Encrypted solid state disk mass production method and encrypted solid state disk

Abstract

The invention relates to the technical field of data security, and discloses an encrypted solid state disk mass production method and an encrypted solid state disk. The method comprises the following steps: assembling a security chip in standard solid state disk hardware to obtain encrypted solid state disk hardware; multiplexing a standard solid state disk mass production process, and adding a security chip configuration step in the standard solid state disk mass production process to form an encrypted solid state disk mass production process; and configuring the encrypted solid-state hard disk hardware based on the encrypted solid-state hard disk mass production process to obtain the encrypted solid-state hard disk. By means of the method, the encrypted solid state disk with high safety and reliability can be obtained through mass production, the data transmission and storage safety of the solid state disk is effectively protected, the risk of data leakage is avoided, the mass production process of the encrypted solid state disk is simplified, the mass production efficiency is improved, and the mass production cost is saved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a mass production method of an encrypted solid-state hard drive and an encrypted solid-state hard drive. Background Art

[0002] In today's digital age, important data such as corporate business secrets, user personal privacy information, and sensitive documents of government agencies are often stored on solid-state drives (SSDs). The demand for SSDs has increased dramatically. As the demand for SSD security increases, various security chips have been added to the production process of SSDs, which has put higher requirements on the production efficiency and mass production level of corresponding encrypted SSDs.

[0003] However, existing technologies have long focused on optimizing the mass production process for standard SSDs. Mass-produced SSDs typically only support non-encrypted scenarios and lack the security mechanisms associated with security chip firmware. Security chip firmware management is relatively weak, and there's a lack of experience in mass-producing encrypted SSDs. Furthermore, under traditional mass production methods, forcibly adapting existing processes to mass-produce encrypted SSDs would compromise their security and reliability. Existing methods for producing encrypted SSDs often struggle to balance safety and production efficiency, failing to meet the market's urgent need for efficient, secure, and large-scale SSD production. Summary of the Invention

[0004] The main purpose of the present invention is to provide a mass production method of an encrypted solid-state hard drive and an encrypted solid-state hard drive, aiming to solve the technical problem that encrypted solid-state hard drives are difficult to mass-produce.

[0005] A first aspect of the present invention provides a method for mass-producing encrypted solid-state drives, the method comprising: assembling a security chip in standard solid-state drive hardware to obtain encrypted solid-state drive hardware, wherein the security chip is connected to a main control chip in the standard solid-state drive hardware to encrypt the encrypted solid-state drive;

[0006] Reusing the standard SSD mass production process and adding a security chip configuration step to the standard SSD mass production process to form an encrypted SSD mass production process;

[0007] The encrypted solid-state hard drive hardware is configured based on the encrypted solid-state hard drive mass production process to obtain an encrypted solid-state hard drive.

[0008] Optionally, in a first implementation of the first aspect of the present invention, the encrypted solid-state drive mass production process includes:

[0009] Burning the security chip secondary boot firmware into the security chip;

[0010] Burning the main control chip firmware to the main control chip;

[0011] Burning security chip firmware to the security chip;

[0012] Based on the security chip after burning, an encryption key for the encrypted solid-state drive is generated;

[0013] Persistently storing the encryption key in the security chip and / or the main control chip;

[0014] Initialize the main control chip and the security chip.

[0015] Optionally, in a second implementation of the first aspect of the present invention, the security chip firmware includes a signature value and a signature verification public key;

[0016] After the security chip firmware is burned into the security chip, the method further includes:

[0017] The signature value is verified based on the signature verification public key, and the security chip firmware is started after the verification passes.

[0018] Optionally, in a third implementation of the first aspect of the present invention, before burning the security chip firmware to the security chip, the method further includes:

[0019] Generate the signature value based on a preset encryption algorithm;

[0020] The signature value and the corresponding signature verification public key are encapsulated at the end of the security chip firmware.

[0021] Optionally, in a fourth implementation of the first aspect of the present invention, burning security chip firmware to the security chip includes:

[0022] Based on the non-volatile memory host controller interface specification, the security chip firmware is transmitted to the main control chip in frames by in-band downloading, so that the main control chip forwards the security chip firmware to the security chip frame by frame.

[0023] Optionally, in a fifth implementation of the first aspect of the present invention, before transmitting the security chip firmware to the main control chip in frames by using in-band download based on the non-volatile memory host controller interface specification, so that the main control chip forwards the security chip firmware frame by frame to the security chip, the method further includes:

[0024] Detecting whether the current state of the security chip is the BOOT state;

[0025] If the security chip is in the BOOT state, the security chip firmware is allowed to be transmitted to the main control chip by in-band download based on the non-volatile memory host controller interface specification;

[0026] If the security chip is not in the BOOT state, the security chip is set to return to the BOOT state to allow the security chip firmware to be transmitted to the main control chip by in-band download based on the non-volatile memory host controller interface specification.

