zone command on the host side, that is, adding multiple key permission instructions, and the new instructions include setting / modifying key instructions, deleting key instructions, locking instructions, and unlocking instructions. In the instruction, CDW14 and CDW15 are used as key fields. The combination of the two fields has a total of 64 bits. The encoding method can be customized by the host. If ASCII is used, it is reflected as an 8-bit key. In addition, a new field is added to the Identify Namespace Structure (namespace characteristic data structure) of the solid-state drive to characterize the authentication function of the solid-state drive, including whether the security zone authentication is supported, whether it is locked, and whether it is enabled.

[0067] The embodiment of the present application realizes the authentication function by adding a CDW13 (authority command control field) command control field on the host side and a new characterization field on the Identify Namespace Structure (namespace characteristic data structure) on the solid state drive side, as shown in the following Tables 1, 2 and 3. Among them, Table 1 is a description of the security zone command, Table 2 is an operation instruction description, and Table 3 is a security zone status added to the namespace characteristic data structure.

[0068] The authentication scheme provided in the embodiment of the present application does not interfere with the operation instructions of the original security zone scheme, thereby ensuring the compatibility of the host in the two security zone firmware operations.

[0069] Table 1: Security Zone Command Description

[0070]

[0071]

[0072] Table 2: Operation Instructions

[0073]

[0074]

[0075] Note:

[0076] (1) Through the security zone opcode 0xFC, CDW13 = 0x81, the authentication code can be set and modified. The authentication code consists of CDW14 and CDW15, a total of 64 bits. There is no limit on the number of times the code can be set / modified. The last setting / modification will take effect. After setting, there is no need to perform a reset.

[0077] (2) Through the security zone opcode 0xFC, CDW13 = 0x82, the authentication code can be deleted. This operation can only be performed in the Unlock state. If the SSD is in the Lock state, the command will be aborted.

[0078] (3) Through the security zone opcode 0xFC, CDW13 = 0x83, the hard disk authentication state can be changed to the Lock state. In this state, the hard disk will abort all security zone related commands except [Unlock], including [Open Security Zone], [Set Security Zone Visible], [Set Security Zone Invisible], [Close Security Zone], [Set / Modify Security Zone Code], and [Delete Security Zone Code].

[0079] (4) Through the security zone opcode 0xFC, CDW13 = 0x84, the hard disk authentication state can be changed to the Unlock state. In this state, all security zone related instructions can be executed.

[0080] Typical scenario: If the hard disk has a security zone code set, when the device starts, the BIOS needs to send the [Unlock] command and pass the authentication before it can perform security zone-related operation commands.

[0081] (5) After setting the security zone code, the initial state is Lock each time the power is turned on.

[0082] (6) When the hard disk is in the Unlock state, it can only be restored to the Lock state by powering on and off and using the [Lock] command. Otherwise, the Unlock state should be maintained throughout the entire power cycle.

[0083] (7) Security zone authentication related commands, including [Set / Modify Code], [Delete Security Zone Code], [Lock], and [Unlock], do not affect the status of the hard disk, including security and user zone data, the current status of the security zone, and the size of the security zone setting.

[0084] (8)TCG and ATA-Security commands have higher priority than security zone commands.

[0085] Table 3 Adding security zone status in the Identify Namespace Data Structure

[0086]

[0087]

[0088] Specifically, according to the NVMe 2.0 specification, Byte

[537] is within the Namespace Features (NSFEAT) field. NSFEAT is an 8-byte (64-bit) field, from Byte 536 to 543, used to indicate various features of the namespace. The specific bit allocation is as follows: Byte 536-Byte 543: Namespace Features (NSFEAT) In this range, different bits represent different feature flags. Therefore, Byte

[537] is actually part of the NSFEAT field.

[0089] Due to the difference in the internal code logic of the solid state drive, the existing solid state drives include those that support security zone authentication and those that do not. The method steps of the embodiment of the present application are implemented on a solid state drive that supports security zone authentication.

