Security encryption management method for hard disk

Abstract

The invention relates to a security encryption management method for a hard disk, and belongs to the technical field of computer information storage. According to the method, security management is carried out based on the security hard disk jump state, the host machine jump state and the authority; the security hard disk comprises an SATA bridging chip and an SATA hard disk which are connected together, and the jump states of the security hard disk are realized on the SATA bridging chip and comprise a factory state, an initial installation state, a binding state, a logout state and a login state; the host machine jump state comprises a binding state and an unbinding state; the authority comprises a user authority L1 and a management authority L2, and the user authority L1 has a hard disk use authority and can perform hard disk login; the management authority L2 has the management authority of the hard disk and the host, password resources can be injected, and safety management setting can be carried out on the safety hard disk. According to the invention, the safety protection requirement of the general storage device is met through a low-cost, high-safety and low-complexity design scheme.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer information storage, and in particular relates to a hard disk security encryption management method. Background Art

[0002] Currently, hard drive encryption technology and master control system security protection are widely used in the information storage field. To ensure data security, many existing technologies use hard drive-level encryption or master control chip firmware protection measures. However, these technologies still have some limitations in practice, specifically in the combination of data encryption and hardware security protection:

[0003] Existing hard drive encryption technologies, such as full disk encryption (FDE) and self-encrypting drives (SED), can effectively encrypt and store data on hard drives. These technologies use encryption algorithms to ensure the security of data during storage and transmission, preventing illegal access or theft of data. Despite this, existing technologies often focus only on the implementation of encryption algorithms and fail to provide effective security protection at the hardware level. For example, hard drive encryption usually relies on the encryption chip built into the hard drive or encryption services at the operating system level, which means that in some cases the hard drive still has the risk of being tampered with, forged, or encryption bypassed, especially when the hard drive is not bound or authenticated to the main control system.

[0004] To improve hard drive security, some technologies employ controller chip firmware encryption or hardware authentication. These methods embed security authentication mechanisms within the hard drive controller chip's firmware, performing identity verification during drive startup to ensure only authorized hosts can access drive data. However, most existing firmware protection technologies rely on operating system driver interfaces and explicit, single-item authentication mechanisms implemented through system calls, lacking a systematic security management mechanism tied to key host components.

[0005] In summary, while existing technical solutions each possess certain advantages, they still have limitations: hard drive encryption technology and main control chip firmware protection are often independent of each other, failing to form a complete security system. Furthermore, existing technologies often focus on either data encryption or firmware security, failing to address the synergy between hardware and firmware, such as hard drive and host binding, authentication, and measurement at the BIOS stage, to fundamentally enhance the hard drive's data security and firmware protection. Therefore, existing technologies remain insufficient in comprehensive security protection, and a new technical solution is needed to enhance the overall security of the hard drive and main control system. Summary of the Invention

[0006] (1) Technical issues to be solved

[0007] The technical problem to be solved by the present invention is how to provide a hard disk security encryption management method to solve the problem that the existing hard disk encryption technology and the main control chip firmware protection are often independent of each other and fail to form a complete security body, and the existing technology fails to fundamentally enhance the data security and firmware protection of the hard disk.

[0008] (2) Technical solution

[0009] In order to solve the above technical problems, the present invention proposes a hard disk security encryption management method, which performs security management based on the secure hard disk jump state, host machine jump state, and permissions;

[0010] The secure hard disk includes: a SATA bridge chip and a SATA hard disk connected together, and the secure hard disk jump state is realized on the SATA bridge chip, including: factory state, initial installation state, binding state, logout state and login state;

[0011] The host jump status includes: binding state and unbinding state;

[0012] The permissions include: user permission L1 and management permission L2. User permission L1 has the permission to use the hard disk and can log in to the hard disk; management permission L2 has the management permission of the hard disk and the host, can inject password resources, and perform security management settings for the secure hard disk.