[0027] Optionally, in a sixth implementation of the first aspect of the present invention, based on the non-volatile memory host controller interface specification, the security chip firmware is transmitted to the main control chip in frames using in-band download, so that the main control chip forwards the security chip firmware to the security chip frame by frame, including:

[0028] Based on a non-volatile memory host controller interface tool, the firmware data of the security chip firmware is read frame by frame to the main control chip, so that the main control chip forwards the firmware data to the security chip frame by frame, wherein the non-volatile memory host controller interface tool adopts an in-band download method;

[0029] After each frame of the firmware data is sent, determining whether all the firmware data of the security chip firmware is sent;

[0030] If all the firmware data have been sent, restarting the security chip;

[0031] If there is still firmware data that has not been sent, read the firmware data of the next frame.

[0032] Optionally, in a fifth implementation of the first aspect of the present invention, the encryption key includes a signature verification public-private key pair and a key encryption key, the signature verification public-private key pair is persistently stored in the security chip, and the key encryption key is persistently stored in the main control chip;

[0033] After generating an encryption key for the encrypted solid-state drive based on the security chip after the burning is completed, the method includes:

[0034] Export the public key of the signature verification public-private key pair to the server;

[0035] Receiving a preset key sent by the server, where the preset key is obtained by encrypting the key to be preset input into the server with the public key;

[0036] authenticating an authorized entity of the server based on the preset key;

[0037] The authenticating the authorized entity of the server based on the preset key includes:

[0038] Based on the preset key, a U-shield is used to authenticate the administrator role of the server.

[0039] Optionally, in a sixth implementation of the first aspect of the present invention, authenticating the authorized entity of the server based on the pre-set key includes:

[0040] Based on the preset key, a U-shield is used to authenticate the administrator role of the server.

[0041] Optionally, in a seventh implementation manner of the first aspect of the present invention, the encryption key includes a key encryption key, and the key encryption key is persistently stored in the main control chip.

[0042] Optionally, in an eighth implementation of the first aspect of the present invention, initializing the main control chip and the security chip includes:

[0043] Restoring the factory settings of the main control chip and clearing the key data and cache data temporarily stored in the main control chip;

[0044] Reset the security chip to erase the key data and cache data temporarily stored in the security chip.

[0045] A second aspect of the present invention further provides an encrypted solid-state drive, which is obtained by processing standard solid-state drive hardware based on the encrypted solid-state drive mass production method as described above.

[0046] The embodiment of the present invention provides a method for mass-producing an encrypted solid-state hard drive and an encrypted solid-state hard drive. By assembling a security chip in standard solid-state hard drive hardware and reusing the standard solid-state hard drive mass production process, a new security chip configuration step is added to the process to form a unique encrypted solid-state hard drive mass production process. The encrypted solid-state hard drive hardware is configured through the encrypted solid-state hard drive mass production process to obtain an encrypted solid-state hard drive. Through the steps of the above method, the present invention can mass-produce highly secure and reliable encrypted solid-state hard drives, so that the data of the solid-state hard drive is effectively protected during transmission and storage, avoiding the risk of data leakage. The reuse of the standard solid-state hard drive mass production process also simplifies the encrypted solid-state hard drive mass production process, improves mass production efficiency, and saves mass production costs. In addition, the encrypted solid-state hard drive mass production method also has high compatibility and scalability, and can adapt to different types of solid-state hard drives and security chips to meet encryption requirements in different scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1A schematic diagram of a flow chart of an embodiment of a method for mass-producing encrypted solid-state hard drives according to an embodiment of the present invention;

[0048] Figure 2 for Figure 1 A schematic diagram of a process flow of an embodiment of a mass production process of encrypted solid-state hard drives in an embodiment;

[0049] Figure 3 for Figure 2 A schematic diagram of the security chip firmware in an embodiment;

[0050] Figure 4 for Figure 2 A flowchart of an embodiment of burning security chip firmware into a security chip in an embodiment. DETAILED DESCRIPTION

[0051] The terms "first," "second," "third," "fourth," and the like (if any) in the description and claims of the present invention and in the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to these processes, methods, products, or apparatus.

[0052] For ease of understanding, the following describes the specific process of the method for mass production of encrypted solid-state hard drives in an embodiment of the present invention. Figure 1 , Figure 1 This is a flow chart of a first embodiment of a method for mass-producing encrypted solid-state hard drives according to an embodiment of the present invention. In this embodiment, the method for mass-producing encrypted solid-state hard drives includes:

[0053] 101. Assemble a security chip in standard solid-state drive hardware to obtain encrypted solid-state drive hardware, wherein the security chip is connected to a main control chip in the standard solid-state drive hardware to encrypt the encrypted solid-state drive;

[0054] In this embodiment, the security chip (Trusted Platform Module, TPM) is a hardware component that has passed national security certification and can independently generate keys and perform encryption and decryption. It usually has an independent processor and storage unit inside, which can store keys and feature data. The selection of the security chip needs to be comprehensively considered according to the specific application scenario, technical requirements and cost budget. In actual operation, the performance of different models of security chips in terms of security, compatibility, performance, cost and supplier support can be compared to finally select the most suitable security chip. For example, the security chip in this embodiment can use the N32S032 encryption chip of National Technology. The security chip has a high degree of security and stability, can effectively prevent data from being illegally accessed and tampered, and can better protect the encrypted solid-state hard drive.

