Data processing method and device in solid state disk, electronic equipment and storage medium

Abstract

The invention provides a data processing method and device in a solid state disk, electronic equipment and a storage medium, and belongs to the technical field of data storage security. The method comprises the steps that an authentication request sent by a host is received, and identity information of the host is verified based on the authentication request; sending the identity information of the solid state disk to a host; under the condition that both the host and the solid state disk pass verification, a secure communication session is established between the solid state disk and the host; judging whether the host has the authority of accessing the target data according to a preset access control strategy; decrypting the target data based on the first key; the first key is obtained through decryption based on a second key, and the second key is generated based on a personal identification code (PIN) of a user and a system random number; decrypting the target data based on the second key to obtain plaintext data corresponding to the target data; and packaging the plaintext data, and returning a packaged decryption result to the host. According to the invention, the confidentiality and integrity of the data in the storage, transmission and access processes are ensured.

Description

Technical Field

[0001] The present application relates to the technical field of data storage security, and in particular to a data processing method, device, electronic device, and storage medium in a solid-state hard disk. Background Art

[0002] With the rapid development of the digital age, data has become a core asset for businesses and individuals, and its security is directly related to business continuity, privacy protection, and even survival and development. In the field of data storage, self-encrypting solid-state drives (SEDs), as storage devices with built-in encryption capabilities, have been widely used to ensure the security of static data storage by automatically encrypting data when written and decrypting it when read. The core function of SEDs is to ensure that data is always encrypted within the drive through hardware-level encryption mechanisms, thereby reducing the risk of leakage due to physical loss or unauthorized direct access. They are a vital component of modern storage security systems.

[0003] In the existing technology, the security protection capabilities of traditional self-encrypting solid-state drives have significant limitations. On the one hand, its encryption function only focuses on the static storage stage of data. In the process of data transmission from the host to the hard disk or from the hard disk to the host, there is a lack of effective security protection mechanism. The data is vulnerable to eavesdropping, tampering or interception, and it is difficult to ensure the integrity and confidentiality of the transmission process. On the other hand, the access control mechanism of traditional self-encrypting solid-state drives is relatively simple, usually relying only on passwords for identity authentication, and cannot achieve fine-grained management based on user roles and permissions. In enterprise-level scenarios with multiple users and multiple devices, it is difficult to meet complex permission allocation requirements, which can easily lead to unauthorized access risks. In addition, the key management strategy of traditional self-encrypting solid-state drives is single, lacking layered protection and dynamic management mechanisms. The security of key storage and use is difficult to guarantee. Once the key is leaked, it will directly threaten the security of all encrypted data.

[0004] The aforementioned shortcomings of existing technologies prevent traditional self-encrypting SSDs from fully addressing the security requirements of the entire data storage, transmission, and access process, making them unable to cope with the increasingly complex cyberattack environment and the high security standards of enterprise-level applications. Therefore, how to overcome the bottlenecks of traditional self-encrypting SSDs in data transmission security, access control precision, and key management flexibility, and build a comprehensive security protection solution covering the entire data lifecycle to ensure the confidentiality and integrity of data during storage, transmission, and access, has become a pressing technical challenge in the current storage security field. Summary of the Invention

[0005] The present application provides a data processing method, device, electronic device and storage medium in a solid-state drive, which can ensure the confidentiality and integrity of data in the solid-state drive during storage, transmission and access.

[0006] According to a first aspect of the present application, a method for processing data in a solid-state drive is provided. The method is applied to the solid-state drive and includes: receiving an authentication request sent by a host, and verifying the identity information of the host based on the authentication request; Sending the identity information of the solid state drive to the host; When both the host and the solid-state drive are authenticated, the solid-state drive establishes a secure communication session with the host; Determining whether the host has permission to access the target data according to a preset access control policy; Decrypting the target data based on a first key; wherein the first key is in an encrypted stored state and is decrypted based on a second key, wherein the second key is generated based on a user's personal identification number (PIN) and a system random number; decrypting the target data based on the second key to obtain plaintext data corresponding to the target data; The plaintext data is encapsulated and the encapsulated decryption result is returned to the host.

[0007] In one embodiment, verifying the identity information of the host based on the authentication request includes: The solid-state drive receives the first identity information sent by the host; The solid state drive compares the first identity information with first pre-stored identity information in the solid state drive; If the comparison results are consistent, it is determined that the host identity authentication has passed.

[0008] In one possible implementation manner, determining whether the host has permission to access target data according to a preset access control policy includes: The access control policy includes at least one of user role, user group, and data classification; In the case where the access control policy is a user role, determining whether the user role to which the sender of the authentication request belongs has permission to access the target data; In the case where the access control policy is a user group, determining whether the user group to which the sender of the authentication request belongs has permission to access the target data; In a case where the access control policy is data classification, it is determined whether the target data requested by the sender of the authentication request has open access rights.

