SSD health query system based on data read-write security

Abstract

The invention discloses an SSD (Solid State Disk) health query system based on data read-write security, which realizes security isolation during query through dynamic read-write permission configuration, and effectively avoids performance bottleneck and security blind area caused by traditional static permission management. An environment fingerprint binding technology is adopted to ensure strong relevance between health data and a hardware state, and the defect that a data source cannot be verified in a traditional method is overcome; the chain encryption and self-verification design improves the anti-attack ability of the data transmission process, and breaks through the limitation that a conventional encryption scheme is easily tampered by a man-in-the-middle; an intelligent state recovery mechanism is combined with progressive strategy rollback and physical layer interference, so that the data residual risk is eliminated while the operation integrity is ensured; according to the overall scheme, a multi-dimensional protection system is constructed through process-level innovation, full-life-cycle safety protection of SSD health query is achieved on the premise of not depending on hardware transformation, and the reliability and the anti-risk capacity of the system are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of SSD technology, and in particular to an SSD health query system based on data reading and writing security. Background Art

[0002] With the rapid development of solid-state drive (SSD) technology, its storage density, read / write speed, and reliability have significantly improved, making it widely used in key areas such as data centers and industrial control. Modern SSDs generally integrate health monitoring functions, which use SMART (Self-Monitoring, Analysis, and Reporting Technology) parameters to provide real-time feedback on key indicators such as storage unit lifespan and bad block rate, providing early warning support for data security. However, existing health query systems are overly focused on functional implementation in their design, and have serious flaws in protecting the security of data reading and writing processes: Traditional solutions typically employ static permission management strategies, either directly suspending all write operations or granting full data read access during health queries. This leads to two extreme risks: the former can cause data loss or storage unit damage due to forced interruption of write tasks (QLC flash memory is particularly sensitive to interruptions), while the latter can expose health parameters to unauthorized access. More seriously, health data transmission relies solely on simple encryption algorithms (such as AES-CBC) and lacks a binding mechanism to the physical state of the hardware. Attackers can forge health status through replay attacks, man-in-the-middle tampering, and other means, misleading storage system decisions (for example, delaying the replacement of a failing storage block).

[0003] Furthermore, existing technologies are overly crude in their post-query state recovery. Most solutions directly restore original read and write permissions without effectively cleaning residual data (such as temporary health parameters in the cache), allowing attackers to exploit this window of opportunity to extract sensitive information. Experiments have shown that physical probing can recover partially erased health data from NAND blocks, allowing reverse engineering of core logic such as the SSD's wear-leveling algorithm.

[0004] In summary, the existing SSD health monitoring function has the problem of low security. Therefore, there is an urgent need for a new SSD health query system that can provide better data security protection while ensuring the real-time query function. Summary of the Invention

[0005] In order to overcome the above-mentioned shortcomings, the present invention aims to provide a technical solution to the above-mentioned problems by providing an SSD health query system based on data reading and writing security.

[0006] To achieve the above object, the present invention provides the following technical solutions: An SSD health query system based on data read and write security includes the following steps: S100: Security verification phase: When receiving a health query request, the composite authentication protocol is initiated to verify the matching of the request source digital certificate and the device physical feature code; Detect the current read and write status of the SSD and establish a safe operating environment, dynamically configuring a temporary read-only access policy; S200: Health data acquisition phase: extracting the original health parameter set in batches under a controlled access policy, and generating a dynamic environment fingerprint synchronously when extracting each batch; Perform multi-layer data encapsulation on the original health parameter set, including: adding a timestamp sequence, injecting the current environment fingerprint feature value, and generating a parameter integrity check code; S300: Security output phase: Constructing a triplet data packet containing original health parameters, environmental characteristic values, and checksums; Use chain encryption algorithm to progressively encrypt data packets and generate health reports with self-verification attributes; S400: Status recovery phase: monitor the completion status of healthy data transmission and select to execute the complete security exit protocol or emergency data erasure procedure according to the transmission result; The original read and write policy of the SSD is restored and an operation audit log is generated, which contains a complete timestamp chain of security events. As a further solution of the present invention: Step S100 includes the following steps: S101: Verify the legitimacy of the request source: Through a preset two-way authentication protocol, the request source is required to submit a digital certificate containing an encrypted timestamp. At the same time, the SSD controller feeds back a hash challenge value of the device's physical feature code to the request source. Verify the validity of the digital certificate based on an asymmetric encryption algorithm and compare the physical signature hash response value returned by the request source with the signature code pre-stored on the SSD. S102: Building a secure environment: Detecting the current read and write operation queue of the SSD. If there are any unfinished write instructions, a delay buffer mechanism is triggered to temporarily store non-critical write operations in an isolated cache area. Dynamically generates a temporary read-only policy based on the SSD firmware version and storage unit health status. This policy includes: prohibiting write instruction injection from unauthorized processes, limiting the number of concurrent connections to the health parameter access interface, and allocating an independent secure memory channel for health query operations. S103: Environmental security confirmation: After the secure operating environment is established, a confirmation signal containing an environmental fingerprint is sent to the request source. The environmental fingerprint is generated by combining the current SSD temperature, voltage fluctuation characteristics, and access policy hash value. If the request source does not return a fingerprint confirmation receipt within the preset time, the security environment rollback operation will be automatically triggered.