[0055] In this optional embodiment, the security chip generally supports multiple security algorithms, such as national commercial ciphers SM1, SM2, SM3, and SM4, as well as one or more mainstream international encryption algorithms such as DES (Data Encryption Standard), AES (Advanced Encryption Standard), and RSA (Rivest Shamir Adleman, an asymmetric encryption algorithm). This security chip can be used to encrypt the solid-state drive, ensuring the security of data during transmission and storage through the corresponding keys and encryption algorithms. In addition, the security chip can also provide security functions such as digital signatures and identity authentication to further enhance the overall security of the solid-state drive. At the same time, the security chip can also support one or more communication protocols such as UART (Universal Asynchronous Receiver / Transmitter), SPI (Serial Peripheral Interface) and I2C (Inter-Integrated Circuit), and usually adopts different communication protocols when the security chip is in different states. For example, the download port of the aforementioned N32S032 encryption chip is a function multiplexing port. UART is used for data transmission before patch processing, and I2C port is used for data transmission after patch processing.

[0056] In this embodiment, the standard solid-state drive refers to a traditional solid-state drive that has not undergone security encryption processing. Its hardware structure usually includes components such as a storage chip, a main control chip, and an interface circuit. Among them, the main control chip is responsible for core functions such as data read and write control, garbage collection and wear leveling, and communicates data with an external server. This application assembles a security chip in the standard solid-state drive hardware so that the security chip can establish a communication connection with the main control chip, such as through a specific interface or bus. This connection allows the security chip to encrypt and decrypt data on the main control chip and establish data and instruction interaction with the main control chip. After assembling the security chip into the standard solid-state drive hardware, the corresponding encrypted solid-state drive hardware can be obtained. The encrypted solid-state drive hardware is different from the standard solid-state drive hardware. It not only has the storage function of a traditional solid-state drive, but also integrates the security mechanism of the security chip, thereby greatly improving the security and reliability of the data.

[0057] In this embodiment, it is important to understand that the assembly of the security chip is not simply a matter of installing it into standard SSD hardware. Instead, it requires a complex series of configuration and debugging tasks. For example, configuration must be performed according to the corresponding communication protocol, the peripheral circuit design of the security chip must be adjusted according to the parameters and functions of the security chip and the main control chip, and firmware programming must be performed based on specific hardware support. This is to better integrate the security chip with the standard SSD hardware and ensure the security and stability of data during transmission and storage. Furthermore, the assembly of the security chip must also take into account its impact on the overall performance of the SSD, such as read and write speeds and power consumption, to ensure that the basic performance of the SSD is not sacrificed while improving security.

[0058] 102. Reuse the standard SSD mass production process and add a security chip configuration step to the standard SSD mass production process to form an encrypted SSD mass production process;

[0059] In this embodiment, the standard solid-state drive mass production process is a standardized process for mass production of standard solid-state drives, which usually includes multiple steps such as firmware burning, performance testing and formatting of the main control chip. The present application reuses the standard solid-state drive mass production process and adds a security chip configuration step thereto to form an encrypted solid-state drive mass production process. Specifically, in the encrypted solid-state drive mass production process formed, in addition to burning and configuring the firmware of the standard solid-state drive, the firmware of the security chip also needs to be specifically configured and burned. This adaptation process ensures that the security chip can correctly communicate with the main control chip and perform its encryption, decryption and security authentication functions. At the same time, during the adaptation process, the firmware version, configuration parameters, etc. of the security chip also need to be strictly checked and tested to ensure its compatibility and stability with the standard solid-state drive hardware, thereby avoiding any compatibility issues or safety hazards in the subsequent mass production process. In addition, during the adaptation process, it is necessary to fully consider the dependency between the configuration steps of the security chip and the main control chip. For example, since different communication protocols are usually used when the security chip is in different states, it is necessary to consider the adaptation processing under different communication protocols, that is, part of the firmware may need to be burned via a certain communication protocol, and the other part of the firmware may need to be burned via another communication protocol.

[0060] Optional, see Figure 2 In one embodiment, the encrypted solid-state drive mass production process includes:

[0061] 1021. Burn the security chip secondary boot firmware to the security chip;

[0062] 1022. Burn the main control chip firmware to the main control chip;

[0063] 1023. Burn the security chip firmware to the security chip;

[0064] 1024. Generate an encryption key for encrypting the solid-state drive based on the security chip after the burning is completed, and store the encryption key persistently in the security chip and / or the main control chip;

[0065] 1025. Initialize the main control chip and the security chip.

[0066] In this optional embodiment, when burning different firmware into the security chip, different communication protocols are typically required for data transmission. For example, in chips such as the N32S032 security chip, the UART protocol is typically used for data transmission when burning the security chip's secondary boot firmware, while the I2C protocol is required for data transmission when burning the security chip firmware. However, since the security chip's download port is a multiplexed port, it functions as a UART port before downloading and an I2C port after downloading. Once the security chip is mounted on the solid-state drive, it can only function as an I2C port. Therefore, the secondary boot firmware must be downloaded before mass production. Only after the mounting and main control chip firmware are burned can the complete security chip firmware be burned into the security chip via the I2C port. Therefore, the steps of the above-mentioned encrypted solid-state drive mass production process are dependent on each other and cannot be interchanged. The security chip's secondary boot firmware, main control chip firmware, and security chip firmware must be burned into the encrypted solid-state drive hardware in sequence to ensure that the main control chip and security chip can function properly.