[0009] In one possible implementation, before determining whether the host has permission to access the target data according to a preset access control policy, the method further includes: Assign differentiated access permissions to different data for different hosts.

[0010] In one embodiment, before decrypting the target data based on the first key, the method further includes: Generate a first random number using a true random number generator built into the solid-state drive, and generate a first key based on the first random number, where the first key is used to encrypt the target data; Obtaining the user's PIN, generating a second random number using the true random number generator, and combining the user's PIN with the second random number to generate the second key; The first key is encrypted and stored based on the second key, so that the first key is obtained by decrypting the target data using the second key before the target data is decrypted.

[0011] In one possible implementation manner, the encapsulating the plaintext data includes: Encrypting the plaintext data in segments based on a secure transmission protocol, and adding a sequence identifier and a timestamp to each encrypted segment; Multiple data segments carrying sequence identifiers and timestamps are encapsulated.

[0012] In one possible implementation manner, if the plaintext data includes key information, the encapsulating the plaintext data further includes: Adding the hash value of the key information to the data packet header; After receiving the encapsulated decryption result, the host verifies the hash value in the data packet header to verify the integrity of the key information.

[0013] In one possible implementation manner, verifying the hash value in the data packet header to verify the integrity of the key information includes: Extracting a hash value of the key information from the data packet header; Performing hash calculation on the received key information to obtain a calculated hash value; The extracted hash value is compared with the calculated hash value; if the two are consistent, the key information is determined to be complete; if the two are inconsistent, the key information is determined to be incomplete, and a key information retransmission request is sent to the solid state drive.

[0014] In one embodiment, returning the encapsulated decryption result to the host includes: Split the encapsulated plaintext data into multiple data packets, each of which contains part of the plaintext data and control information; The plurality of data packets are returned to the host.

[0015] According to a second aspect of the present application, a data processing device in a solid-state hard disk is provided, wherein the data processing device in the solid-state hard disk comprises: an identity authentication module, configured to receive an authentication request from a host, verify the identity information of the host based on the authentication request, send the identity information of the solid-state drive to the host, and establish a secure communication session between the solid-state drive and the host if both the host and the solid-state drive are authenticated; The permission control module is used to determine whether the host has the permission to access the target data according to the preset access control policy; a key management module, configured to decrypt the target data based on a first key; wherein the first key is in an encrypted stored state and is decrypted based on a second key, wherein the second key is generated based on a user's personal identification number (PIN) and a system random number; and decrypt the target data based on the second key to obtain plaintext data corresponding to the target data; The data processing module is used to encapsulate the plaintext data and return the encapsulated plaintext data to the host.

[0016] In one embodiment, the identity authentication module is further configured to receive first identity information sent by the host; compare the first identity information with first pre-stored identity information in the solid state drive; and determine that the host identity authentication is successful if the comparison results are consistent.

[0017] In one possible implementation, the permission control module is further used to determine whether the user role to which the sender of the authentication request belongs has the permission to access the target data when the access control policy is user role; to determine whether the user group to which the sender of the authentication request belongs has the permission to access the target data when the access control policy is user group; and to determine whether the target data requested by the sender of the authentication request has open access rights when the access control policy is data classification.

[0018] In one embodiment, the permission control module includes: The permission allocation module is used to allocate differentiated access permissions to different data for different hosts.

[0019] In one embodiment, the key management module includes: A key generation module is configured to generate a first random number using a true random number generator built into the solid-state drive, and to generate a first key based on the first random number, where the first key is used to encrypt the target data; obtain the user's PIN, generate a second random number using the true random number generator, and combine the user's PIN with the second random number to generate the second key; and encrypt and store the first key based on the second key so that the first key can be decrypted using the second key before decrypting the target data.

[0020] In one possible implementation, the data processing module is further used to encrypt the plaintext data in segments based on a secure transmission protocol, and add a sequence identifier and a timestamp in each encrypted segment; and encapsulate multiple data segments carrying the sequence identifier and timestamp.

[0021] In one possible implementation manner, the data processing module is further configured to add a hash value of the key information to a data packet header; after the host receives the encapsulated decryption result, the host verifies the hash value in the data packet header to verify the integrity of the key information.

[0022] In one possible implementation manner, the data processing module is further used to extract the hash value of the key information from the data packet header; perform hash calculation on the received key information to obtain a calculated hash value; compare the extracted hash value with the calculated hash value; if the two are consistent, the key information is determined to be complete; if the two are inconsistent, the key information is determined to be incomplete, and a key information retransmission request is sent to the solid-state drive.

[0023] In one possible implementation, the data processing module is further configured to split the encapsulated plaintext data into a plurality of data packets, each data packet containing a portion of the plaintext data and control information, and return the plurality of data packets to the host.