[0090] See also Fig. 9 As shown, Fig. 9 An operational flow diagram of solid-state drive security zone authentication is provided for an embodiment of the present application. For security zone authentication, the embodiment of the present application is implemented in a new version of the host OKR software. Before the host sends an operation instruction to the solid-state drive, it queries and reads the value of Byte

[537] of the solid-state drive's Identify Namespace Structure (namespace characteristic data structure), determines the state of the solid-state drive by reading the value of Byte

[537] , and sends instructions to the solid-state drive based on the state of the solid-state drive, so that the solid-state drive executes the corresponding operation.

[0091] For example, if the host queries that Byte

[537] =0x00, it is determined that the solid state drive does not support security zone authentication.

[0092] For example, if the host queries that Byte

[537] =0x01, it is determined that the solid state drive supports security zone authentication, the security zone is not set for authentication, and the security zone is in an unlocked state.

[0093] For example, if the host queries that Byte

[537] =0x03, it is determined that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone is in an unlocked state.

[0094] For example, if the host queries Byte

[537] =0x07, it is determined that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone is in a locked state.

[0095] In the embodiment of the present application, the security zone has been set up for authentication, which means that the security zone has been set up for keys.

[0096] If the host queries Byte

[537] =0x00, the original security zone operation mode is adopted;

[0097] If the host finds that Byte

[537] =0x01, the authentication mechanism can be omitted and the security zone can be operated in the traditional way to complete the security zone operation. The authentication mechanism can also be set to perform the authentication operation, which includes setting or modifying the key, setting the value of Byte

[537] to 0x03, and then performing the lock operation. The security zone operation can also be performed, the security zone can be set, and then the lock operation can be performed.

[0098] If the host finds that Byte

[537] =0x07, it needs to send an unlock command to perform the unlock operation. When the SSD is in the unlock state, you can perform authentication operations and security zone operations respectively. The authentication operation includes setting or modifying the key, setting the value of Byte

[537] to 0x03, and then performing the lock operation. You can also delete the key, set the value of Byte

[537] to 0x01, and do not perform the lock operation. For the security zone operation, after the security zone operation is not completed, set the value of Byte

[537] to 0x03, and then perform the lock operation.

[0099] If the host finds that Byte

[537] =0x03, the SSD is in unlocked state, and authentication and security zone operations can be performed respectively. Authentication operations include setting or modifying the key, setting the value of Byte

[537] to 0x03, and then performing a lock operation. You can also delete the key, set the value of Byte

[537] to 0x01, and do not perform a lock operation. For security zone operations, after the security zone operation is not completed, set the value of Byte

[537] to 0x03, and then perform a lock operation.

[0100] The following is a detailed description of the method for authenticating the security zone of the solid state drive provided in an embodiment of the present application in conjunction with the accompanying drawings.

[0101] See also Figure 1 , Figure 1 A flowchart of a method for authenticating a solid state drive security zone provided in an embodiment of the present application, the method comprising the following steps:

[0102] S203: When the security zone of the solid state drive is in an unlocked state, if a setting or modifying key instruction sent from the host is received, the key of the security zone is set or modified according to the setting or modifying key instruction;

[0103] S204: setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a first preset value, wherein the first preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone state is unlocked;

[0104] S205: If a locking instruction is received from the host, the security zone is locked according to the locking instruction, and the security zone is in a locked state;

[0105] S206: Setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a second preset value, wherein the second preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is locked.

[0106] Specifically, the value of the security zone status information in the embodiment of the present application is the value of Byte

[537] .

[0107] The host sends a command to set or modify the key to the solid-state drive. After receiving the command, the solid-state drive executes the setting or modification of the key and sets the value of Byte

[537] of the namespace characteristic data structure of the solid-state drive to the first preset value 0x03, that is, Byte

[537] =0x03, indicating that the solid-state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is unlocked.