[0013] (3) Beneficial effects

[0014] This invention proposes a method for secure encryption management of hard drives. Compared to existing technologies, the technical solution proposed in this invention proposes a systematic hard drive + host protection mechanism. By implementing state mechanisms such as factory state, initial installation state, binding state, logout state, and login state on the SATA bridge chip, secure management of the host and hard drive is achieved. This design eliminates the need to consider host and hard drive compatibility issues and instead configures BIOS boot resources and firmware protection mechanisms within the SATA bridge chip. This low-cost, highly secure, and low-complexity design addresses the security requirements of general storage devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is the conversion process of the secure hard disk of the present invention from the factory state, the initial installation state and the binding state;

[0016] Figure 2 It is the jump process from binding state to logout state to login state in the secure hard disk;

[0017] Figure 3 This is the transition process from the unbinding state to the binding state of the host. DETAILED DESCRIPTION

[0018] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below with reference to the accompanying drawings and examples.

[0019] The present invention relates to a secure encryption management method between a hard disk and a main control system, belonging to the field of computer information storage technology. The secure encryption management method of the present invention can simultaneously achieve data storage encryption while also implementing security protection for the hard disk main control chip firmware. Specifically, it implements host and device binding, authentication, and measurement functions in the BIOS stage, thereby improving security capabilities.

[0020] The present invention proposes a method for achieving systematic hard disk protection by designing a SATA bridge chip and firmware during the BIOS boot phase.

[0021] The present invention provides a method for secure encryption management of a hard disk, which performs security management based on the secure hard disk jump state, host machine jump state, and permissions; the secure hard disk includes: a SATA bridge chip and a SATA hard disk connected together, and the secure hard disk jump state is implemented on the SATA bridge chip, including: factory state, initial installation state, binding state, logout state, login state, etc., thereby realizing the security management of the host machine and the secure hard disk; the host machine jump state includes: binding state and unbinding state; wherein L1 is user permission and L2 is management permission. L1 has hard disk usage permission and can log in to the hard disk; L2 has management permission for the hard disk and the host, can inject password resources, and perform security management settings for the secure hard disk.

[0022] Figure 1 This is the conversion process of the secure hard disk in the present invention from the factory state, initial installation state and binding state. Figure 1 As shown below:

[0023] (1) Factory state: The secure hard disk function test is completed and there is no sensitive data inside the secure hard disk.

[0024] (2) Initial installation: L2 permissions are required. In a secure environment, the management tool injects sensitive information such as keys, certificates, device numbers, etc. into the secure hard disk. Sensitive information is not allowed to be read but can be overwritten.

[0025] (3) Binding state: The actual working state of the secure hard disk, that is, after the secure hard disk is matched with the login host, it can be actually used. After the password resource is injected in the initial installation state, the binding is set in the host BIOS interface. When the secure hard disk needs to be unbound or the host is changed, it is necessary to obtain L2 permissions to unbind. After unbinding, the secure hard disk password resource exists and the binding can continue; when the secure hard disk needs to be destroyed, it is necessary to obtain L2 permissions to reset it. After the reset, the secure hard disk password resource is destroyed and restored to the factory state.

[0026] Figure 2 This is the jump process from the binding state to the logout state to the login state in the secure hard disk of the present invention. Figure 2 As shown, the state proposed by the present invention is as follows:

[0027] (1) Binding state: The secure hard disk is in the initial installation state. When connected to the host, the user obtains L2 permissions and enters the BIOS binding function. The host binds to the secure hard disk. The host obtains the device identifier of the secure hard disk and the key component generated by the secure hard disk; the secure hard disk obtains the host identifier of the host. The binding process uses a cryptographic module to encrypt the transmission. The key component R1 is randomly generated by the random number hardware module of the SATA bridge chip and has randomness, but the key M remains unchanged. The SATA bridge chip calculates the key component R2 required to be stored by the host BIOS based on R1, that is, M XOR R1 = R2. Each time the host BIOS is bound, R2 is recorded. At the same time, the SATA bridge chip deletes M and generates an MD5 identifier value of M. Each time the secure hard disk is logged in, M needs to be obtained through key synthesis, that is, M = R1 XOR R2. Once the secure hard disk is bound to the host, the secure hard disk firmware disables the binding function and does not allow re-binding. For secure hard disks that have not been logged in (authenticated through BIOS), the SATA bridge chip firmware blocks the host's read and write behavior, ensuring that the hard disk file information cannot be written or read.