[0024] According to a third aspect of the present application, an electronic device is provided, including: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data processing method in the solid state drive described in this application.

[0025] According to a fourth aspect of the present application, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the data processing method in the solid-state hard disk described in the present application.

[0026] The embodiments of the present application provide a data processing method, device, electronic device and storage medium in a solid-state hard disk, and the method includes: receiving an authentication request sent by a host, and verifying the identity information of the host based on the authentication request; sending the identity information of the solid-state hard disk to the host; when both the host and the solid-state hard disk are verified, the solid-state hard disk establishes a secure communication session with the host; judging whether the host has the authority to access the target data according to a preset access control policy; decrypting the target data based on a first key; wherein the first key is in an encrypted storage state, and the first key is obtained by decrypting based on a second key, and the second key is generated based on the user's personal identification code PIN and a system random number; decrypting the target data based on the second key to obtain plaintext data corresponding to the target data; encapsulating the plaintext data, and returning the encapsulated decryption result to the host. In the implementation mode of the present application, a two-way identity authentication mechanism is used to effectively ensure the legitimacy of the identities of both communicating parties, block the access of illegal devices at the source, and improve the basic security of data interaction; by establishing a secure communication session, an encrypted channel is constructed for subsequent data transmission to prevent data from being stolen or tampered with during transmission; with the help of a preset access control policy, strict judgment is made on the host access rights, which can achieve refined management and control of access data of different hosts and avoid data leakage caused by unauthorized access; a double-layer key mechanism is adopted in which a second key generated based on the user PIN and the system random number decrypts the first key and then decrypts the target data by the first key, which greatly improves the key system's anti-cracking ability and enhances the encryption security of the target data; by encapsulating the plaintext data, the integrity and confidentiality of the data in the process of returning to the host are further guaranteed, and a full-link data protection mechanism covering identity authentication, permission control, multi-layer encryption and secure transmission is formed as a whole, which significantly improves the security and reliability of data processing in solid-state drives.

[0027] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The above and other objects, features and advantages of the exemplary embodiments of the present application will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present application are shown in an illustrative and non-limiting manner, in which: In the drawings, the same or corresponding reference numerals denote the same or corresponding parts.

[0029] Figure 1 The schematic diagram of the implementation process of the data processing method in the solid state drive provided by the embodiment of the present application is shown Figure 1 ; Figure 2 The schematic diagram of the implementation process of the data processing method in the solid state drive provided by the embodiment of the present application is shown Figure 2 ; Figure 3 A schematic diagram illustrating a process flow of implementing a user request to access data in a data processing method in a solid-state drive provided by an embodiment of the present application is shown; Figure 4 Schematic diagrams of key generation in a data processing method in a solid-state drive provided by an embodiment of the present application are shown, wherein (a) is a schematic diagram of generating a first key, and (b) is a schematic diagram of generating a second key; Figure 5 A schematic diagram showing the structure of a data processing device in a solid-state drive provided by an embodiment of the present application is shown; Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0030] In order to make the purpose, features, and advantages of this application more obvious and easy to understand, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of this application.

[0031] In the following description, reference is made to “some embodiments”, which describes a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0032] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0033] It should be understood that in the various embodiments of the present application, the size of the serial number of each implementation process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0034] In the embodiment of the present application, this data processing method is applied to a self-encrypting solid-state drive. A self-encrypting solid-state drive is a storage device with built-in encryption function, which can automatically encrypt data when it is written to the hard drive and automatically decrypt it when it is read. By integrating a user authentication program, a permission control program, a key management program and a data processing program in a self-encrypting solid-state drive, a complete data security protection system is constructed. Among them, the user authentication program is responsible for realizing two-way identity authentication between the host and the solid-state drive to ensure the legitimacy of the identities of both communicating parties; the permission control program strictly determines the host access rights based on the preset access control policy to achieve refined control of data access; the key management program is responsible for key generation, encryption storage and decryption call, and improves the security of data encryption through a double-layer key mechanism; the data processing program is responsible for the encapsulation, transmission and integrity verification of plaintext data to ensure the security and integrity of data during transmission. The above programs work together to form a full-link security mechanism covering identity authentication, permission control, key management and data transmission, effectively improving the security and reliability of data processing in solid-state drives.

[0035] Schematic diagram of the implementation process of the data processing method in the solid state drive provided in the embodiment of the present application Figure 1 ,like Figure 1 As shown, at least the following steps are included to protect data security when the host accesses the solid-state hard disk: Step S101: receiving an authentication request sent by a host, and verifying the identity information of the host based on the authentication request.

[0036] In some embodiments, the solid-state drive receives an authentication request sent by a host, where the authentication request carries identity information for verifying the identity of the host.