[0067] In this optional embodiment, the security chip's secondary bootloader is the core component for starting and initializing the security chip. When the security chip is powered on or reset, it is responsible for performing a series of initialization operations, such as configuring the clock system, initializing memory space, setting interrupt services, and preparing the firmware loading environment. This allows the download port function to be switched from UART to I2C after the security chip is mounted, enabling stable communication with the main control chip. At the same time, the security chip's secondary bootloader also has the function of firmware loading, responsible for reading the security chip's main firmware from the non-volatile memory and loading it into the working memory. During this process, the secondary bootloader performs necessary checks and verifications to ensure the integrity and authenticity of the main firmware. Only the main firmware that passes the verification is allowed to execute, effectively preventing malicious code or damaged firmware from damaging the security chip.

[0068] In this optional embodiment, the main control chip firmware and the security chip firmware are the core underlying software programs running the main control chip and security chip, respectively. The main control chip firmware not only manages and coordinates the operation of the SSD's internal hardware resources, but also carries out important functions such as communication with the server, processing data read and write requests, garbage collection, and wear leveling. By closely collaborating with the security chip, it implements encrypted data storage and access control, ensuring the data security of the SSD. The security chip firmware is the foundation for the security chip's functionality, encompassing key functions such as security algorithm implementation, key management, and the establishment of secure communication protocols. This enables the security chip to manage encryption key generation, storage, updates, and destruction throughout its lifecycle, ensuring key security and availability. Furthermore, the security chip firmware provides the protocol basis and interaction logic for establishing secure communication between the security chip and the main control chip, enabling encrypted data transmission and access control. In the mass production process of encrypted SSDs, the correctness and security of both the main control chip firmware and the security chip firmware are directly related to the SSD's performance and data security. Therefore, during the mass production process, these two firmwares need to be rigorously tested and verified to ensure that they meet the design requirements and have good stability and security.

[0069] In this optional embodiment, after the burning of the security chip is completed, the security chip can generate various encryption keys, such as one or more of the key encryption keys (Key Encryption Key, KEK), signature verification public and private keys, and other data encryption keys or identity authentication keys. These encryption keys are the key to ensuring the security of the solid-state drive data and can be used to achieve different encryption and security protection requirements for encrypted solid-state drives. These encryption keys will be persistently stored in the security chip and / or the main control chip, such as persistently stored in non-volatile memories such as Nand flash memory or EEPROM (Electrically Erasable Programmable read only memory), to ensure that the encryption keys will not be lost after the solid-state drive loses power or restarts, thereby continuously providing data encryption and security protection for the solid-state drive.

[0070] In this optional embodiment, after the firmware is burned and the keys are pre-set, the main control chip and security chip need to be initialized. This initialization is crucial to ensuring the proper functioning of the main control chip and security chip. It involves resetting and clearing the chips, as well as configuring parameters such as operating modes, parameter settings, and memory allocation. This initialization allows the main control chip and security chip to enter their intended operating states, providing a solid foundation for subsequent operations such as data reading and writing, encryption, and decryption.

[0071] Optionally, in one embodiment, the security chip firmware includes a signature value and a signature verification public key; after the security chip firmware is burned into the security chip, the method further includes: verifying the signature value based on the signature verification public key, and starting the security chip firmware after the verification passes.

[0072] In this optional embodiment, the signature value refers to the data generated by the security chip firmware after compilation is completed and processed by a specific algorithm. This data is closely related to the security chip firmware and can uniquely identify the version and content of the security chip firmware. Before the security chip firmware is burned into the security chip, the security chip firmware is usually signed to generate a corresponding signature value. The signature processing process usually adopts asymmetric encryption algorithms such as the SM2 algorithm and the RSA algorithm. Among them, SM2, as one of the national secret algorithms, is more in line with the demands of domestic financial or government application scenarios and is more suitable for use in these application scenarios. In the firmware generated by the security chip firmware, the developer of the security chip firmware will use his own private key and use these algorithms to sign the security chip firmware to generate a signature value.

[0073] In this optional embodiment, after the security chip firmware is burned into the security chip, the signature value can be verified using the public key provided by the developer, i.e., the verification public key. The verification process is the reverse process of signing, and the integrity and authenticity of the security chip firmware can be verified through verification to ensure that the security chip firmware has not been tampered with or damaged during transmission and storage. If the verification passes, it means that the security chip firmware is complete and authentic, and the security chip firmware can be started to start executing the corresponding security functions. If the verification fails, it usually means that there is a problem with the security chip firmware during transmission or storage, or that the security chip firmware is not provided by a legitimate developer. In this case, the security chip firmware will be refused to start, and a warning or error message may be issued to avoid potential security risks. This signing and verification mechanism can ensure the security and credibility of the security chip firmware, and further protect the data security of the encrypted solid-state drive.

[0074] Optional, see Figure 3 Schematic diagram, in one embodiment, before burning the security chip firmware to the security chip, it also includes: generating a signature value based on a preset encryption algorithm; and encapsulating the signature value and the corresponding signature verification public key at the end of the security chip firmware.