[0108] The host sends a lock command to the solid-state drive. After receiving the command, the solid-state drive executes the security zone lock and sets the value of Byte

[537] of the namespace characteristic data structure of the solid-state drive to the second preset value 0x07, that is, Byte

[537] =0x07, indicating that the solid-state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is locked.

[0109] The embodiment of the present application provides a method for authenticating the security zone of a solid-state hard disk, which adds authentication to the security zone of the solid-state hard disk, and the security zone of the solid-state hard disk can only be accessed after authentication. Even if the operation instructions of the security zone of the solid-state hard disk are leaked, the security zone of the solid-state hard disk and the data in the security zone cannot be cleared without authentication, and the data in the security zone of the solid-state hard disk will not be easily destroyed, thereby ensuring the data security of the security zone of the solid-state hard disk and the normal functional use of the security zone.

[0110] In some embodiments, see Figure 2 , Figure 2 A flowchart for verifying an unlock instruction is provided in an embodiment of the present application; before the security area of ​​the solid state drive is in an unlocked state, the method further includes:

[0111] S201: If an unlocking instruction sent from the host is received, verify the unlocking instruction;

[0112] S202: If the unlocking instruction meets the preset condition, the security zone is unlocked according to the unlocking instruction, and the security zone is in an unlocked state.

[0113] Specifically, the unlock instruction is an unlock key. The host sends the unlock key to the SSD. The SSD receives the unlock key and verifies the unlock key, specifically to determine whether the unlock key is consistent with the set key. If the unlock key is consistent with the set key, it is determined that the key is correct, the key verification passes, and the SSD performs the unlock operation on the security zone, and the security zone is in an unlocked state. If the unlock key is inconsistent with the set key, it is determined that the key is incorrect, the SSD does not perform the unlock operation on the security zone, and the SSD sends a command illegal information to the host.

[0114] In some embodiments, see Figure 3 , Figure 3 A flowchart of a solid state hard disk power-on initialization provided in an embodiment of the present application; before the security zone of the solid state hard disk is in an unlocked state, the method further includes:

[0115] S101: Determine whether a security zone exists in the solid state drive;

[0116] S102: If it is determined that the solid state drive has a security zone, setting the security zone to be invisible;

[0117] S103: Locking the security zone, so that the security zone is in a locked state;

[0118] S104: Setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a second preset value, wherein the second preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is locked.

[0119] Specifically, the solid-state drive has been set for authentication. After the solid-state drive is powered on, if it is determined that a security zone exists, the security zone is set to be invisible, the security zone is locked, and the value of Byte

[537] of the namespace characteristic data structure of the solid-state drive is set to a second preset value 0x07, that is, Byte

[537] =0x07, indicating that the solid-state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is locked.

[0120] In some embodiments, see Figure 4 , Figure 4 A flowchart of setting up authentication for the first time on a solid state drive is provided in an embodiment of the present application, and the method further includes:

[0121] S105: If it is determined that the solid state drive does not have a security zone, and a security zone setting instruction sent from the host is received, configuring the security zone according to the security zone setting instruction;

[0122] S106: if a key setting or modification instruction is received from the host, the key is set or modified in the security zone according to the key setting or modification instruction;

[0123] S107: setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a first preset value, wherein the first preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone state is unlocked;

[0124] S108: If a locking instruction is received from the host, the security zone is locked according to the locking instruction, and the security zone is in a locked state;

[0125] S109: Setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a second preset value, wherein the second preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is locked.

[0126] Specifically, this embodiment is a method and steps for setting authentication for the first time for a solid-state drive. If the solid-state drive has not set a security zone, and if the solid-state drive receives a security zone setting instruction sent from the host, the solid-state drive sets the security zone according to the security zone setting instruction. If the solid-state drive receives a key setting or modification instruction sent from the host, the solid-state drive sets or modifies the key according to the instruction, and sets the value of Byte

[537] of the namespace characteristic data structure of the solid-state drive to the first preset value 0x03, that is, Byte

[537] =0x03, indicating that the solid-state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is unlocked.

