A hard disk data protection and secure transmission system

Abstract

The present invention relates to the field of data security, and in particular to a hard disk data protection and secure transmission system. The system comprises a Bluetooth module, a hard disk, and a storage channel security encryption chip. The storage channel security encryption chip wirelessly communicates with mobile phone application software via the Bluetooth module to perform identity authentication, unlocking hard disk access rights and releasing sensitive data based on the authentication result. The storage channel security encryption chip is connected between a host and a hard disk to implement data encryption and decryption transmission and partition control on the hard disk. The hard disk is divided into a public area, a private area, and a hidden area. The public area stores open resources in plain text, the private area stores personal data in ciphertext, and the hidden area stores sensitive data in ciphertext. Sensitive data is accessed through a dedicated tool using a private protocol. The present invention implements hard disk data access control, hierarchical management, virus protection, and secure transmission functions, solving the problem of data leakage caused by lost or stolen storage devices.

Description

Technical Field

[0001] The present invention relates to the technical field of computer storage and data security, and in particular to a hard disk data protection and secure transmission system based on a hard disk encryption chip. Background Art

[0002] With the rapid growth of data storage demand and the increasing frequency of data breaches, hard drive data security has become a core issue in the computer storage sector. Traditional hard drive data protection technologies rely primarily on software encryption, operating system permission control, or password authentication mechanisms. However, these methods have significant flaws and, when it comes to secure data transmission, make it difficult to trace the source of data and ensure its secure circulation.

[0003] For example, existing technologies often use operating system-based software encryption solutions, whose security relies on the integrity of the host driver and the security of the system environment. These solutions are vulnerable to attacks by malicious programs (such as ransomware viruses like EternalBlue and Panda Burning Incense) and suffer from poor driver compatibility and difficulty adapting across platforms. Furthermore, software encryption keys are easily stolen through memory sniffing or man-in-the-middle attacks, making them vulnerable to interception of communication links. Conventional hard drives typically employ a single encryption strategy, failing to differentiate between public, private, and sensitive data. If a storage device is lost or stolen, attackers can access all data by cracking a single encryption layer, leading to the leakage of private and sensitive information. Existing hard drive antivirus technologies primarily rely on real-time scanning or sandbox isolation, but their proactive defense against hidden malicious code (such as macro viruses or script Trojans disguised as normal files) is insufficient. Traditional file systems (such as NTFS, FAT, and EXT4) use standard commands, making them susceptible to hijacking or exploitation by malicious programs, leading to data tampering or ransomware. When data is transmitted across devices, traditional methods lack end-to-end hardware-level encryption protection, suffer from lax key management, and make it impossible to trace the data's origin. For example, in public cloud storage or shared transmission scenarios, plaintext or weakly encrypted data can be easily intercepted or tampered with.

[0004] To address these issues, existing technologies attempt to improve security through hardware security modules (HSMs) or trusted computing technologies. However, these technologies still suffer from the following shortcomings: the tight coupling of hardware encryption chips and storage controllers leads to resource allocation conflicts, making it difficult to achieve multi-level security isolation. The lack of wireless authentication mechanisms for mobile devices prevents system driver dependencies and cross-platform compatibility. Furthermore, the inadequate design of active antivirus mechanisms and proprietary transmission protocols for stored data makes it difficult to block the spread and execution of malicious code. Therefore, a comprehensive solution integrating hardware encryption, hierarchical storage management, active antivirus protection, and secure transmission is urgently needed to address data security challenges in complex environments. Summary of the Invention

[0005] In response to the shortcomings of the existing technology, the present invention provides a hard disk data protection and secure transmission system to achieve access control, hierarchical management, virus protection and secure data transmission of the hard disk. It aims to solve the problem of data leakage caused by the loss of storage devices and to resist ransomware viruses such as EternalBlue and Panda Burning Incense, as well as malicious programs such as worms and Trojans based on data encryption mechanisms, and to achieve secure data transmission.