[0075] In this optional embodiment, the preset encryption algorithm can specifically be an asymmetric encryption algorithm such as the aforementioned SM2 algorithm, RSA algorithm, etc., which will not be described in detail here. The signature value and the verification public key are encapsulated at the end of the security chip firmware to ensure that during the burning process, the signature value and the verification public key can be correctly written into the security chip together with the security chip firmware. This encapsulation method not only simplifies the firmware burning process, but also facilitates the direct reading of the signature value and the verification public key encapsulated at the end of the firmware from the security chip in the subsequent verification operation without the need for additional storage or transmission steps. At the same time, encapsulating the signature value and the verification public key at the end of the firmware can also prevent them from being accidentally deleted or tampered with, thereby further enhancing the security and credibility of the security chip firmware. After the encapsulation is completed, the security chip firmware with the signature value and the verification public key can be burned into the security chip for subsequent verification and startup operations.

[0076] Optionally, in one embodiment, burning the security chip firmware to the security chip includes: based on the non-volatile memory host controller interface specification, using in-band download to transmit the security chip firmware in frames to the main control chip, so that the main control chip forwards the security chip firmware to the security chip frame by frame.

[0077] In this optional embodiment, the Non-Volatile Memory Express (NVMe) host controller interface specification is a high-performance storage interface specification that defines a communication protocol between a host and a storage device, aiming to improve the read and write speed and response time of the storage device. In-band download is a method for downloading and updating firmware through the data channel of the storage device. It does not require an additional physical interface or channel, thereby simplifying the firmware update process and reducing hardware costs. At the same time, it can also form a double backup with out-of-band download to ensure the reliability and security of the firmware update. In this embodiment, in-band download is used to transmit the security chip firmware in frames to the main control chip via the NVMe interface. After receiving each frame of firmware data, the main control chip forwards it to the security chip, which receives and stores it. This frame transmission method can ensure the integrity and correctness of the firmware data, and also helps to improve the speed and efficiency of the firmware update. During the firmware transmission and update process, the firmware data can also be strictly checked and verified to ensure that it meets the design requirements and has good stability and security.

[0078] Optional, see Figure 4 In one embodiment, before transmitting the security chip firmware to the main control chip in frames by in-band download based on the non-volatile memory host controller interface specification, so that the main control chip forwards the security chip firmware to the security chip frame by frame, the method further includes:

[0079] (1) Check whether the current state of the security chip is BOOT state;

[0080] (2) If the security chip is in the BOOT state, it is allowed to transfer the security chip firmware to the main control chip using in-band download based on the non-volatile memory host controller interface specification;

[0081] (3) If the security chip is not in the BOOT state, the security chip is set to return to the BOOT state to allow the security chip firmware to be transmitted to the main control chip by in-band download based on the non-volatile memory host controller interface specification.

[0082] Based on the non-volatile memory host controller interface specification, the security chip firmware is transmitted to the main control chip in frames using in-band download. The main control chip then forwards the security chip firmware frame by frame to the security chip, including:

[0083] (4) Reading the firmware data of the security chip firmware frame by frame to the main control chip based on the non-volatile memory host controller interface tool, so that the main control chip forwards the firmware data frame by frame to the security chip, wherein the non-volatile memory host controller interface tool adopts an in-band download method;

[0084] (5) After each frame of firmware data is sent, determine whether all firmware data of the security chip firmware has been sent;

[0085] (6) If all firmware data has been sent, the security chip is restarted;

[0086] (7) If there is still firmware data that has not been sent, read the firmware data of the next frame.

[0087] In this optional embodiment, during the frame-by-frame processing, it is first checked whether the security chip status is in the BOOT state. The BOOT state refers to a state in which the security chip can receive firmware data after completing the download of the secondary boot firmware and completing the switching of the interface function. If the security chip status is in the BOOT state, it means that the security chip has completed the loading of the secondary boot firmware and is in a state of waiting to receive firmware data. At this time, a corresponding non-volatile memory host controller interface tool based on in-band download, such as NVMe-CLI, can be used to read a frame of security chip firmware and send it to the main control chip, which is then forwarded to the security chip by the main control chip, thereby realizing frame-by-frame transmission of firmware data. If the security chip status is not in the BOOT state, the security chip can be set to return to the BOOT state through a reset operation or a power restart operation, and then the corresponding frame-by-frame transmission can be performed.

[0088] In this optional embodiment, after each frame of firmware data is sent, a determination is made as to whether all firmware data of the security chip firmware has been sent to ensure data integrity and correctness. If any firmware data of the security chip firmware has not yet been sent, the next frame of firmware data is read and sent frame by frame until all firmware data has been sent. If all firmware data of the security chip firmware has been sent, the security chip can be rebooted (rebooted) to enable the security chip to begin executing the newly burned firmware. After the security chip reboots, the encrypted solid-state drive will reinitialize the internal state of the security chip based on the newly burned security chip firmware, configure relevant security parameters, and activate the security chip's encryption, decryption, and security authentication functions to ensure the security chip operates correctly and performs its security protection function. During this reboot process, the aforementioned signature verification step can be used, i.e., the signature value is verified based on the signature verification public key. After the signature verification passes, the security chip firmware is activated to further enhance the security and reliability of the encrypted solid-state drive. In addition, after the security chip reboots, a series of performance tests and verifications can be performed on the security chip to ensure that it meets design requirements and has good stability and security, thereby providing users with a more reliable and secure storage solution.