[0127] If the solid-state drive receives a lock command sent from the host, the solid-state drive performs a lock operation and sets the value of Byte

[537] of the namespace characteristic data structure of the solid-state drive to a second preset value 0x07, that is, Byte

[537] =0x07, indicating that the solid-state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is locked.

[0128] In some embodiments, see Figure 5 , Figure 5 A flowchart of deleting a key in a solid state drive is provided in an embodiment of the present application. After setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a second preset value, the method further includes:

[0129] S301: If an unlocking instruction sent from the host is received, verify the unlocking instruction;

[0130] S302: If the unlocking instruction meets the preset condition, the security zone is unlocked according to the unlocking instruction, and the security zone is in an unlocked state;

[0131] S303: If a key deletion instruction is received from the host, the key of the security zone is deleted according to the key deletion instruction;

[0132] S304: Setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a third preset value, wherein the third preset value indicates that the solid state drive supports security zone authentication, the security zone is not set for authentication, and the security zone status is unlocked.

[0133] Specifically, this embodiment is a step of how to delete authentication after the SSD has been set up for authentication. If the SSD receives an unlock instruction sent from the host, the SSD verifies the unlock instruction, and the unlock instruction is specifically an unlock key. The SSD determines whether the unlock key is consistent with the set key. If the unlock key is consistent with the set key, it is determined that the key is correct, the key verification passes, the SSD performs an unlock operation on the security zone, and the security zone is in an unlocked state. If the unlock key is inconsistent with the set key, it is determined that the key is incorrect, the SSD does not perform an unlock operation on the security zone, and the SSD sends a command illegal information to the host.

[0134] If the solid-state drive receives a key deletion instruction sent from the host, the solid-state drive deletes the key of the security zone according to the key deletion instruction, and sets the value of Byte

[537] of the namespace characteristic data structure of the solid-state drive to the third preset value 0x01, that is, Byte

[537] =0x01, indicating that the solid-state drive supports security zone authentication, the security zone is not set for authentication, and the security zone is in an unlocked state. In this embodiment, after the authentication is deleted, the security zone is not locked. The security zone of the solid-state drive can be set for authentication or not, that is, the security zone of the solid-state drive can be set for keys or not, but if you want to delete the key, the host needs to know the previously set key before it can perform the key deletion operation.

[0135] In some embodiments, see Figure 6 , Figure 6 A flowchart of setting a security zone in a solid state drive is provided in an embodiment of the present application, and the method further includes:

[0136] S401: When the security zone of the solid state drive is in an unlocked state, if a security zone setting instruction sent from a host is received, setting the security zone according to the security zone setting instruction;

[0137] S402: setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a first preset value, wherein the first preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone state is unlocked;

[0138] S403: If a locking instruction is received from the host, the security zone is locked according to the locking instruction, and the security zone is in a locked state;

[0139] S404: Setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a second preset value, wherein the second preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is locked.

[0140] Specifically, when the security zone of the solid-state hard drive is in an unlocked state, if the solid-state hard drive receives a security zone setting instruction sent from the host, the security zone is set according to the security zone setting instruction, and the value of Byte

[537] of the namespace characteristic data structure of the solid-state hard drive is set to the first preset value 0x03, that is, Byte

[537] =0x03, indicating that the solid-state hard drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is unlocked.

[0141] If the solid-state drive receives a lock instruction sent from the host, the solid-state drive locks the security zone according to the lock instruction, and sets the value of Byte

[537] of the namespace characteristic data structure of the solid-state drive to the second preset value 0x07, that is, Byte

[537] =0x07, indicating that the solid-state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is locked.

[0142] Setting the safety zone in the embodiment of the present application may include: turning on the safety zone, setting the size of the safety zone, setting the safety zone invisible, setting the safety zone visible, turning off the safety zone function, etc.