[0006] To solve the above technical problems, the present invention adopts a technical solution: a hard disk data protection and secure transmission system, comprising a Bluetooth module, a hard disk, and a storage channel security encryption chip. The storage channel security encryption chip wirelessly communicates with the mobile phone application software through the Bluetooth module to perform identity authentication, and unlocks the hard disk access rights and releases sensitive data based on the identity authentication result. The storage channel security encryption chip is connected between the host and the hard disk to realize data encryption and decryption transmission and partition control of the hard disk.

[0007] The storage channel security encryption chip divides the hard disk into a public area, a private area, and a hidden area according to the settings of the mobile phone application software. The public area stores open resources in plain text; the private area stores personal data in ciphertext, and personal data must be accessed after identity authentication through the mobile phone application software; the hidden area stores sensitive data in ciphertext, which is invisible in the file system and is accessed through dedicated tools using a private protocol; the dedicated tools include the FatFS file system, virus scanning components, and isolation sandboxes. The FatFS file system calls a private instruction protocol stack to implement the creation, enumeration, reading, modification, and deletion of sensitive data files in the hidden area. The isolation sandbox is used to temporarily store data written to the hidden area. The virus scanning component is used to scan the temporarily stored data for viruses. After the virus scan passes, the written data is written to the hidden area using a private instruction protocol stack.

[0008] Secure transmission of data in the hidden area is achieved through the storage channel security encryption chip and special tools. The storage channel security encryption chip provides cryptographic calculation services, and the special tools are responsible for calling interfaces and managing files. Through the hard encryption module and digital envelope mechanism of the storage channel security encryption chip, the special tools reconstruct the file structure, generate authentication information and key information based on the identification mark set by the user, encrypt and decrypt the file content, and ensure the security of sensitive data during transmission.

[0009] Furthermore, the secure transmission of data in the hidden area is based on digital envelope technology. Each transmitted file includes a file header and a file body. The file header records the functional data of the file body, including the file protection key authentication identifier, version information, signature certificate, the valid length and format of the file to be transmitted, and the file header signature value. The file body includes a valid encrypted data block and a padded encrypted data block.

[0010] Furthermore, the encryption process of the transmitted file data is as follows:

[0011] S11. The data sender sends the identification identifier F to the storage channel security encryption chip through a dedicated tool. The storage channel security encryption chip generates a file protection key authentication identifier K based on the identification identifier F.

[0012] S12. The storage channel security encryption chip derives a key based on the version information and the identification identifier F to obtain a file protection key Mkey, which is used to encrypt the file body.

[0013] S13. The storage channel security encryption chip concatenates the file protection key authentication identifier K, version information, signature certificate, and the valid length and format of the file. It then signs the concatenation result using the signature private key corresponding to the signature certificate to obtain a file header signature value. The file header signature value, together with the file protection key authentication identifier K, version information, signature certificate, and the valid length and format of the file, constitutes the file header. A dedicated tool is used to obtain the file header.

[0014] S14. The dedicated tool splits the file into predefined groups and sends the split files to the storage channel security encryption chip. The storage channel security encryption chip performs loopback encryption on the split files to generate ciphertext and pads the files according to the predefined groups to obtain valid encrypted data blocks and padded encrypted data blocks. The dedicated tool then assembles the encrypted file body and file header to obtain a digital envelope file that can be transmitted.

[0015] S15. Call the interface used in the transmission file data encryption process, and send the digital envelope file to the storage channel security encryption chip through the private instruction protocol stack. The storage channel security encryption chip then sends the digital envelope file to the hidden area of ​​the hard disk.

[0016] Furthermore, the decryption process of the transmitted file data is as follows:

[0017] S21. The data recipient obtains the digital envelope file, splits it into a file header and a file body, and sends the file header to the storage channel security encryption chip through a dedicated tool;

[0018] S22. The storage channel security encryption chip parses the signature certificate, obtains the signature public key, and verifies the signature of the file header to verify the legitimacy of the file header.