[0007] As a further solution of the present invention: Step S200 includes the following steps: S201: Batch data extraction control: Dynamically set the batch extraction capacity based on the health score of the SSD storage unit. When the health score is ≥80%, the single batch extraction capacity does not exceed 5% of the total health parameter storage area. When the health score is <80%, the single batch extraction capacity is proportionally reduced and the batch interval is increased. Before each batch extraction, the integrity status of the temporary read-only policy is verified through the firmware interface; S202: Dynamic environment fingerprint generation: Generate a dynamic environment fingerprint based on the following multi-dimensional parameters: Current SSD controller temperature and voltage fluctuation characteristic values; The physical block access frequency distribution of the health parameter storage area; Policy configuration hash value of the secure operating environment; A lightweight obfuscation algorithm is used to perform nonlinear fusion on the above parameters to generate a unique fingerprint identification; S203, multi-layer data encapsulation processing: The first layer of encapsulation: adding a timeline with a time series encryption stamp to the original health parameters. The time series encryption stamp contains a batch number and a quantum random number. The second layer of encapsulation: splits the dynamic environment fingerprint into feature vectors and injects them into the data field gaps of the health parameters according to the preset weights; The third layer of encapsulation: Generates a chain checksum based on the first two layers of data. The checksum includes: The final checksum hash value of the previous batch of health parameters; Chaotic encrypted summary of this batch of environmental fingerprints; The instantaneous power consumption characteristic value of the current SSD controller; S204, Abnormal Behavior Blocking: During the data encapsulation process, the following abnormal indicators are monitored in real time: The mutation amplitude threshold of health parameters within the same batch; Real-time matching between environmental fingerprints and operational strategies; The fluctuation range of the time consumption for data encapsulation processing; If any indicator is detected to exceed the preset safety threshold, the current batch operation will be terminated immediately and the safety alarm protocol will be triggered.

[0008] As a further solution of the present invention: the safety output stage of step S300 further includes the following detailed steps: S301, triplet data packet structured processing: The original health parameters are split into multiple data blocks according to preset rules, and each data block is attached with an independent check field, which contains: The hash value of the physical storage unit address of the corresponding data block; The quantized value of the clock jitter characteristic of the current SSD controller; Chaotic encryption summary of the previous data block; The environmental characteristic value and the check code are embedded into the data block gap in an orthogonal coding manner to form a triplet structure with spatial isolation characteristics; S302, progressive chain encryption processing: First layer encryption: A lightweight symmetric encryption algorithm is used to independently encrypt each data block, and the encryption key is dynamically derived from the environmental fingerprint feature value; Second layer encryption: The encrypted data blocks are concatenated in sequence, and the encryption result of the previous block is used as the initialization vector of the next block to generate a chained encrypted data stream; Third-layer encryption: Physically Unclonable Function (PUF)-based terminal encryption is applied to the complete data stream, and the following features are bound to the final ciphertext: Current operating voltage ripple characteristics of the SSD controller; Read disturb statistics of NAND flash memory cells during encryption operations; S303, self-verification health report generation: Append a verification information set to the end of the ciphertext data, including: Hash value of the power consumption trace of each data block encryption process; XOR checksum of all initialization vectors in the chain encryption process; Secondary obfuscation encryption result of environmental feature values; The ciphertext data and verification information are reorganized in a tree structure to generate a health report that supports segmented verification. The report allows the receiver to verify integrity in any of the following ways: Verify the consistency of power consumption traces of each data block based on preset weight values; Verify the relevance of the initialization vector through reverse chain decryption; S304, safety output control: Monitor the physical layer characteristic parameters of the output channel, including signal level stability and timing jitter value; When a channel abnormality is detected, it automatically switches to a degraded output mode, which includes: Transmit health reports in fragments and interleave; Add a decoy checksum to each data shard; Update the frequency hopping sequence of the output channel in real time.