[0089] Optionally, in one embodiment, the encryption key includes a signature and verification public and private key pair, which are persistently stored in a security chip; based on the security chip after burning, after generating an encryption key for encrypting the solid-state drive, it includes: exporting the public key of the signature and verification public and private key pair to the server; receiving a preset key issued by the server, the preset key is obtained by encrypting the key to be preset input into the server by the public key; and authenticating the authorized entity of the server based on the preset key.

[0090] In this optional embodiment, the signature and verification public-private key pair is a crucial key pair used in encrypted SSDs to implement data signing and verification. The private key is used to sign data, while the public key is used to verify the signature, ensuring data integrity and authenticity. During the mass production of encrypted SSDs, the signature and verification public-private key pair will be persistently stored in the security chip to ensure its security and reliability.

[0091] In this optional embodiment, after the security chip is burned and configured, the public key in the signature verification public-private key pair is exported to a server. This server can be the encrypted SSD's management server or another server that interacts with the encrypted SSD. After exporting the public key, the server can use it to encrypt the input key to be provisioned, obtaining the provisioned key. The server then sends the provisioned key to the encrypted SSD for subsequent use. After receiving the provisioned key, the encrypted SSD can decrypt the provisioned key using the private key stored in the security chip, obtaining the original provisioned key. The encrypted SSD can then authenticate the server's authorized entity based on the provisioned key. This authentication process can involve the encrypted SSD sending a request containing authentication information to the server. Upon receiving the request, the server verifies the authentication information using the provisioned key. The server's authorized entity refers to a user, process, or service that is authorized to access and operate the server. If authentication succeeds, the server's authorized entity is legitimate and authorized, and the encrypted SSD can then interact with it for subsequent data and operations. This authentication mechanism, based on signature verification of public-private key pairs and pre-set keys, further enhances the security and reliability of communication between the encrypted SSD and the server, preventing unauthorized access and manipulation, and protecting the data stored on the SSD. Furthermore, this authentication mechanism complies with modern information security requirements, improving the overall security of encrypted SSDs and providing a more flexible and scalable authorization management approach for encrypted SSDs, adapting them to diverse application scenarios and security requirements.

[0092] Optionally, in one embodiment, authenticating the authorized entity of the server based on the preset key includes: using a USB shield to authenticate the administrator role of the server based on the preset key.

[0093] In this optional embodiment, a USB key is a smart password key that is typically used to store a user's digital certificate and provide hardware-level encryption protection to ensure the user's identity and transaction security when conducting online transactions or logging into sensitive systems. In this embodiment, the USB key is used to identify the server administrator role, further improving the accuracy and security of authentication. The server administrator role refers to a user or process with permission to manage and configure the server. This user or process is used to perform key initialization and reset operations.

[0094] In this optional embodiment, when using the U-Shield to authenticate the administrator role of the server, the administrator role of the server will first be required to insert the U-Shield and enter the corresponding password. Then the digital certificate stored in the U-Shield is read, and the digital certificate is verified using the preset key. If the verification passes, it means that the U-Shield is legal and authorized, and the administrator role of the server is also authentic and trustworthy. At this time, the administrator role of the server can be allowed to perform corresponding management and configuration operations on the encrypted solid-state hard drive. This U-Shield-based identification method not only improves the accuracy and security of authentication, but also helps prevent malicious attacks and unauthorized access, and further protects the security of data stored in the encrypted solid-state hard drive. At the same time, as a mature hardware encryption technology, the U-Shield has good compatibility and ease of use, and can be easily integrated into the existing encrypted solid-state hard drive management system to provide users with a more convenient and secure storage solution.

[0095] Optionally, in one embodiment, the encryption key further includes a key encryption key, and the key encryption key is persistently stored in the main control chip.

[0096] In this optional embodiment, the key encryption key is an important key used to encrypt other data stored in the encrypted SSD. It typically has higher security requirements and is therefore persistently stored in the main control chip to ensure it is not easily accessed or tampered with. As the core control component of the encrypted SSD, the main control chip is responsible for data read and write operations as well as encryption and decryption functions. Storing the key encryption key in the main control chip allows it to be closely integrated with data read and write operations and encryption and decryption, thereby improving the security of the entire encrypted SSD. Furthermore, the main control chip typically also has high security protection capabilities, such as anti-tampering and anti-attack, which further enhances the security and reliability of the key encryption key. During the mass production of encrypted SSDs, it is necessary to ensure the randomness and unpredictability of the key encryption key to prevent it from being cracked or attacked. Furthermore, strict access control and permission management are required to ensure that only authorized users or processes can access and use it. This key encryption key-based security protection mechanism can further enhance the data security of encrypted SSDs, providing users with a more reliable and secure storage solution.

[0097] Optionally, in one embodiment, initializing the main control chip and the security chip includes: restoring the factory settings of the main control chip, clearing the key data and cache data temporarily stored in the main control chip; resetting the security chip, erasing the key data and cache data temporarily stored in the security chip.