[0019] S23. If the file header is valid, the storage channel security encryption chip generates a file protection key authentication identifier K1 based on the identification identifier F1 input by the data recipient, and compares K1 with the K in the file header to see if they are consistent. If they are consistent, it proves that the permissions are correct;

[0020] S24, the storage channel security encryption chip derives a key based on the version information and the identification mark F1 input by the recipient to obtain the file confidentiality file protection key Mkey ’ , Mkey ’Used to decrypt the file body;

[0021] S25. The dedicated tool performs loopback decryption on the file according to the set grouping to obtain the plaintext, and obtains the actual file according to the effective length and format of the file.

[0022] Furthermore, the process of identity authentication by the storage channel security encryption chip through wireless communication between the Bluetooth module and the mobile phone application software is as follows: the Bluetooth module establishes point-to-point communication with the mobile phone application software, transmits authentication data through challenge and response, and the storage channel security encryption chip parses the authentication data transmitted by the Bluetooth module. If the data is legal, the identity authentication is successful, otherwise the identity authentication fails.

[0023] Furthermore, the key of the privacy zone is imported from the outside, and a key backup and key recovery mechanism is designed to recover the data in the privacy zone; the hard disk protection key is derived based on the identity authentication data, and the hard disk protection key encrypts the privacy zone key and stores it.

[0024] Furthermore, the key of the hidden area is randomly generated by the storage channel security encryption chip and does not have a key recovery mechanism. The root key of the hidden area key is generated by the characteristic metadata solidified by the storage channel security encryption chip through a derivation operation, and the root key is used to protect the hidden area key.

[0025] Furthermore, the hard disk is a SATA interface hard disk, including a SATA solid state drive, a SATA mechanical hard disk, an M.2 interface, and an MSATA interface hard disk.

[0026] Furthermore, the storage channel security encryption chip is connected between the host and the hard disk in the form of a SATA bridge, realizing a data channel from the host to the hard disk.

[0027] Furthermore, the host accesses the public area and the privacy area through the SATA standard protocol, and the host accesses the hidden area through the customized SATA private instruction protocol stack.

[0028] Beneficial effects of the present invention: The present invention constructs a hard disk data protection and secure transmission system by integrating the storage channel security encryption chip HX0168, a Bluetooth module, a SATA interface hard disk and special tools. The core of the system is to divide the hard disk into a public area, a private area and a hidden area, and combine a multi-level security mechanism (such as digital envelope technology, a private command protocol) with dynamic authentication (Bluetooth challenge-response) to achieve hierarchical management and control of data: the public area is transparently accessed, the private area has the feature of offline authorization, and is authenticated by the mobile phone; the hidden area is only accessible to special tools through a private protocol, and the key is randomly generated by the chip and cannot be exported or restored. The special tool effectively blocks the self-starting and propagation of ransomware viruses such as EternalBlue and malicious scripts through the FatFS file system, isolation sandbox, dynamic virus scanning component and private command protocol stack, and uses digital envelope technology to ensure secure data transmission. This design is compatible with a variety of SATA storage devices, and resists data leakage and attacks in all links from storage, access to transmission. It is suitable for government affairs, finance and other fields with high security requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a block diagram of the hard disk data protection and secure transmission system;

[0030] Figure 2 It is a logical architecture diagram of hard disk data protection and secure transmission design;

[0031] Figure 3 This is a schematic diagram of the privacy zone isolation sandbox;

[0032] Figure 4 It is a schematic diagram of the digital envelope file structure;

[0033] Figure 5 It is a flow chart of encryption of transmitted file data;

[0034] Figure 6 It is a flow chart of decryption of transmitted file data. DETAILED DESCRIPTION

[0035] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0036] Example 1

[0037] This embodiment discloses a hard disk data protection and secure transmission system. Figure 1As shown, it includes a Bluetooth module, a SATA hard drive, and a storage channel security encryption chip. The storage channel security encryption chip is the HX0168 from Shandong Huayi Microelectronics Technology Co., Ltd. SATA hard drives, including SATA solid-state drives, SATA mechanical hard drives, M.2 interfaces, and MSATA interfaces, are used to store data. Their data content and access rights are controlled by the HX0168. During operation, the Bluetooth module serves as the authentication medium, the SATA hard drive serves as the data storage medium, and the HX0168 serves as the security management core.