[0037] In some embodiments, the first pre-stored identity information is legal identity data written by a security management program of the solid-state drive during system initialization or host registration, and may be updated periodically during system operation to enhance security.

[0038] In some embodiments, the first identity information may be transmitted in an encrypted manner, and the solid-state drive decrypts the information after receiving it, and then compares it with the first pre-stored identity information.

[0039] In some embodiments, to prevent replay attacks, the solid-state drive may also perform validity verification on the timestamp or random number carried in the first identity information before comparison to ensure that the authentication request is generated in real time and has not been tampered with.

[0040] Step S102: Send the identity information of the solid state drive to the host.

[0041] In some embodiments, the identity information of the solid-state drive may include a unique device identifier, a digital certificate, public key information, or a pre-shared key identifier of the solid-state drive. The identity information is stored in a secure storage area of ​​the solid-state drive, which is tamper-resistant and anti-unauthorized access to ensure the authenticity and integrity of the identity information.

[0042] In some embodiments, the SSD's identity information can be encrypted before being sent, and a random number or timestamp can be appended to prevent it from being intercepted and replayed. After receiving the SSD's identity information, the host compares it with the SSD's identity information pre-stored in the host. If the comparison results are consistent, the SSD's identity verification is determined to be successful, thereby completing two-way authentication.

[0043] In some embodiments, the identity information of the solid-state drive can be generated and signed by a security chip built into the solid-state drive. After receiving it, the host confirms the identity of the solid-state drive by verifying the validity of the signature, thereby further enhancing the anti-counterfeiting and anti-tampering capabilities of the verification process.

[0044] Step S103: When both the host and the solid-state drive are verified, the solid-state drive establishes a secure communication session with the host.

[0045] In some embodiments, only when both the host and the solid-state drive are authenticated will a secure communication session be established between the two parties for encrypted transmission and integrity protection in subsequent data interaction processes.

[0046] In some embodiments, if either the host or the solid-state drive fails to pass verification, the secure communication session is refused to be established, and an error response message is returned to the party that failed verification, terminating the current access request, thereby preventing unauthorized devices from interacting with the solid-state drive.

[0047] Step S104: determining whether the host has permission to access the target data according to a preset access control policy.

[0048] In some embodiments, the SSD includes a permissions control program. Access control policies can be pre-configured by an administrator within the SSD's permissions control program and customized based on enterprise security policies. For example, an administrator can categorize target data into multiple levels based on importance, with different levels of data corresponding to different access roles or access groups. Upon receiving an access request, the SSD automatically makes authorization or denial decisions based on the policy.

[0049] In some embodiments, the access control policy may include at least one of a user role, a user group, and a data classification: In some embodiments, when the access control policy is based on user roles, the SSD determines whether the user role to which the host belongs has permission to access the target data. Specifically, the permission control program categorizes the host into predefined roles based on the roles recorded in the policy library. For example, predefined roles may include administrators, authorized users, and guests. The system configures differentiated access scopes and operational permissions for different roles. For example, administrators can access all or high-level data; authorized users can only access data segments related to their business; and guests can only access open data or be restricted to read-only access.

[0050] When receiving a request to access target data, the permission control program retrieves the minimum permitted role level for the data. If the permission level of the role to which the host belongs is not lower than the required level, it is determined to be authorized; otherwise, it is determined to be unauthorized and access is denied.

[0051] In some embodiments, when the access control policy is user group, the solid-state drive determines whether the user group to which the host belongs has permission to access the target data. Specifically, the permission control module queries the group permission list bound to the target data based on the group identifier of the host. The group permission list is a blacklist or whitelist of access groups pre-set by the administrator. If the group to which the host belongs appears in the permission list of the target data, or is not in the prohibition list and matches the whitelist policy, the determination is authorized; otherwise, the determination is unauthorized.

[0052] In some embodiments, when the access control policy is data classification, the solid-state drive determines whether the target data belongs to the open access category, or whether a higher level of authorization is required for access. Specifically, the target data will be labeled with a classification label when it is created or imported, such as open, restricted, confidential, etc., and a locked state can be set. The permission control program reads the classification label and compares it with the role or group attributes of the host. The comparison basis can be: for open data, hosts that have passed authentication can access it directly; for restricted or confidential data, access is allowed only when the host meets the specified role or group conditions, or has a higher level of authorization, otherwise it is denied and the data segment remains locked.

[0053] In some embodiments, the system can select one or more of the above strategies and simultaneously enable them. If any strategy is not met, the system determines that the access is unauthorized. If the determination is unauthorized, the SSD will return an access denial prompt and record an audit log. If the access is authorized, the judgment result will be bound to the current session for quick reuse later.