[0098] In this optional embodiment, the initialization process for the main control chip and security chip is intended to ensure that the encrypted solid-state chip is in a clean and secure state after leaving the factory, providing a reliable foundation for data reading, writing, encryption, and decryption operations. The main control chip is initialized by restoring factory settings using a new hard drive to clear temporary key data and cached data that may have been stored during the production process, preventing this data from interfering with subsequent data reading, writing, and encryption and decryption operations or posing a security risk. The security chip, on the other hand, is reset to erase its temporarily stored key data and cached data, ensuring its safety and reliability after leaving the factory.

[0099] In this optional embodiment, since the mass production process is mainly used for some pre-delivery verifications that need to be done when solid-state hard drives are shipped in batches from the factory, special attention needs to be paid to the security and integrity of the data when initializing the main control chip and the security chip. Restoring the factory settings of the main control chip and clearing the temporarily stored key data and cache data can effectively prevent the leakage of sensitive information and ensure that the main control chip can correctly perform data reading and writing and encryption and decryption functions in subsequent operations. At the same time, resetting the security chip and erasing the temporarily stored key data and cache data inside it are also important steps to ensure the security and reliability of the security chip. This initialization processing method can not only ensure the security and stability of the encrypted solid-state hard drive after leaving the factory, but also provide users with a more reliable and secure storage solution. After completing the initialization process, the encrypted solid-state hard drive can enter the mass production process, carry out subsequent testing, verification and packaging operations, and finally be delivered to users for use.

[0100] 103. Configure the encrypted solid state drive hardware based on the encrypted solid state drive mass production process to obtain an encrypted solid state drive.

[0101] In this embodiment, after establishing a mass production process for encrypted SSDs suitable for mass production through the aforementioned steps, the encrypted SSD hardware can be configured accordingly based on this process. The configuration method can be found in the description of each step in the process in step 102, and this application will not elaborate on this further. Configuring the encrypted SSD hardware through this mass production process ensures that the encrypted SSD can correctly perform all functions and operations during mass production. Configuration may include the firmware version of the security chip, encryption algorithm selection, key generation and management, and other aspects. Once configured, the encrypted SSD will have the required security and reliability to meet user needs. Furthermore, during the mass production process, the encrypted SSD can undergo a series of tests and verifications to ensure that it meets design requirements and exhibits good stability and performance. These tests and verifications may include read and write speed tests, encryption and decryption performance tests, and security certification tests. These tests and verifications further ensure the quality and reliability of the encrypted SSD.

[0102] Through the steps of the above-mentioned method for mass-producing encrypted SSDs, this embodiment of the present invention can mass-produce highly secure and reliable encrypted SSDs, effectively protecting the SSD data during transmission and storage, thereby avoiding the risk of data leakage. The reuse of the standard SSD mass-production process also simplifies the encrypted SSD mass-production process, improving production efficiency and saving production costs. Furthermore, the method for mass-producing encrypted SSDs is highly compatible and scalable, adapting to different types of SSDs and security chips. For example, the method can adapt and adjust to SSDs with different interface specifications (such as SATA, PCIe, etc.) and security chips from different manufacturers and models to ensure that they can correctly perform various functions and operations. This compatibility and scalability give the method for mass-producing encrypted SSDs a wider range of applications and more flexible application methods, meeting the needs of different users and application scenarios.

[0103] To execute the corresponding steps in the above method embodiment and each possible implementation method, the present invention also provides an encrypted solid-state drive, which is obtained by processing standard solid-state drive hardware based on the above encrypted solid-state drive mass production method.

[0104] In this embodiment, the encrypted solid-state drive is a specific computer-readable and writable storage medium. Different from a standard solid-state drive, the encrypted solid-state drive is obtained based on the above-mentioned encrypted solid-state drive mass production method and has higher security and reliability. Its internal main control chip and security chip are strictly initialized and configured to ensure that functions such as data reading and writing, encryption and decryption, and security authentication can be performed correctly and securely. At the same time, the encrypted solid-state drive also adopts advanced encryption technology and key management mechanism to effectively protect the data stored therein to prevent data leakage and illegal access. The solid-state drive can specifically be one of the types of solid-state drives such as SATA solid-state drives, PCIe solid-state drives, or M.2 solid-state drives. These different types of solid-state drives have different interface specifications and performance characteristics, but they can all be mass-produced and configured through the encrypted solid-state drive mass production method provided by the present invention, so that the corresponding encrypted solid-state drive has higher security and reliability.

[0105] In this embodiment, when a user uses the encrypted SSD, they cannot directly read or write data after inserting it into a server. Instead, they must authenticate and set a key before unlocking and allowing access. This can be done, for example, by entering a preset password or key, or by using a key-based authentication method such as facial recognition or fingerprint recognition. Once authentication is successful, the server unlocks the encrypted SSD, allowing the user to read and write data to it. The encrypted SSD and the server implement a mutual security verification mechanism. The encrypted SSD verifies the server using a preset key stored in the encrypted SSD, while the server verifies the encrypted SSD using a public key or digital certificate provided by the encrypted SSD. This mutual security verification mechanism ensures that only authorized servers and encrypted SSDs can interact with each other, further improving data security and reliability. The encrypted SSD is well-suited for data-sensitive applications, such as finance and government, ensuring data is not easily leaked and protected from malicious attacks or unauthorized access. This effectively maintains data confidentiality and integrity, providing a reliable data storage solution for various fields and industries.