[0038] The Bluetooth module has an SPI (UART) interface and connects to the corresponding interface on the HX0168. The HX0168 uses the Bluetooth module to wirelessly communicate with the mobile phone application for identity authentication. Specifically, the Bluetooth module and the mobile phone application establish point-to-point communication, transmitting authentication data through a challenge-response method. The HX0168 parses the authentication data transmitted by the Bluetooth module. If the data is legitimate, authentication is successful. Based on the authentication result, the HX0168 controls the mounting of the hard drive's hidden area.

[0039] The HX0168 chip manages data security, acting as a SATA bridge between the host and SATA hard drives. It facilitates data transmission between the host and the SATA hard drive, implements data encryption and decryption, and manages partition control. It also provides the necessary computing power for specialized tools required for secure data transmission. The HX0168 supports hard drive access control technology, digital envelope technology, a Bluetooth driver interface, an SKF / SDF interface, a standard command stack, and a private command stack. Access control technology manages hard drive partitions within the SATA storage module; digital envelope technology encapsulates files for secure transmission; the Bluetooth driver interface communicates with the Bluetooth module to obtain and verify authentication data for mobile applications; the SKF / SDF interface provides cryptographic computing services; the standard command stack uses standard ATA / SCSI commands for reading and writing data in the public and private areas of the hard drive; and the private command stack uses proprietary (custom) ATA / SCSI commands for reading and writing data in the hidden area.

[0040] The HX0168 divides the SATA storage module into three types: public, private, and hidden areas. The public area stores open resources such as operating system components, system tools, and public data in plaintext. This data requires no encryption or access control. The host accesses the public area using the standard SATA protocol, and the HX0168 transmits the public area data transparently. The private area stores personal data in encrypted form. The host accesses the private area using the SATA standard. Loading is controlled by authentication information sent by the mobile application (authentication is required before content can be loaded and accessed). The HX0168 uses the Bluetooth module to obtain and verify this authentication information, actively loading or unloading the private area to the host, and implementing access control for the private area. The hidden area stores sensitive data, which is not only stored in encrypted form but also requires specialized tools using a proprietary protocol to read and write, and also requires specialized tools to decrypt the sensitive data. This design protects against ransomware viruses that use data encryption mechanisms, such as EternalBlue and Panda Burning Incense, and prevents the automatic launch of malicious programs such as worms and Trojans.

[0041] In this embodiment, the private zone key is imported externally, enabling key backup and recovery mechanisms to be designed for recovering data in the hidden zone. Furthermore, a hard disk protection key is derived based on identity authentication data. This encrypted private zone key is stored to protect the private zone key, preventing it from being cracked through sniffing or chip discarding. The hidden zone key is randomly generated internally, with its root key derived from the characteristic metadata stored in the HX0168 chip through a derivation operation. This root key protects the encryption key for the file's hidden zone, making it impossible to recover data and ensuring the security of sensitive data.

[0042] Special tools are used to manage sensitive data in hidden areas and to securely transmit data in private areas through digital envelope technology, which relies on host hardware and software resources, such as Figure 2As shown, the dedicated tool consists of a FatFS file system, a virus scanning component, and an isolated sandbox. The dedicated tool is installed in the host and communicates with the HX0168 through the host's driver-free interface. The host's driver-free interface communicates with the HX0168 chip using two protocols: a standard protocol and a proprietary protocol. The standard protocol is used to read and write data in the public and private areas; the proprietary protocol is used to read and write data in the hidden area and supports digital envelope technology and the SKF / SDF cryptographic interface. The HX0168 is the security management core, providing hard drive access control, a Bluetooth driver interface, digital envelope technology, an SKF / SDF cryptographic interface, a standard command protocol stack, and a proprietary command protocol stack. The Bluetooth driver interface and Bluetooth module support hard drive access control technology for controlling loading and access to the private area. The SKF / SDF cryptographic interface supports digital envelope technology for secure data transmission. The HX0168 communicates with SATA hard drives using both standard and proprietary protocols. The standard protocol is used to access the public and private areas, while the proprietary protocol is used to access the hidden area. In this embodiment, the standard protocol is the SATA standard command protocol stack, and the proprietary protocol is a custom SATA proprietary command protocol stack.