[0028] (2) Logout state: After the secure hard disk is bound to the host computer, it is in the logout state by default when powered on. File information on the hard disk cannot be written or read.

[0029] (3) Login state: The user obtains L1 authority, and the secure hard disk performs two-way authentication with the host computer to confirm that the hard disk ID is consistent with the hard disk ID stored in the BIOS during the host computer binding phase. The key synthesis process is carried out. The host computer encrypts the key component R2 using asymmetric encryption and sends it to the secure hard disk. The secure hard disk decrypts the key component R2 and synthesizes it, calculates the MD5 result, and compares the synthesis results to see if they are consistent. After verification, the SATA bridge chip of the secure hard disk synthesizes the key M and loads the key into the password module of the SATA bridge chip. The real data of the SATA hard disk is decrypted, and hard disk access is released. The user has the ability to write to and read the hard disk.

[0030] Figure 3 This is the process of the host machine transitioning from the unbinding state to the binding state in the present invention, such as Figure 3 As shown:

[0031] (1) Binding State: The secure hard disk is in its initial installation state. The user obtains L2 privileges and enters the BIOS binding function. The host computer binds to the secure hard disk. At this point, the host computer obtains the secure hard disk's device ID and key component; the secure hard disk obtains the host computer's host ID. The binding process uses the SATA bridge chip's cryptographic module for encrypted transmission. The key component is random; each binding process changes the key component, but the key remains unchanged.

[0032] (2) Unbinding state: When the user obtains L2 permissions and is not connected to the bound secure hard disk, that is, the secure hard disk is lost or stolen, the host can unilaterally destroy the secure hard disk device identifier and key component R2 stored in the BIOS. When the secure hard disk is connected, the host performs two-way authentication through the hard disk unbinding instruction. After the authentication is successful, the device identifier and key component stored in the host BIOS are destroyed. The secure hard disk obtains the host key component R2 and performs key synthesis to restore the secure hard disk key M (R1 XOR R2 = M). At the same time, the MD5 value of R1 and key M stored in the secure hard disk is destroyed. At this time, the secure hard disk becomes the initial installation state and the secure hard disk can be rebound.

[0033] Compared to existing technologies, the technical solution proposed in this invention proposes a systematic hard drive + host protection mechanism. By implementing state mechanisms for factory, initial installation, binding, logout, and login states on the SATA bridge chip, this approach enables secure management of both the host and the hard drive. This design eliminates the need to consider host and hard drive compatibility issues and instead utilizes BIOS boot resources and firmware protection mechanisms configured within the SATA bridge chip. This low-cost, highly secure, and low-complexity design addresses the security requirements of universal storage devices.

[0034] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for secure encryption management of a hard disk, characterized in that: This method performs security management based on the secure hard disk jump status, host machine jump status, and permissions; The secure hard disk includes: a SATA bridge chip and a SATA hard disk connected together, and the secure hard disk jump state is realized on the SATA bridge chip, including: factory state, initial installation state, binding state, logout state and login state; The host jump status includes: binding state and unbinding state; The permissions include: user permission L1 and management permission L2. User permission L1 has the permission to use the hard disk and can log in to the hard disk; management permission L2 has the management permission of the hard disk and the host, can inject password resources, and perform security management settings for the secure hard disk.

2. The hard disk security encryption management method according to claim 1, wherein: The factory state of the secure hard disk means that the secure hard disk function test is completed and there is no sensitive data inside the secure hard disk.

3. The hard disk security encryption management method according to claim 1, wherein: Initial installation of a secure hard drive requires L2 permissions. In a secure environment, the management tool injects sensitive information into the secure hard drive, including keys, certificates, and device numbers. Sensitive information cannot be read but can be overwritten.