[0106] Since the embodiment of the encrypted solid-state hard drive portion corresponds to the embodiment of the above-mentioned method, please refer to the above-mentioned method embodiment for the introduction of the encrypted solid-state hard drive provided by the embodiment of the present invention. The embodiment of the present invention will not be repeated here, and it has the same beneficial effects as the above-mentioned encrypted solid-state hard drive mass production method.

[0107] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for mass production of encrypted solid-state hard drives, characterized in that: include: Assembling a security chip in standard solid-state drive hardware to obtain encrypted solid-state drive hardware, wherein the security chip is connected to the main control chip in the standard solid-state drive hardware to encrypt the encrypted solid-state drive; Reusing the standard SSD mass production process and adding a security chip configuration step to the standard SSD mass production process to form an encrypted SSD mass production process; The encrypted solid-state hard drive hardware is configured based on the encrypted solid-state hard drive mass production process to obtain an encrypted solid-state hard drive.

2. The method for mass-producing encrypted solid-state hard drives according to claim 1, wherein: The encrypted solid-state drive mass production process includes: Burning the security chip secondary boot firmware into the security chip; Burning the main control chip firmware to the main control chip; Burning security chip firmware to the security chip; Based on the security chip after burning, an encryption key for the encrypted solid-state drive is generated; Persistently storing the encryption key in the security chip and / or the main control chip; Initialize the main control chip and the security chip.

3. The method for mass-producing encrypted solid-state hard drives according to claim 2, wherein: The security chip firmware includes a signature value and a signature verification public key; After the security chip firmware is burned into the security chip, the method further includes: The signature value is verified based on the signature verification public key, and the security chip firmware is started after the verification passes.

4. The method for mass-producing encrypted solid-state hard drives according to claim 3, wherein: Before burning the security chip firmware to the security chip, the method further includes: Generate the signature value based on a preset encryption algorithm; The signature value and the corresponding signature verification public key are encapsulated at the end of the security chip firmware.

5. The method for mass-producing encrypted solid-state hard drives according to claim 2, wherein: The step of burning the security chip firmware to the security chip includes: Based on the non-volatile memory host controller interface specification, the security chip firmware is transmitted to the main control chip in frames by in-band downloading, so that the main control chip forwards the security chip firmware to the security chip frame by frame.

6. The method for mass-producing encrypted solid-state hard drives according to claim 5, wherein: Before transmitting the security chip firmware to the main control chip in frames by in-band download based on the non-volatile memory host controller interface specification, so that the main control chip forwards the security chip firmware to the security chip frame by frame, the method further includes: Detecting whether the current state of the security chip is the BOOT state; If the security chip is in the BOOT state, the security chip firmware is allowed to be transmitted to the main control chip by in-band download based on the non-volatile memory host controller interface specification; If the security chip is not in the BOOT state, the security chip is set to return to the BOOT state to allow the security chip firmware to be transmitted to the main control chip by in-band download based on the non-volatile memory host controller interface specification.

7. The method for mass-producing encrypted solid-state hard drives according to claim 5, wherein: The method of transmitting the security chip firmware to the main control chip in frames by using in-band download based on the non-volatile memory host controller interface specification, so that the main control chip forwards the security chip firmware to the security chip frame by frame, includes: Based on a non-volatile memory host controller interface tool, the firmware data of the security chip firmware is read frame by frame to the main control chip, so that the main control chip forwards the firmware data to the security chip frame by frame, wherein the non-volatile memory host controller interface tool adopts an in-band download method; After each frame of the firmware data is sent, determining whether all the firmware data of the security chip firmware is sent; If all the firmware data have been sent, restarting the security chip; If there is still firmware data that has not been sent, read the firmware data of the next frame.

8. The method for mass-producing encrypted solid-state hard drives according to claim 2, wherein: The encryption key includes a signature verification public-private key pair and a key encryption key, the signature verification public-private key pair is persistently stored in the security chip, and the key encryption key is persistently stored in the main control chip; After generating an encryption key for the encrypted solid-state drive based on the security chip after the burning is completed, the method includes: Export the public key of the signature verification public-private key pair to the server; Receiving a preset key sent by the server, where the preset key is obtained by encrypting the key to be preset input into the server with the public key; authenticating an authorized entity of the server based on the preset key; The authenticating the authorized entity of the server based on the preset key includes: Based on the preset key, a U-shield is used to authenticate the administrator role of the server.

9. The method for mass-producing encrypted solid-state hard drives according to claim 2, wherein: The initializing the main control chip and the security chip includes: Restoring the factory settings of the main control chip and clearing the key data and cache data temporarily stored in the main control chip; Reset the security chip to erase the key data and cache data temporarily stored in the security chip.

10. An encrypted solid-state hard drive, characterized in that: The encrypted solid-state drive is obtained by processing standard solid-state drive hardware based on the encrypted solid-state drive mass production method according to any one of claims 1 to 9.

Images