[0143] In some embodiments, see Figure 7 , Figure 7 A flowchart for checking a locking instruction provided in an embodiment of the present application, if a locking instruction sent from a host is received, a locking operation is performed on the security zone according to the locking instruction, and the security zone is in a locked state, including:

[0144] S205a: If a locking instruction sent from the host is received, the locking instruction is verified;

[0145] S205b: If the locking instruction meets the preset condition, the safety zone is locked according to the locking instruction, and the safety zone is in a locked state.

[0146] Specifically, if the solid-state drive receives a locking instruction sent from the host, it verifies the locking instruction, which may be a locking key, and specifically determines whether the locking key is consistent with the set key. If the locking key is consistent with the set key, it is determined that the key is correct, the key verification passes, and the solid-state drive performs a locking operation on the security zone, and the security zone is in a locked state. If the locking key is inconsistent with the set key, it is determined that the key is incorrect, the solid-state drive does not perform a locking operation on the security zone, and the solid-state drive sends a command illegality message to the host.

[0147] Any unlocking or locking step in the embodiment of the present application needs to be verified. Only after the verification is passed, the corresponding operation is performed. If the verification fails, the illegal information is reported to the host. Specifically, the solid-state drive needs to verify the unlocking command and locking command sent from the host, that is, to determine whether its key is consistent with the set key. If they are consistent, it is determined that the key is correct, the key verification passes, and the corresponding operation is performed. If they are inconsistent, it is determined that the key is incorrect, the key verification fails, and the illegal command information is reported to the host.

[0148] See also Fig.10 , Fig.10 A schematic diagram of the overall process of a solid-state drive firmware provided by an embodiment of the present application. Specifically, first, the solid-state drive is powered on and initialized. The solid-state drive is powered on to determine whether the SSD has a security zone. If so, the security zone is set to be invisible, and the security zone is set to a locked state. The solid-state drive is powered on and initialized. The key has been set for the solid-state drive. After the power-on is completed, the solid-state drive is in a locked state.

[0149] If it is determined that there is no security zone on the SSD, the SSD can receive relevant instructions for security zone operations issued by the host, such as the instructions for setting the security zone operation size, setting the security zone status, setting or modifying the key, locking, and unlocking in the dotted box, and perform the corresponding operations.

[0150] If the host wants to perform security zone operations, the host needs to be unlocked before the security zone operations can be performed. If the host issues an unlock command, the SSD needs to verify the unlock command. Only after the verification is passed can the security zone operation be performed to determine whether the security zone is in an unlocked state. If so, it is determined that the security is in an unlocked state, and then the security zone operation command sent by the host can be received. For example, the host issues a command to set the size of the security zone operation, a command to set the status of the security zone, a command to set or modify the key, a lock command, and an unlock command. If not, it is determined that the security zone is in a locked state. If the host receives a command to set the size of the security zone operation, a command to set the status of the security zone, a command to set or modify the key, or a lock command, the SSD will not execute it and report the illegal command information to the host. If the host receives an unlock command, it is necessary to perform a key verification on the unlock command. If the key verification passes, the authentication state operation is set. If the key verification fails, the illegal command information is reported to the host.

[0151] It should be noted that Fig.10 The commands sent by the host in the dotted box are not sent by the host at the same time. The host will not send commands at the same time. The host sends a command to the SSD, and the SSD performs the corresponding operation according to the command.

[0152] Specifically, when the SSD is in the unlocked state, if a lock command or unlock command is received from the host, the SSD verifies the lock command or unlock command, and only performs the corresponding operation after the verification passes. If the verification fails, the command illegality information is reported to the host.

[0153] When the solid-state drive is in unlocked state, if a command for setting the security zone size is received from the host, the solid-state drive executes the operation of setting the security zone size and determines whether setting the security zone size is legal. If it is legal, it configures the security zone space and configures the security zone status. If it is illegal, it reports the illegal command information to the host.

[0154] When the solid-state drive is in an unlocked state, if a command for setting the security zone status is received from the host, the solid-state drive executes an operation for setting the security zone status to determine whether the security zone status is visible. If it is determined that the security zone status is visible, the security zone status is configured to be visible. If it is determined that the security zone status is invisible, the security zone status is configured to be invisible.