[0054] Step S105, decrypting the target data based on the first key; wherein the first key is in an encrypted storage state, and the first key is decrypted based on the second key, and the second key is generated based on the user's personal identification code PIN and a system random number.

[0055] In some embodiments, after receiving the access authorization determination result, the solid-state drive reads a first key in an encrypted storage state from a local key storage area, where the first key may be a data encryption key used to encrypt or decrypt target data, and the second key may be a key encryption key used to encrypt or decrypt the data encryption key. The solid-state drive decrypts the first key based on the second key to obtain the first key in plaintext.

[0056] In some embodiments, to prevent key exposure, the plaintext first key only exists briefly in the memory and is used to decrypt the target data. It is immediately cleared after decryption is completed to reduce the risk of theft.

[0057] In some embodiments, the second key is generated by combining the user's PIN with a system-generated random number.

[0058] In some embodiments, to prevent attackers from obtaining the second key by exhaustively enumerating the user's PIN, the SSD can limit the number of PIN entry attempts. For example, if the user enters the PIN incorrectly more than a preset number of times, a lock mechanism is triggered, temporarily prohibiting further decryption requests or requiring the administrator to reset the device through a secure recovery process.

[0059] Step S106: decrypt the target data based on the second key to obtain plaintext data corresponding to the target data.

[0060] In some embodiments, after completing the decryption of the first key in step S105, the solid-state drive can also directly decrypt the target data based on the second key to cope with the scenario of double encryption. For example, when the target data undergoes two layers of encryption before storage: the first layer is encrypted using the first key and the second layer is encrypted using the second key, in order to obtain the plaintext of the data, a second round of decryption must be performed after the first round of decryption.

[0061] Before performing the decryption operation, the solid-state drive can first read the encryption algorithm identifier corresponding to the target data, such as AES-256, SM4, etc., to ensure that the algorithm and key length consistent with those used during encryption are used.

[0062] Step S107: encapsulate the plaintext data and return the encapsulated decryption result to the host.

[0063] In some embodiments, the plaintext data is encapsulated, including: encrypting the plaintext data in segments based on a secure transmission protocol, and adding a sequence identifier and a timestamp in each encrypted segment; and encapsulating multiple data segments carrying sequence identifiers and timestamps.

[0064] Specifically, after obtaining the plaintext content of the target data, the SSD invokes a built-in data processing program to perform segmented encryption on the plaintext data based on secure transmission protocols such as Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS). Segmented encryption avoids cache pressure caused by processing large data blocks all at once, facilitates data retransmission during transmission, and enhances data security. Even if a data packet is intercepted, the complete data cannot be inferred from it.

[0065] During segment encryption, the SSD adds a sequence identifier and timestamp to each encrypted segment. For example, the sequence identifier can be an increasing 64-bit unsigned integer, indicating the segment's position in the original data stream. The timestamp, generated by the SSD's built-in real-time clock module with millisecond accuracy, identifies the generation time of the data segment and prevents replay attacks. Both the sequence identifier and timestamp are embedded in the data segment's control header in plaintext before encryption, ensuring that the host can restore the original sequence and verify data timeliness after decryption.

[0066] In some embodiments, if the plaintext data contains key information, the encapsulation processing of the plaintext data also includes: adding the hash value of the key information to the data packet header; after the host receives the encapsulated decryption result, the hash value in the data packet header is verified to verify the integrity of the key information.

[0067] In some embodiments, if the plaintext data contains key information, such as a data encryption key, the SSD will additionally calculate a hash value for the key information during the packaging phase. The hash algorithm can be SHA-256, SHA-3, or any other algorithm that can calculate a hash value for the key information. The calculated hash value is directly added to the integrity field of the packet header, and the field itself is also encrypted to prevent attackers from tampering with the hash value.

[0068] In some embodiments, after receiving the encapsulated data packet, the host verifies the hash value in the data packet header to verify the integrity of the key information. The verification process specifically includes: The encrypted hash value is extracted from the packet header and decrypted; the hash value is recalculated for the received key information; the two hash values ​​are compared. If they match, the key information is considered intact and can continue to be used. If they do not match, the key information is determined to have been tampered with or transmitted incorrectly, and a key information retransmission request is immediately sent to the SSD, terminating the current data processing flow. This mechanism ensures the integrity of key security parameters and prevents data leakage or unavailability caused by key tampering.

[0069] In some embodiments, the encapsulated plaintext data will be divided into multiple data packets, each data packet contains: part of the plaintext data, control information, such as sequence identifier, timestamp, data length, encryption algorithm identifier, etc. The solid-state drive sends the data packets to the host end in ascending order of the sequence identifier.