[0043] The FatFS file system calls a private instruction protocol stack to implement functions such as creation, enumeration, reading, modification, and deletion of sensitive data files in the hidden area, and manages the hidden area partition and hidden area file system. The isolated sandbox is the host's memory space, which is used to temporarily store data written to the hidden area. After passing the virus scan, the private instruction protocol stack is converted to a standard protocol stack, and the data is stored in the hidden area through the SATA interface. Figure 3 As shown, the virus scanning component is loaded by a dedicated tool. This professional tool uses dynamic loading to call an external antivirus plug-in, identifying and scanning written data in real time to filter out malicious programs / scripts. Because the hidden area uses a private instruction protocol stack to read data, data loading is controlled by the dedicated tool, so executable files / scripts cannot start automatically.

[0044] The HX0168 chip and dedicated tools jointly ensure secure data transmission. The HX0168 chip provides cryptographic operation services, while the dedicated tools are responsible for calling interfaces and managing files.

[0045] Secure transmission is based on digital envelope technology, such as Figure 4As shown, each transferred file consists of two parts: a file header and a file body. The file header records the descriptive information and cryptographic resources of the transferred file, including: a file protection key authentication identifier generated based on user-configured authentication information, version information, the sender's signature certificate, the file's valid length and format, and the file header signature value. The file protection key authentication identifier is calculated from the user-entered identification identifier and key derivation is performed based on the user-configured authentication information to obtain the digital envelope file body key. The version information indicates the algorithm protocol used for key derivation, providing greater flexibility and security. The signature certificate is derived from the cryptographic resources built into the sender's HX0168 chip and matched with its internal private signature key. It is used to verify the file header and generate the signature value. The file's valid length and format indicate the actual valid data length in the file body, and the file format indicates the actual file format. The file body is divided into a valid encrypted data block and a padded encrypted data block. The valid encrypted data block length corresponds to the valid file length in the file header, and the padded encrypted data block is used to supplement the packet calculation length.

[0046] like Figure 5 As shown in the figure, the encryption process of transmitted file data is as follows:

[0047] S11. The data sender (encryptor) sends the identification F to the storage channel security encryption chip through a dedicated tool. The HX0168 chip generates a file protection key authentication identifier based on the identification F through hash calculation (such as the SM3 algorithm). The file protection key authentication identifier is used to authenticate the identity of the decryptor.

[0048] The S12 and HX0168 chips perform key derivation (hash calculation or symmetric encryption algorithm) based on the version information and identification identifier F to obtain the file protection key Mkey, which is used to encrypt the file body.

[0049] S13. The HX0168 chip concatenates the file protection key authentication identifier K, version information, signature certificate, and the file's valid length and format. It then signs the concatenation result using the signature private key corresponding to the signature certificate to obtain the file header signature value. The file header signature value, along with the file protection key authentication identifier K, version information, signature certificate, and the file's valid length and format, constitutes the file header. A dedicated tool retrieves the file header. During this process, the signature private key and file protection key Mkey operate only within the HX0168 chip and cannot be obtained by dedicated tools. The signature value is used to ensure the integrity of the header file; the signature certificate in the file header corresponds to the sender's signature private key. Extracting the signature public key from the signature certificate can be used to verify the file header signature value.

[0050] S14. A dedicated tool splits the file into 128KB blocks and sends the blocks to the HX0168 chip. The HX0168 performs loopback encryption on the split files to generate ciphertext. The encryption algorithm can use a symmetric algorithm such as SM4 / AES in non-feedback (non-chained) mode (e.g., ECB, CTR, XTS). Padding is performed on the 128KB blocks to obtain valid encrypted data blocks and padded encrypted data blocks. The dedicated tool then assembles the encrypted file body and file header to produce a digital envelope file ready for transmission.