[0155] When the solid-state drive is in unlocked state, if a command to set, modify or delete a key is received from the host, the operation of setting, modifying or deleting the key is executed.

[0156] When the SSD is in the locked state, if it receives instructions for setting the security zone size, setting the security zone status, setting or modifying the key, and locking instructions sent from the host, the SSD does not perform the operation and reports an illegal command message to the host.

[0157] When the SSD is in the locked state, if it receives an unlock command sent from the host, the SSD verifies the unlock command and executes the corresponding operation only after the verification passes. If the verification fails, the SSD reports the illegal command information to the host.

[0158] If the SSD security zone does not support authentication, and if the SSD receives a key setting or modification instruction, a key deletion instruction, a security zone lock instruction, and a security zone unlock instruction sent from the host, an illegal command information is reported to the host.

[0159] The details of authentication key management are as follows:

[0160] Design core: Use the machine's unique code to convert the authentication key according to specific rules.

[0161] Unique code source: The unique code source can be the motherboard SN, SSD SN, SSD 8S code. The length is required to be 8 bytes. The fixed 8 bits in the unique code can be intercepted.

[0162] Algorithm: You can use AES algorithm or custom algorithm. AES algorithm such as phthon AES standard library requires encryption KEK for AES algorithm.

[0163] Implementation method: Computer software: specifically, a unique key is generated by scanning a unique code with a barcode scanner; Input method: can be input with a barcode scanner and keyboard, Output method: txt.

[0164] Application scenarios: Regarding production, the production process is customized according to needs. It is necessary to confirm which workstation to add the process and how to transfer the generated key. Regarding after-sales, the tools are distributed to various after-sales service centers and the tools need to be authorized for use.

[0165] Management and control methods: Online activation: The software needs to be logged in to an account online to use; key activation: The software needs to enter an activation code to use. The activation code needs to be applied for. It is recommended that the activation code include the number of uses to limit the number of times users use the tool.

[0166] Based on the same inventive concept, see Fig.11 , Fig.11 A schematic diagram of a structure of a device for authenticating a solid-state hard disk security zone provided in an embodiment of the present application. The embodiment of the present application provides a device for authenticating a solid-state hard disk security zone, the device comprising:

[0167] The authentication module 10 is configured to set or modify the key of the security zone according to the setting or modifying key instruction if a setting or modifying key instruction sent from the host is received when the security zone of the solid state drive is in an unlocked state;

[0168] A first state module 20, configured to set the value of the security zone state information of the namespace characteristic data structure of the solid state drive to a first preset value, wherein the first preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone state is unlocked;

[0169] The locking module 30 is configured to lock the security zone according to the locking instruction if a locking instruction is received from the host;

[0170] The second status module 40 is configured to set the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a second preset value, wherein the second preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is a locked state.

[0171] An embodiment of the present application further provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the steps of the method described above are implemented.

[0172] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein the memory stores an executable program, and the processor executes the executable program to perform the steps of the method described above.

[0173] The above embodiments are only exemplary embodiments of the present application and are not intended to limit the present application. The protection scope of the present application is defined by the claims. Those skilled in the art may make various modifications or equivalent substitutions to the present application within the essence and protection scope of the present application, and such modifications or equivalent substitutions shall also be deemed to fall within the protection scope of the present application.

Claims

1. A method for authenticating a security zone of a solid state drive, characterized in that: include: When the security zone of the solid state drive is in an unlocked state, if a setting or modifying key instruction sent from a host is received, the key of the security zone is set or modified according to the setting or modifying key instruction; Setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a first preset value, wherein the first preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone state is an unlocked state; If a locking instruction sent from the host is received, a locking operation is performed on the security zone according to the locking instruction, and the security zone is in a locked state; The value of the security zone status information of the namespace characteristic data structure of the solid state drive is set to a second preset value, wherein the second preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is a locked state.