[0070] In some embodiments, if the transmission environment is unreliable, out-of-order reordering and packet retransmission mechanisms based on sequence identifiers and timestamps can be enabled to ensure data integrity and recoverability. On the host side, multiple received data packets are first sorted, the validity of each packet's timestamp is verified, and then reassembled into a complete plaintext data stream for use by upper-layer applications or file systems.

[0071] In some embodiments, the data processing program supports multiple communication protocols, such as Non-Volatile Memory Express (NVMe) and Serial Advanced Technology Attachment (SATA), and provides a standardized command interface to ensure compatibility with different types of host devices. During transmission, the plaintext data is re-encoded to adapt to the frame structure and transmission rules of the selected communication protocol, and security enhancements are incorporated into the encoding process to effectively prevent illegal playback and forgery.

[0072] In some embodiments, step S101 may include at least one or more of steps S101a to S101c. Specifically, the implementation flow of the data processing method in the solid-state drive provided in the embodiment of the present application is as follows: Figure 2 ,like Figure 2 As shown: In step S101a, the solid state drive receives first identity information sent by the host.

[0073] In this embodiment, the first identity information may be a unique identifier of the host, a digital certificate, public key information, or a pre-shared key identifier, etc.

[0074] In step S101b, the solid state drive compares the first identity information with first pre-stored identity information in the solid state drive.

[0075] Step S101c: If the comparison results are consistent, it is determined that the host identity authentication has passed.

[0076] In some embodiments, the solid-state drive compares the first identity information with the first pre-stored identity information pre-stored in its internal secure storage area. Specifically, a flowchart of a user request to access data implementation of a data processing method in a solid-state drive provided in an embodiment of the present application is as follows: Figure 3 As shown: When the comparison results are consistent, it is determined that the host identity authentication is passed, and step S104 is executed to determine whether the host has the authority to access the target data and whether the user has the authorization to access the target data segment according to the preset access control policy.

[0077] If the authentication fails, the host is denied access and an error message is returned.

[0078] If the host has the authority to access the target data, step S105 is executed to decrypt the target data based on the first key. Successful decryption allows access to the target data.

[0079] If the host does not have permission to access the target data, the host's access is denied and an error message is returned.

[0080] The present application provides a method for processing data in a solid-state drive. Before determining whether the host has permission to access target data according to a preset access control policy, the method further includes: Assign differentiated access permissions to different data for different hosts.

[0081] In some embodiments, an administrator can log in to a system management platform through the SSD's management interface, preset multiple user roles or user groups in the platform interface, and configure a corresponding access permission list for each role or user group. The access permission list is used to define the scope of target data that can be accessed, the types of operations that can be performed, such as reading, writing, deleting, and modifying, and whether to allow unlocking of encrypted data segments.

[0082] In actual operation, when a host initiates an access request, the SSD determines the user role or group to which the host belongs based on the verified host identity information and loads the corresponding access policy from a pre-stored access permission list. Only if the access policy explicitly allows access to the requested target data and the corresponding security conditions are met will the SSD allow subsequent key decryption and data processing operations. Otherwise, the system denies access and records it in the security log for subsequent audit.

[0083] The data processing method in a solid state drive provided by the present application further includes generating a first key and a second key. Specifically, a schematic diagram of key generation of the data processing method in a solid state drive provided by an embodiment of the present application is shown in FIG. Figure 4 As shown: In some embodiments, before decrypting the target data based on the first key, Figure 4In the schematic diagram of generating the first key shown in (a), the method further includes: generating a first random number using a true random number generator built into the solid-state drive, and generating a first key based on the first random number using a key derivation function, wherein the first key is used to encrypt the target data; In some embodiments, before decrypting the target data based on the first key, Figure 4 In the second key generation schematic diagram shown in (b), the method further includes: obtaining the user PIN, generating a second random number using the true random number generator, combining the user PIN and the second random number to generate the second key using a key derivation function; and encrypting and storing the first key based on the second key, so as to obtain the first key by decrypting the target data using the second key before decrypting the target data.

[0084] In some embodiments, a True Random Number Generator (TRNG) built into the solid-state drive generates a first random number based on the locked range divided in the data, and generates a first key based on the first random number, where the first key is used to encrypt the target data. For example, the first random number generated by the TRNG can be a 256-bit high-entropy random bit sequence. This random number is processed by a Key Derivation Function (KDF) to obtain the first key, namely the Data Encryption Key (DEK). After generation, the key is directly written to the secure storage area within the solid-state drive and marked as encrypted.

[0085] In some embodiments, after receiving a user PIN input by a user, the solid-state drive generates a second random number through the true random number generator, and combines the user PIN with the second random number to generate the second key, namely, a key encryption key (KEK).

[0086] In some embodiments, the second key is used to encrypt and store the first key. Specifically, the first key is encrypted using an encryption algorithm and stored in a secure area of ​​the solid-state drive. During encryption, the second random number can be stored together with the encrypted first key so that the second random number can be used to regenerate the second key during the decryption phase, thereby decrypting the first key.