4. The hard disk security encryption management method according to claim 1, wherein: The binding state of the secure hard disk is the actual working state of the secure hard disk, that is, the secure hard disk is actually used after matching with the login host; after the password resource is injected in the initial installation state, the binding is set in the host BIOS interface; when the secure hard disk needs to be unbound or the host is changed, L2 permissions are required to unbind it. After unbinding, the secure hard disk password resource exists and can continue to be bound; when the secure hard disk needs to be destroyed, L2 permissions are required to reset it. After the reset, the secure hard disk password resource is destroyed and restored to the factory state.

5. The hard disk security encryption management method according to claim 4, characterized in that: The secure hard disk is in an initial installation state and is connected to the host. The user obtains L2 permissions and enters the BIOS binding function. The host is bound to the secure hard disk and obtains the device identifier of the secure hard disk and the key component generated by the secure hard disk. The secure hard disk obtains the host identifier of the host, and the binding process uses a cryptographic module for encrypted transmission. The key component R1 is randomly generated by the random number hardware module of the SATA bridge chip and is random, but the key M remains unchanged. The SATA bridge chip calculates the key component R2 required to be stored in the host BIOS based on R1, that is, M XOR R1 = R2. Each time binding is performed, the host BIOS records R2, and the SATA bridge chip deletes M and generates an MD5 identification value of M. Each time logging into the secure hard disk, M needs to be obtained through key synthesis, that is, M = R1 XOR R2.

6. The hard disk security encryption management method according to claim 5, characterized in that: Once the secure hard disk is bound to the host machine, the secure hard disk firmware disables the binding function and does not allow re-binding. For a secure hard drive that is not logged in, the SATA bridge chip firmware blocks the host's read and write behavior, ensuring that file information on the hard drive cannot be written or read.

7. The hard disk security encryption management method according to any one of claims 4 to 6, characterized in that: Logout state of the secure hard disk: After the secure hard disk is bound to the host computer, it is in the logged-out state by default upon power-on, and file information on the hard disk cannot be written or read.

8. The hard disk security encryption management method according to claim 7, wherein: Login state of the secure hard disk: The user obtains L1 authority, the secure hard disk and the host perform two-way authentication, confirm that the hard disk identifier is consistent with the hard disk identifier stored in the BIOS during the host binding phase, and perform the key synthesis process. The host encrypts the key component R2 using asymmetric encryption and sends it to the secure hard disk. The secure hard disk decrypts the key component R2 and synthesizes it, calculates the MD5 result, and compares the synthesis results for consistency; after verification, the SATA bridge chip of the secure hard disk synthesizes the key M and loads the key to the password module of the SATA bridge chip. The real data of the SATA hard disk is decrypted, the hard disk access is released, and the user has the ability to write and read the hard disk.

9. The hard disk security encryption management method according to claim 1, wherein: Host binding state: The secure hard disk is in the initial installation state. The user obtains L2 privileges and enters the BIOS binding function to bind the host to the secure hard disk. At this time, the host obtains the device ID and key component of the secure hard disk; the secure hard disk obtains the host ID of the host. The binding process uses the password module of the SATA bridge chip to encrypt the transmission. The key component is random. Each time binding occurs, the key component changes but the key remains unchanged.

10. The hard disk security encryption management method according to claim 9, characterized in that: Unbinding state of the host: The user obtains L2 permissions. When the bound secure hard disk is not connected, that is, the secure hard disk is lost or stolen, the host can unilaterally destroy the secure hard disk device identifier and key component R2 stored in the BIOS; when the secure hard disk is connected, the host performs two-way authentication through the hard disk unbinding instruction. After the authentication is successful, the device identifier and key component stored in the host BIOS are destroyed, and the secure hard disk obtains the host key component R2 and performs key synthesis to restore the secure hard disk key M, that is, R1XOR R2=M, and at the same time destroys the MD5 value of R1 and key M stored in the secure hard disk. At this time, the secure hard disk becomes the initial installation state and the secure hard disk can be rebound.

Images