2. The method according to claim 1, characterized in that Before the security area of ​​the solid state drive is in an unlocked state, the method further includes: If an unlocking instruction sent from the host is received, verifying the unlocking instruction; If the unlock instruction meets the preset condition, the security zone is unlocked according to the unlock instruction, and the security zone is in an unlocked state.

3. The method according to claim 2, characterized in that Before the security area of ​​the solid state drive is in an unlocked state, the method further includes: Determine whether there is a secure zone on the SSD; If it is determined that the solid state drive has a security zone, setting the security zone to be invisible; Performing a locking operation on the safety zone, so that the safety zone is in a locked state; The value of the security zone status information of the namespace characteristic data structure of the solid state drive is set to a second preset value, wherein the second preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is a locked state.

4. The method according to claim 3, characterized in that The method further comprises: If it is determined that the solid state drive does not have a security zone, and a security zone setting instruction sent from the host is received, configuring the security zone according to the security zone setting instruction; If a key setting or modification instruction is received from the host, the key is set or modified in the security zone according to the key setting or modification instruction; Setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a first preset value, wherein the first preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone state is an unlocked state; If a locking instruction sent from the host is received, a locking operation is performed on the security zone according to the locking instruction, and the security zone is in a locked state; The value of the security zone status information of the namespace characteristic data structure of the solid state drive is set to a second preset value, wherein the second preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is a locked state.

5. The method according to claim 1, characterized in that: After setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a second preset value, the method further includes: If an unlocking instruction sent from the host is received, verifying the unlocking instruction; If the unlock instruction meets the preset condition, the security zone is unlocked according to the unlock instruction, and the security zone is in an unlocked state; If a key deletion instruction sent from the host is received, the key of the security zone is deleted according to the key deletion instruction; The value of the security zone status information of the namespace characteristic data structure of the solid state drive is set to a third preset value, wherein the third preset value indicates that the solid state drive supports security zone authentication, the security zone is not set for authentication, and the security zone status is an unlocked state.

6. The method according to claim 1, characterized in that The method further comprises: When the security zone of the solid state drive is in an unlocked state, if a security zone setting instruction sent from the host is received, setting the security zone according to the security zone setting instruction; Setting the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a first preset value, wherein the first preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone state is an unlocked state; If a locking instruction sent from the host is received, a locking operation is performed on the security zone according to the locking instruction, and the security zone is in a locked state; The value of the security zone status information of the namespace characteristic data structure of the solid state drive is set to a second preset value, wherein the second preset value indicates that the solid state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is a locked state.

7. The method according to claim 1, characterized in that If a locking instruction is received from the host, locking the security zone according to the locking instruction, and the security zone is in a locked state, including: If a locking instruction sent from the host is received, the locking instruction is verified; If the locking instruction meets the preset condition, a locking operation is performed on the safety zone according to the locking instruction, and the safety zone is in a locked state.

8. A device for authenticating a solid state hard disk security zone, characterized in that: include: an authentication module configured to, when the security zone of the solid state drive is in an unlocked state, set or modify the key of the security zone according to the setting or modifying key instruction if a setting or modifying key instruction is received from the host; A first status module is configured to set the value of the security zone status information of the namespace characteristic data structure of the solid state drive to a first preset value, wherein the first preset value indicates that the solid state drive supports security zone authentication, the security zone has been set with authentication, and the security zone state is an unlocked state; a locking module, configured to lock the security zone according to a locking instruction sent from a host if the locking instruction is received; A second status module is configured to set the value of the security zone status information of the namespace characteristic data structure of the solid-state drive to a second preset value, wherein the second preset value indicates that the solid-state drive supports security zone authentication, the security zone has been set for authentication, and the security zone status is a locked state.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. An electronic device, comprising a memory and a processor, wherein an executable program is stored in the memory, and the processor executes the executable program to perform the steps of any one of the methods according to claims 1 to 7.

Images