[0087] Through the above-mentioned dual-layer key generation mechanism, the solid-state drive can ensure that even if the encrypted storage file of the first key is illegally obtained, it cannot be decrypted to obtain the first key without the correct user PIN, thereby preventing the target data from being accessed or leaked without authorization.

[0088] In the embodiment of the present application, by sequentially executing steps such as user authentication, access authority determination, key management, and data processing, secure and reliable data interaction is achieved between the solid-state drive and the host. The user authentication program ensures the legal identity of both communicating parties and prevents unauthorized devices from accessing; the authority control program accurately limits the access scope of different hosts to different data based on the preset access control policy to avoid unauthorized operations; the key management program uses a method based on random numbers and user PINs to generate and protect keys to ensure the security of data encryption keys during storage and transmission; the data processing program encapsulates, encrypts, adds sequence identification and integrity verification information to the plain text before returning the data, thereby preventing data tampering and loss while supporting multiple communication protocols. Therefore, the embodiment of the present application not only improves the data security protection level of the solid-state drive, but also enhances the system's adaptability to multiple types of hosts and multiple usage scenarios.

[0089] In the above embodiments of the present application, the solid-state drive may be a solid-state storage device using NAND flash memory or other non-volatile storage media, such as an SSD with an NVMe interface or an SSD with a SATA interface. The method of the present application is not limited to the above-mentioned solid-state drive types and may also be applied to other storage devices with data encryption and security management functions.

[0090] An optional structural diagram of a data processing device in a solid state drive provided in an embodiment of the present application is shown in FIG. Figure 5 As shown, the data processing device 500 in the solid state drive includes at least: The identity authentication module 501 is configured to receive an authentication request from a host, verify the identity information of the host based on the authentication request, send the identity information of the solid-state drive to the host, and establish a secure communication session between the solid-state drive and the host if both the host and the solid-state drive are authenticated. The permission control module 502 is used to determine whether the host has permission to access the target data according to a preset access control policy; The key management module 503 is configured to decrypt the target data based on a first key, wherein the first key is in an encrypted stored state and is decrypted based on a second key, wherein the second key is generated based on a user's personal identification number (PIN) and a system random number; the target data is decrypted based on the second key to obtain plaintext data corresponding to the target data; The data processing module 504 is used to encapsulate the plaintext data and return the encapsulated plaintext data to the host.

[0091] In some embodiments, the identity authentication module 501 is further configured to receive first identity information sent by the host; compare the first identity information with first pre-stored identity information in the solid state drive; and if the comparison results are consistent, determine that the host identity authentication is successful.

[0092] In some embodiments, the permission control module 502 is also used to determine whether the user role to which the sender of the authentication request belongs has the permission to access the target data when the access control policy is user role; to determine whether the user group to which the sender of the authentication request belongs has the permission to access the target data when the access control policy is user group; and to determine whether the target data requested by the sender of the authentication request has open access rights when the access control policy is data classification.

[0093] In some embodiments, the permission control module 502 includes: The permission allocation module 505 is used to allocate differentiated access permissions to different data for different hosts.

[0094] In some embodiments, the key management module 503 includes: The key generation module 506 is configured to generate a first random number using a true random number generator built into the solid-state drive, and generate a first key based on the first random number, where the first key is used to encrypt the target data; obtain the user PIN, generate a second random number using the true random number generator, and combine the user PIN with the second random number to generate a second key; and encrypt and store the first key based on the second key so that the first key can be decrypted using the second key before decrypting the target data.

[0095] In some embodiments, the data processing module 504 is further used to encrypt the plaintext data in segments based on a secure transmission protocol, and add a sequence identifier and a timestamp in each encrypted segment; and encapsulate multiple data segments carrying sequence identifiers and timestamps.

[0096] In some embodiments, the data processing module 504 is further configured to add a hash value of the key information to a data packet header; after the host receives the encapsulated decryption result, the host verifies the hash value in the data packet header to verify the integrity of the key information.

[0097] In some embodiments, the data processing module 504 is also used to extract the hash value of the key information from the data packet header; perform hash calculation on the received key information to obtain a calculated hash value; compare the extracted hash value with the calculated hash value; if the two are consistent, the key information is determined to be complete; if the two are inconsistent, the key information is determined to be incomplete, and a key information retransmission request is sent to the solid-state drive.

[0098] In some embodiments, the data processing module 504 is further configured to segment the encapsulated plaintext data into multiple data packets, each data packet containing a portion of the plaintext data and control information, and return the multiple data packets to the host.

[0099] A structural diagram of an electronic device provided in an embodiment of the present application is as follows Figure 6 , a schematic block diagram of an example electronic device 800 that can be used to implement an embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The devices shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or claimed herein.