[0009] As a further solution of the present invention: the state recovery phase of step S400 further includes the following detailed steps: S401, intelligent determination of transmission status: Monitor the physical layer and protocol layer dual-dimensional status indicators of the health report transmission channel, including: Physical layer: signal integrity index, channel-to-noise ratio threshold; Protocol layer: ACK / NACK response rate, data packet retransmission count; Dynamically determine the transmission completion status based on a preset transmission integrity scoring model that integrates the following parameters: the proportion of successfully received data fragments and the verification pass rate; The risk level assessment value of the remaining unconfirmed fragments; S402, Safe Exit Protocol Execution: When the transfer is determined to be complete, the phased safe exit process is initiated: Verify the consistency of the current environment fingerprint with the initial establishment phase. If the deviation exceeds the preset threshold, a secondary verification is triggered; Gradually release the delayed write instructions in the isolation buffer in reverse order and inject integrity check marks; Perform pre-write verification on the area covered by the temporary read-only policy to ensure that there is no residual temporary data related to health queries; S403, Emergency Data Erase Procedure: When it is determined to be an abnormal interrupt, a multi-level erase operation is performed: Logical layer erase: Use a physically unclonable function (PUF) to generate a one-time erase key to overwrite the health parameter cache; Physical layer disturbance: Apply a specific pattern of read disturbance pulses to the NAND block storing healthy data, including: performing three consecutive program / erase cycles on the target cell; Injecting high voltage disturbance signals into adjacent cells; Metadata obfuscation: Modify the physical pointers of related logical addresses in the FTL mapping table and insert decoy data pages; S404, Policy Recovery and Audit Enhancement: When restoring the original read-write strategy, a gradual load injection method is used: In the first phase, only 50% of the write bandwidth is restored and abnormal heating indicators of the SSD controller are monitored; When there are no abnormalities for three consecutive clock cycles, the system will gradually increase to full load. Additional environmental traceability information is included when generating operation audit logs, including: Hash value of the temperature-voltage change curve during the existence of the safe operating environment; Timestamp chain and execution result code of each stage state recovery operation; Interference pulse pattern signature code used in emergency erase procedures; S405, after-effect monitoring mechanism: After the status is restored, the guard monitoring period starts (the duration is twice the duration of the health query operation). During this period: Perform pattern recognition on abnormal instructions involving access to healthy parameters, and trigger the circuit breaker mechanism if an operation matching the query characteristics is detected; Regularly check the status of the removal of residual environmental fingerprints in the SSD metadata area.

[0010] Compared with the prior art, the present invention has the following beneficial effects: The present invention realizes security isolation during query through dynamic read and write permission configuration, effectively avoiding the performance bottleneck and security blind spots caused by traditional static permission management; adopts environmental fingerprint binding technology to ensure the strong correlation between health data and hardware status, solving the defect of unverifiable data source in traditional methods; chain encryption and self-verification design improve the anti-attack capability of the data transmission process, breaking through the limitation that conventional encryption schemes are susceptible to tampering by middlemen; the intelligent state recovery mechanism combines progressive policy rollback with physical layer interference to eliminate the risk of data residue while ensuring operational integrity; the overall solution constructs a multi-dimensional protection system through process-level innovation, realizing full life cycle security protection of SSD health queries without relying on hardware modification, significantly improving system reliability and risk resistance. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 It is a flow chart of steps S100-S400 in the present invention. DETAILED DESCRIPTION