[0051] S15. Call the SKF / SDF interface used in the transmission file data encryption process, send the digital envelope file to the HX0168 chip through the private instruction protocol stack, and the HX0168 chip then sends the digital envelope file to the hidden area of ​​the hard disk.

[0052] The decryption process of the transmitted file data is the inverse process of the encryption process of the transmitted file data. Figure 6 As shown, the decryption process of the transmitted file data is:

[0053] S21. The data receiver (decryptor) obtains the digital envelope file, splits it into a file header and a file body, and sends the file header to the HX0168 chip through a dedicated tool.

[0054] The S22 and HX0168 chips parse the signature certificate, obtain the signature public key, and verify the signature of the file header to verify the legitimacy of the file header.

[0055] S23. If the file header is legal, the HX0168 chip generates a file protection key authentication identifier K1 based on the identification identifier F1 input by the data recipient, and compares K1 with the K in the file header to see if they are consistent. If they are consistent, it proves that the permissions are correct.

[0056] S24 and HX0168 chips derive the key based on the version information and the identification mark F1 input by the recipient to obtain the file confidentiality file protection key Mkey ’ , Mkey ’ Used to decrypt the file body. In this process, the key Mkey is protected ’ Only works inside the HX0168 chip.

[0057] S25. The dedicated tool performs loopback decryption on the file in 128KB blocks to obtain the plaintext, and obtains the actual file based on the effective length and format of the file.

[0058] This invention utilizes the hardware and software collaborative design of the HX0168 storage channel security encryption chip to implement hard drive data access control, hierarchical management, virus protection, and secure transmission. It aims to address data leakage issues caused by lost or stolen storage devices and effectively defend against attacks from malicious programs such as ransomware, worms, and Trojans. This invention is suitable for scenarios requiring high security, such as personal privacy protection, sensitive enterprise data management, and storage of confidential government documents.

[0059] The above description is only the basic principle and preferred embodiments of the present invention. Improvements and substitutions made by those skilled in the art based on the present invention fall within the protection scope of the present invention.