[0012] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0013] See also Figure 1 , an SSD health query system based on data reading and writing security, including the following steps: S100: Security verification phase: When receiving a health query request, the composite authentication protocol is initiated to verify the matching of the request source digital certificate and the device physical feature code; Detect the current read and write status of the SSD and establish a safe operating environment, dynamically configuring a temporary read-only access policy; S200: Health data acquisition phase: extracting the original health parameter set in batches under a controlled access policy, and generating a dynamic environment fingerprint synchronously when extracting each batch; Perform multi-layer data encapsulation on the original health parameter set, including: adding a timestamp sequence, injecting the current environment fingerprint feature value, and generating a parameter integrity check code; S300: Security output phase: Constructing a triplet data packet containing original health parameters, environmental characteristic values, and checksums; Use chain encryption algorithm to progressively encrypt data packets and generate health reports with self-verification attributes; S400: Status recovery phase: monitor the completion status of healthy data transmission and select to execute the complete security exit protocol or emergency data erasure procedure according to the transmission result; Restoring the original read and write policy of the SSD and generating an operation audit log containing a complete timestamp chain of security events; In S100, by real-time monitoring of the SSD read and write status and dynamically configuring a temporary read-only policy, non-critical write operations are allowed to be temporarily stored in an isolated cache area while ensuring the security of health queries. Compared with the existing method of directly interrupting writes, this method reduces operation latency and avoids the problem of storage unit loss caused by forced interruption. In S200, health data is strongly bound to the SSD's current physical state, such as temperature and voltage fluctuations, by injecting environmental fingerprint feature values. This requires forged data to simulate the dynamic characteristics of the hardware environment, increasing the complexity of the attack by at least three orders of magnitude and effectively addressing the vulnerability of traditional software encryption to replay attacks. In S300, a chain encryption algorithm is used to use the encryption result of the previous data block as the subsequent initialization vector, forming a cryptographic association between the data blocks. Tampering with a single data block will cause the chain decryption to fail. Compared with independent encryption modes such as AES-GCM, the sensitivity of data integrity verification is improved; In S400, the transmission status is intelligently determined to adaptively select safe exit or emergency erase. Combining physical layer interference (such as NAND block read disturbance pulses) with logical layer confusion, the probability of residual data recovery is reduced to less than 10^-6, which is two orders of magnitude more secure than traditional logical erase solutions. A closed-loop protection chain is formed from request authentication to audit tracing. A panoramic backtracking of the operation process is achieved through the environmental fingerprint timestamp chain (log), locating security incidents with millisecond-level accuracy. A progressive policy recovery mechanism (loading write bandwidth in stages) avoids the risk of instantaneous overload of the SSD controller, improving system recovery stability. The technical solution of the present invention is entirely based on firmware-layer process innovation. It does not require modification of the SSD hardware structure or the addition of a coprocessor, resulting in low implementation costs. It also supports adaptation to NAND flash memory architectures from different manufacturers, and its deployment flexibility is significantly superior to existing technologies that rely on specific control chips. The present invention realizes security isolation during query through dynamic read and write permission configuration, effectively avoiding the performance bottleneck and security blind spots caused by traditional static permission management; adopts environmental fingerprint binding technology to ensure the strong correlation between health data and hardware status, solving the defect of unverifiable data source in traditional methods; chain encryption and self-verification design improve the anti-attack capability of the data transmission process, breaking through the limitation that conventional encryption schemes are susceptible to tampering by middlemen; the intelligent state recovery mechanism combines progressive policy rollback with physical layer interference to eliminate the risk of data residue while ensuring operational integrity; the overall solution constructs a multi-dimensional protection system through process-level innovation, realizing full life cycle security protection of SSD health queries without relying on hardware modification, significantly improving system reliability and risk resistance.

[0014] In the embodiment of the present invention, step S100 includes the following steps: S101: Verify the legitimacy of the request source: Through a preset two-way authentication protocol, the request source is required to submit a digital certificate containing an encrypted timestamp. At the same time, the SSD controller feeds back a hash challenge value of the device's physical feature code to the request source. Verify the validity of the digital certificate based on an asymmetric encryption algorithm and compare the physical signature hash response value returned by the request source with the signature code pre-stored on the SSD. S102: Building a secure environment: Detecting the current read and write operation queue of the SSD. If there are any unfinished write instructions, a delay buffer mechanism is triggered to temporarily store non-critical write operations in an isolated cache area. Dynamically generates a temporary read-only policy based on the SSD firmware version and storage unit health status. This policy includes: prohibiting write instruction injection from unauthorized processes, limiting the number of concurrent connections to the health parameter access interface, and allocating an independent secure memory channel for health query operations. S103: Environmental security confirmation: After the secure operating environment is established, a confirmation signal containing an environmental fingerprint is sent to the request source. The environmental fingerprint is generated by combining the current SSD temperature, voltage fluctuation characteristics, and access policy hash value. If the request source does not return a fingerprint confirmation receipt within the preset time, the security environment rollback operation will be automatically triggered; In S101, a two-way authentication protocol is used to cross-verify the request source and the SSD controller, reducing the success rate of counterfeit attacks in traditional one-way authentication. At the same time, a physical signature hash challenge mechanism is introduced to increase the computing power cost of forging legitimate identities. In S102, the dynamically generated temporary read-only policy is combined with a delay buffer mechanism to achieve secure isolation while maintaining normal write throughput, reducing instruction latency compared to a solution that directly interrupts write operations. In S103, the environmental fingerprint confirmation mechanism effectively blocks the man-in-the-middle attack path through real-time hardware status binding and timeout rollback design, can identify environmental tampering behavior, and ensure consistency errors in the secure operating environment, significantly improving the overall security baseline of the system.

[0015] In the embodiment of the present invention, step S200 includes the following steps: S201: Batch data extraction control: Dynamically set the batch extraction capacity based on the health score of the SSD storage unit. When the health score is ≥80%, the single batch extraction capacity does not exceed 5% of the total health parameter storage area. When the health score is <80%, the single batch extraction capacity is proportionally reduced and the batch interval is increased. Before each batch extraction, the integrity status of the temporary read-only policy is verified through the firmware interface; S202: Dynamic environment fingerprint generation: Generate a dynamic environment fingerprint based on the following multi-dimensional parameters: Current SSD controller temperature and voltage fluctuation characteristic values; The physical block access frequency distribution of the health parameter storage area; Policy configuration hash value of the secure operating environment; A lightweight obfuscation algorithm is used to perform nonlinear fusion on the above parameters to generate a unique fingerprint identification; S203, multi-layer data encapsulation processing: First layer encapsulation: adding a time axis with a time series encryption stamp to the original health parameters, wherein the time series encryption stamp includes a batch number and a quantum random number; The second layer of encapsulation: splits the dynamic environment fingerprint into feature vectors and injects them into the data field gaps of the health parameters according to the preset weights; The third layer of encapsulation: Generates a chain checksum based on the first two layers of data. The checksum includes: The final checksum hash value of the previous batch of health parameters; Chaotic encrypted summary of this batch of environmental fingerprints; The instantaneous power consumption characteristic value of the current SSD controller; S204, Abnormal Behavior Blocking: During the data encapsulation process, the following abnormal indicators are monitored in real time: The mutation amplitude threshold of health parameters within the same batch; Real-time matching between environmental fingerprints and operational strategies; The fluctuation range of the time consumption for data encapsulation processing; If any indicator is detected to exceed the preset safety threshold, the current batch operation will be terminated immediately and the safety alarm protocol will be triggered; In S201, dynamic batch capacity control is used to intelligently adapt healthy data extraction to SSD load. When the health level drops below 80%, the single batch size is automatically reduced and the interval is extended, reducing resource utilization in high-load scenarios while maintaining data integrity. In S202, multi-dimensional environmental fingerprint generation integrates hardware features such as controller temperature and access frequency, and combines them with a nonlinear obfuscation algorithm to generate a unique identifier. This increases the complexity of attacks against forged health data to 10^12 operations, improving anti-forgery capabilities by three orders of magnitude compared to traditional timestamp binding solutions. In S203, the chain check code design improves the tamper detection rate from a single batch to the entire link by binding cross-batch hash association with power consumption characteristics, and supports 10 millisecond-level anomaly positioning; In S204, the real-time anomaly blocking mechanism is based on dynamic monitoring of multi-dimensional indicators, which can identify and intercept data tampering within 50 microseconds. Compared with the traditional polling detection method, the response speed is improved, and an overall dynamic protection system covering the entire process of data collection, packaging, and transmission is built.

[0016] In the embodiment of the present invention, step S300 includes the following steps: S301, triplet data packet structured processing: The original health parameters are split into multiple data blocks according to preset rules, and each data block is attached with an independent check field, which contains: The hash value of the physical storage unit address of the corresponding data block; The quantized value of the clock jitter characteristic of the current SSD controller; Chaotic encryption summary of the previous data block; The environmental characteristic value and the check code are embedded into the data block gap in an orthogonal coding manner to form a triplet structure with spatial isolation characteristics; S302, progressive chain encryption processing: First layer encryption: A lightweight symmetric encryption algorithm is used to independently encrypt each data block, and the encryption key is dynamically derived from the environmental fingerprint feature value; Second layer encryption: The encrypted data blocks are concatenated in sequence, and the encryption result of the previous block is used as the initialization vector of the next block to generate a chained encrypted data stream; Third-layer encryption: Physically Unclonable Function (PUF)-based terminal encryption is applied to the complete data stream, and the following features are bound to the final ciphertext: Current operating voltage ripple characteristics of the SSD controller; Read disturb statistics of NAND flash memory cells during encryption operations; S303, self-verification health report generation: Append a verification information set to the end of the ciphertext data, including: Hash value of the power consumption trace of each data block encryption process; XOR checksum of all initialization vectors in the chain encryption process; Secondary obfuscation encryption result of environmental feature value; The ciphertext data and verification information are reorganized in a tree structure to generate a health report that supports segmented verification. The report allows the receiver to verify integrity in any of the following ways: Verify the consistency of power consumption traces of each data block based on preset weight values; Verify the relevance of the initialization vector through reverse chain decryption; S304, safety output control: Monitor the physical layer characteristic parameters of the output channel, including signal level stability and timing jitter value; When a channel abnormality is detected, it automatically switches to a degraded output mode, which includes: Transmit health reports in fragments and interleave; Add a decoy checksum to each data shard; Update the frequency hopping sequence of the output channel in real time; In S302, the chain encryption algorithm is used to concatenate the encrypted data blocks into a cryptographically linked structure. This prevents tampering with a single data block from causing chain decryption failure. Attackers must simultaneously crack at least three independent encryption layers (symmetric encryption, chain vectors, and PUF binding), increasing the computational complexity of the data substitution attack to 10^15, a four-order-of-magnitude improvement in protection compared to the traditional AES-GCM scheme. In S303, the self-verified health report uses a tree structure and segmented verification design to allow the recipient to verify the authenticity of any subset without decrypting the entire data, improving audit efficiency and reducing the average time required to detect abnormal data from seconds to milliseconds. Physical layer feature binding (such as voltage ripple and read disturb values) strongly correlates encrypted data with hardware status. Crackers must simultaneously reproduce the physical parameter fluctuations of the SSD operating environment (with an error tolerance of less than 0.1%), completely resolving the vulnerability of pure algorithmic encryption to offline cracking. In S304, the degraded output mode can maintain data availability when the channel is abnormal through fragmented interleaved transmission and decoy check code injection, while increasing the cost for eavesdroppers to extract valid information, achieving a dynamic balance between security and availability, and improving the anti-interference capability by 3 times compared to the existing single-channel solution.