Claims

1. A hard disk data protection and secure transmission system, characterized by: It includes a Bluetooth module, a hard drive, and a storage channel security encryption chip. The storage channel security encryption chip uses the Bluetooth module to wirelessly communicate with the mobile phone application software for identity authentication. Based on the identity authentication results, it unlocks the hard drive access rights and releases sensitive data. The storage channel security encryption chip is connected between the host and the hard disk to realize the hard disk data encryption and decryption transmission and partition control; The storage channel security encryption chip divides the hard disk into a public area, a private area, and a hidden area according to the settings of the mobile phone application software. The public area stores open resources in plain text; the private area stores personal data in cipher text, and personal data must be accessed after identity authentication through the mobile phone application software; the hidden area stores sensitive data in cipher text, which is invisible in the file system and is accessed through dedicated tools using a private protocol; the dedicated tools include the FatFS file system, virus scanning components, and isolation sandboxes. The FatFS file system calls a private instruction protocol stack to implement the creation, enumeration, reading, modification, and deletion of sensitive data files in the hidden area. The isolation sandbox is used to temporarily store data written to the hidden area. The virus scanning component is used to scan the temporarily stored data for viruses. After the virus scan passes, the written data is written to the hidden area through the private instruction protocol stack. Secure data transmission in the hidden area is achieved through a storage channel security encryption chip and dedicated tools. The storage channel security encryption chip provides cryptographic operation services, while the dedicated tools are responsible for calling interfaces and managing files. Through the hard encryption module and digital envelope mechanism of the storage channel security encryption chip, dedicated tools reconstruct the file structure, generate authentication information and key information based on the identification mark set by the user, encrypt and decrypt the file content, and ensure the security of sensitive data during transmission. The secure transmission of data in the hidden area is based on digital envelope technology. Each transmitted file includes a file header and a file body. The file header records the functional data of the file body, including the file protection key authentication mark, version information, signature certificate, the valid length and format of the file to be transmitted, and the file header signature value. The file body includes the valid encrypted data block and the padded encrypted data block. The encryption process of transmitted file data is as follows: S11. The data sender sends the identification identifier F to the storage channel security encryption chip through a dedicated tool. The storage channel security encryption chip generates a file protection key authentication identifier K based on the identification identifier F. S12. The storage channel security encryption chip derives a key based on the version information and the identification identifier F to obtain a file protection key Mkey, which is used to encrypt the file body. S13. The storage channel security encryption chip concatenates the file protection key authentication identifier K, version information, signature certificate, and the valid length and format of the file. It then signs the concatenation result using the signature private key corresponding to the signature certificate to obtain a file header signature value. The file header signature value, together with the file protection key authentication identifier K, version information, signature certificate, and the valid length and format of the file, constitutes the file header. A dedicated tool is used to obtain the file header. S14. The dedicated tool splits the file into predefined groups and sends the split files to the storage channel security encryption chip. The storage channel security encryption chip performs loopback encryption on the split files to generate ciphertext and pads the files according to the predefined groups to obtain valid encrypted data blocks and padded encrypted data blocks. The dedicated tool then assembles the encrypted file body and file header to obtain a digital envelope file that can be transmitted. S15. Calling the interface used in the file transmission data encryption process, sending the digital envelope file to the storage channel security encryption chip through the private instruction protocol stack, and the storage channel security encryption chip then sending the digital envelope file to the hidden area of ​​the hard disk; The decryption process of the transferred file data is as follows: S21. The data recipient obtains the digital envelope file, splits it into a file header and a file body, and sends the file header to the storage channel security encryption chip through a dedicated tool; S22. The storage channel security encryption chip parses the signature certificate, obtains the signature public key, and verifies the signature of the file header to verify the legitimacy of the file header. S23. If the file header is valid, the storage channel security encryption chip generates a file protection key authentication identifier K1 based on the identification identifier F1 input by the data recipient, and compares K1 with the K in the file header to see if they are consistent. If they are consistent, it proves that the permissions are correct; S24. The storage channel security encryption chip derives a key based on the version information and the identification identifier F1 input by the recipient to obtain a file confidentiality file protection key Mkey', which is used to decrypt the file body. S25. The dedicated tool performs loopback decryption on the file according to the set grouping to obtain the plaintext, and obtains the actual file according to the effective length and format of the file.

2. The hard disk data protection and secure transmission system according to claim 1, wherein: The process of identity authentication by the storage channel security encryption chip through wireless communication between the Bluetooth module and the mobile phone application software is as follows: the Bluetooth module establishes point-to-point communication with the mobile phone application software, transmits authentication data through challenge and response, and the storage channel security encryption chip parses the authentication data transmitted by the Bluetooth module. If the data is legal, the identity authentication is successful, otherwise the identity authentication fails.

3. The hard disk data protection and secure transmission system according to claim 1, wherein: The privacy zone key is imported from the outside, and a key backup and key recovery mechanism is designed to recover the privacy zone data. The hard disk protection key is derived based on the identity authentication data, and the hard disk protection key encrypts the privacy zone key and stores it.

4. The hard disk data protection and secure transmission system according to claim 1, wherein: The hidden area key is randomly generated by the storage channel security encryption chip and does not have a key recovery mechanism. The root key of the hidden area key is generated by the characteristic metadata solidified by the storage channel security encryption chip through a derivation operation. The root key is used to protect the hidden area key.

5. The hard disk data protection and secure transmission system according to claim 1, wherein: The hard drive is a SATA interface hard drive, including SATA solid-state drive, SATA mechanical hard drive, M.2 interface, and MSATA interface hard drive.

6. The hard disk data protection and secure transmission system according to claim 5, characterized in that: The storage channel security encryption chip is connected between the host and the hard disk in the form of a SATA bridge to realize the data channel from the host to the hard disk.

7. The hard disk data protection and secure transmission system according to claim 6, characterized in that: The host accesses the public area and the privacy area through the SATA standard protocol, and accesses the hidden area through the custom SATA private instruction protocol stack.

Images