[0017] In the embodiment of the present invention, the state recovery phase in step S400 further includes the following detailed steps: S401, intelligent determination of transmission status: Monitor the physical layer and protocol layer dual-dimensional status indicators of the health report transmission channel, including: Physical layer: signal integrity index, channel-to-noise ratio threshold; Protocol layer: ACK / NACK response rate, data packet retransmission count; Dynamically determine the transmission completion status based on a preset transmission integrity scoring model that integrates the following parameters: the proportion of successfully received data fragments and the verification pass rate; The risk level assessment value of the remaining unconfirmed fragments; S402, Safe Exit Agreement Execution: When the transfer is determined to be complete, the phased safe exit process is initiated: Verify the consistency of the current environment fingerprint with the initial establishment phase. If the deviation exceeds the preset threshold, a secondary verification is triggered; Gradually release the delayed write instructions in the isolation buffer in reverse order and inject integrity check marks; Perform pre-write verification on the area covered by the temporary read-only policy to ensure that there is no residual temporary data related to health queries; S403, Emergency Data Erase Procedure: When it is determined to be an abnormal interrupt, a multi-level erase operation is performed: Logical layer erase: Use a physically unclonable function (PUF) to generate a one-time erase key to overwrite the health parameter cache; Physical layer disturbance: Apply a specific pattern of read disturbance pulses to the NAND block storing healthy data, including: performing three consecutive program / erase cycles on the target cell; Injecting high voltage disturbance signals into adjacent cells; Metadata obfuscation: Modify the physical pointers of related logical addresses in the FTL mapping table and insert decoy data pages; S404, Policy Recovery and Audit Enhancement: When restoring the original read-write strategy, a gradual load injection method is used: In the first phase, only 50% of the write bandwidth is restored and abnormal heating indicators of the SSD controller are monitored; When there are no abnormalities for three consecutive clock cycles, the system will gradually increase to full load. Additional environmental traceability information is included when generating operation audit logs, including: Hash value of the temperature-voltage change curve during the existence of the safe operating environment; Timestamp chain and execution result code of each stage state recovery operation; Interference pulse pattern signature code used in emergency erase procedures; S405, after-effect monitoring mechanism: After the status is restored, the guard monitoring period starts (the duration is twice the duration of the health query operation). During this period: Perform pattern recognition on abnormal instructions involving access to healthy parameters, and trigger the circuit breaker mechanism if an operation matching the query characteristics is detected; Regularly check the status of the removal of residual environmental fingerprints in the SSD metadata area; In S401, the accuracy of abnormal interruption identification is improved by combining dual-dimensional transmission status determination with an integrity scoring model, avoiding false alarms caused by traditional threshold determination methods. In S403, a multi-level erasure solution combines logical overwrite, physical interference, and metadata obfuscation to reduce the probability of healthy data residue from 10^-3 in traditional solutions to 10^-6, increasing the cost of recovering valid data by 1000 times. Progressive policy recovery improves SSD controller recovery stability through phased write bandwidth loading and abnormal heat monitoring, and avoids the 30% performance jitter risk caused by instantaneous load shocks. In S404, the environmental traceability log (audit information) integrates temperature-voltage curve hashing and interference pulse signatures, supporting millisecond-level operation backtracking and positioning, increasing post-event evidence collection efficiency by five times. In S405, the guard monitoring mechanism continuously blocks more than 90% of associated attack attempts after the status is restored through fuse interception and residual fingerprint verification, completely resolving the defect in the existing technology that security protection terminates when the process ends, and forming a closed-loop protection chain.

[0018] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims, not the foregoing description, and all variations within the meaning and range of equivalents of the claims are intended to be included therein. Any reference sign in a claim should not be construed as limiting the claim to which it relates.

Claims

1. An SSD health query system based on data read and write security, characterized in that: The following steps are involved: S100: Security verification phase: When receiving a health query request, the composite authentication protocol is initiated to verify the matching of the request source digital certificate and the device physical feature code; Detect the current read and write status of the SSD and establish a safe operating environment, dynamically configuring a temporary read-only access policy; S200: Health data acquisition phase: extracting the original health parameter set in batches under a controlled access policy, and generating a dynamic environment fingerprint synchronously when extracting each batch; Perform multi-layer data encapsulation on the original health parameter set, including: adding a timestamp sequence, injecting the current environment fingerprint feature value, and generating a parameter integrity check code; S300: Security output phase: Constructing a triplet data packet containing original health parameters, environmental characteristic values, and checksums; Use chain encryption algorithm to progressively encrypt data packets and generate health reports with self-verification attributes; S400: Status recovery phase: monitor the completion status of healthy data transmission and select to execute the complete security exit protocol or emergency data erasure procedure according to the transmission result; The original read and write policy of the SSD is restored and an operation audit log is generated, which contains a complete timestamp chain of security events.

2. The SSD health query system based on data read and write security according to claim 1 is characterized in that: The step S100 includes the following steps: S101: Verify the legitimacy of the request source: Through a preset two-way authentication protocol, the request source is required to submit a digital certificate containing an encrypted timestamp. At the same time, the SSD controller feeds back a hash challenge value of the device's physical feature code to the request source. Verify the validity of the digital certificate based on an asymmetric encryption algorithm and compare the physical signature hash response value returned by the request source with the signature code pre-stored on the SSD. S102: Building a secure environment: Detecting the current read and write operation queue of the SSD. If there are any unfinished write instructions, a delay buffer mechanism is triggered to temporarily store non-critical write operations in an isolated cache area. Dynamically generates a temporary read-only policy based on the SSD firmware version and storage unit health status. This policy includes: prohibiting write instruction injection from unauthorized processes, limiting the number of concurrent connections to the health parameter access interface, and allocating an independent secure memory channel for health query operations. S103: Environmental security confirmation: After the secure operating environment is established, a confirmation signal containing an environmental fingerprint is sent to the request source. The environmental fingerprint is generated by combining the current SSD temperature, voltage fluctuation characteristics, and access policy hash value. If the request source does not return a fingerprint confirmation receipt within the preset time, the security environment rollback operation will be automatically triggered.

3. The SSD health query system based on data read and write security according to claim 2 is characterized in that: The step S200 includes the following steps: S201: Batch data extraction control: Dynamically set the batch extraction capacity based on the health score of the SSD storage unit. When the health score is ≥80%, the single batch extraction capacity does not exceed 5% of the total health parameter storage area. When the health score is <80%, the single batch extraction capacity is proportionally reduced and the batch interval is increased. Before each batch extraction, the integrity status of the temporary read-only policy is verified through the firmware interface; S202: Dynamic environment fingerprint generation: Generate a dynamic environment fingerprint based on the following multi-dimensional parameters: Current SSD controller temperature and voltage fluctuation characteristic values; The physical block access frequency distribution of the health parameter storage area; Policy configuration hash value of the secure operating environment; A lightweight obfuscation algorithm is used to perform nonlinear fusion on the above parameters to generate a unique fingerprint identification; S203, multi-layer data encapsulation processing: The first layer of encapsulation: adding a timeline with a time series encryption stamp to the original health parameters. The time series encryption stamp contains a batch number and a quantum random number. The second layer of encapsulation: splits the dynamic environment fingerprint into feature vectors and injects them into the data field gaps of the health parameters according to the preset weights; The third layer of encapsulation: Generates a chain checksum based on the first two layers of data. The checksum includes: The final checksum hash value of the previous batch of health parameters; Chaotic encrypted summary of this batch of environmental fingerprints; The instantaneous power consumption characteristic value of the current SSD controller; S204, Abnormal Behavior Blocking: During the data encapsulation process, the following abnormal indicators are monitored in real time: The mutation amplitude threshold of health parameters within the same batch; Real-time matching between environmental fingerprints and operational strategies; The fluctuation range of the time consumption for data encapsulation processing; If any indicator is detected to exceed the preset safety threshold, the current batch operation will be terminated immediately and the safety alarm protocol will be triggered.

4. The SSD health query system based on data read and write security according to claim 3 is characterized in that: The safety output stage of step S300 further includes the following detailed steps: S301, triplet data packet structured processing: The original health parameters are split into multiple data blocks according to preset rules, and each data block is attached with an independent check field, which contains: The hash value of the physical storage unit address of the corresponding data block; The quantized value of the clock jitter characteristic of the current SSD controller; Chaotic encryption summary of the previous data block; The environmental characteristic value and the check code are embedded into the data block gap in an orthogonal coding manner to form a triplet structure with spatial isolation characteristics; S302, progressive chain encryption processing: First layer encryption: A lightweight symmetric encryption algorithm is used to independently encrypt each data block, and the encryption key is dynamically derived from the environmental fingerprint feature value; Second layer encryption: The encrypted data blocks are concatenated in sequence, and the encryption result of the previous block is used as the initialization vector of the next block to generate a chained encrypted data stream; Third-layer encryption: Physically Unclonable Function (PUF)-based terminal encryption is applied to the complete data stream, and the following features are bound to the final ciphertext: Current operating voltage ripple characteristics of the SSD controller; Read disturb statistics of NAND flash memory cells during encryption operations; S303, self-verification health report generation: Append a verification information set to the end of the ciphertext data, including: Hash value of the power consumption trace of each data block encryption process; XOR checksum of all initialization vectors in the chain encryption process; Secondary obfuscation encryption result of environmental feature value; The ciphertext data and verification information are reorganized in a tree structure to generate a health report that supports segmented verification. The report allows the receiver to verify integrity in any of the following ways: Verify the consistency of power consumption traces of each data block based on preset weight values; Verify the relevance of the initialization vector through reverse chain decryption; S304, safety output control: Monitor the physical layer characteristic parameters of the output channel, including signal level stability and timing jitter value; When a channel abnormality is detected, it automatically switches to a degraded output mode, which includes: Transmit health reports in fragments and interleave; Add a decoy checksum to each data shard; Update the frequency hopping sequence of the output channel in real time.

5. The SSD health query system based on data read and write security according to claim 4 is characterized in that: The state recovery phase in step S400 further includes the following detailed steps: S401, intelligent determination of transmission status: Monitor the physical layer and protocol layer dual-dimensional status indicators of the health report transmission channel, including: Physical layer: signal integrity index, channel-to-noise ratio threshold; Protocol layer: ACK / NACK response rate, data packet retransmission count; Dynamically determine the transmission completion status based on a preset transmission integrity scoring model that integrates the following parameters: the proportion of successfully received data fragments and the verification pass rate; The risk level assessment value of the remaining unconfirmed fragments; S402, Safe Exit Agreement Execution: When the transfer is determined to be complete, the phased safe exit process is initiated: Verify the consistency of the current environment fingerprint with the initial establishment phase. If the deviation exceeds the preset threshold, a secondary verification is triggered; Gradually release the delayed write instructions in the isolation buffer in reverse order and inject integrity check marks; Perform pre-write verification on the area covered by the temporary read-only policy to ensure that there is no residual temporary data related to health queries; S403, Emergency Data Erase Procedure: When it is determined to be an abnormal interrupt, a multi-level erase operation is performed: Logical layer erase: Use a physically unclonable function (PUF) to generate a one-time erase key to overwrite the health parameter cache; Physical layer disturbance: Apply a specific pattern of read disturbance pulses to the NAND block storing healthy data, including: performing three consecutive program / erase cycles on the target cell; Injecting high voltage disturbance signals into adjacent cells; Metadata obfuscation: Modify the physical pointers of related logical addresses in the FTL mapping table and insert decoy data pages; S404, Policy Recovery and Audit Enhancement: When restoring the original read-write strategy, a gradual load injection method is used: In the first phase, only 50% of the write bandwidth is restored and abnormal heating indicators of the SSD controller are monitored; When there are no abnormalities for three consecutive clock cycles, the system will gradually increase to full load. Additional environmental traceability information is included when generating operation audit logs, including: Hash value of the temperature-voltage change curve during the existence of the safe operating environment; Timestamp chain and execution result code of each stage state recovery operation; Interference pulse pattern signature code used in emergency erase procedures; S405, after-effect monitoring mechanism: After the status is restored, the guard monitoring period starts (the duration is twice the duration of the health query operation). During this period: Perform pattern recognition on abnormal instructions involving access to healthy parameters, and trigger the circuit breaker mechanism if an operation matching the query characteristics is detected; Regularly check the status of the removal of residual environmental fingerprints in the SSD metadata area.

Images