[0100] like Figure 6 As shown, electronic device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. Various programs and data required for the operation of electronic device 800 may also be stored in RAM 803. Computing unit 801, ROM 802, and RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to bus 804.

[0101] Multiple devices in the electronic device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a magnetic disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the electronic device 800 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0102] The computing unit 801 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above, such as the data processing method in a solid-state drive. For example, in some embodiments, the data processing method in a solid-state drive can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 808. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the data processing method in a solid-state drive described above can be performed. Alternatively, in other embodiments, the computing unit 801 can be configured to perform the data processing method in a solid-state drive by any other suitable means (e.g., via firmware).

[0103] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0104] The program code for implementing the methods of the present application can be written in any combination of one or more programming languages. Such program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the program code is executed by the processor or controller, the functions / operations specified in the flow charts and / or block diagrams are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0105] In the context of this application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or electronic device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or electronic device, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fibers, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0106] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0107] The systems and techniques described herein can be implemented in a computing system that includes back-end devices (e.g., as data servers), or a computing system that includes middleware devices (e.g., application servers), or a computing system that includes front-end devices (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end devices, middleware devices, or front-end devices. The devices of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0108] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises through computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0109] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this application can be achieved. This is not a limitation herein.

[0110] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A data processing method in a solid-state hard disk, wherein the data processing method in the solid-state hard disk is applied to the solid-state hard disk, characterized in that: The data storage method in the solid state drive includes: receiving an authentication request sent by a host, and verifying the identity information of the host based on the authentication request; Sending the identity information of the solid state drive to the host; When both the host and the solid-state drive are authenticated, the solid-state drive establishes a secure communication session with the host; Determining whether the host has permission to access the target data according to a preset access control policy; Decrypting the target data based on a first key; wherein the first key is in an encrypted stored state and is decrypted based on a second key, and the second key is generated based on a user's personal identification code (PIN) and a system random number; decrypting the target data based on the second key to obtain plaintext data corresponding to the target data; The plaintext data is encapsulated and the encapsulated decryption result is returned to the host.

2. The method according to claim 1, characterized in that The verifying the identity information of the host based on the authentication request includes: The solid-state drive receives the first identity information sent by the host; The solid state drive compares the first identity information with first pre-stored identity information in the solid state drive; If the comparison results are consistent, it is determined that the host identity authentication has passed.

3. The method according to claim 1, characterized in that The determining whether the host has permission to access the target data according to a preset access control policy includes: The access control policy includes at least one of user role, user group, and data classification; In the case where the access control policy is a user role, determining whether the user role to which the sender of the authentication request belongs has permission to access the target data; In the case where the access control policy is a user group, determining whether the user group to which the sender of the authentication request belongs has permission to access the target data; In a case where the access control policy is data classification, it is determined whether the target data requested by the sender of the authentication request has open access rights.

4. The method according to claim 3, characterized in that Before determining whether the host has permission to access the target data according to the preset access control policy, the method further includes: Assign differentiated access permissions to different data for different hosts.

5. The method according to claim 1, wherein Before decrypting the target data based on the first key, the method further includes: Generate a first random number using a true random number generator built into the solid-state drive, and generate a first key based on the first random number, where the first key is used to encrypt the target data; Obtaining the user's PIN, generating a second random number using the true random number generator, and combining the user's PIN with the second random number to generate the second key; The first key is encrypted and stored based on the second key, so that the first key is obtained by decrypting the target data using the second key before the target data is decrypted.

6. The method according to claim 1, characterized in that The encapsulating the plaintext data includes: Encrypting the plaintext data in segments based on a secure transmission protocol, and adding a sequence identifier and a timestamp to each encrypted segment; Multiple data segments carrying sequence identifiers and timestamps are encapsulated.

7. The method according to claim 6, characterized in that If the plaintext data includes key information, the encapsulating the plaintext data further includes: Adding the hash value of the key information to the data packet header; After receiving the encapsulated decryption result, the host verifies the hash value in the data packet header to verify the integrity of the key information.

8. The method according to claim 7, characterized in that Verifying the integrity of the key information by checking the hash value in the data packet header includes: Extracting a hash value of the key information from the data packet header; Performing hash calculation on the received key information to obtain a calculated hash value; The extracted hash value is compared with the calculated hash value; if the two are consistent, the key information is determined to be complete; if the two are inconsistent, the key information is determined to be incomplete, and a key information retransmission request is sent to the solid state drive.

9. The method according to claim 1, characterized in that The step of returning the encapsulated decryption result to the host comprises: Split the encapsulated plaintext data into multiple data packets, each of which contains part of the plaintext data and control information; The plurality of data packets are returned to the host.

10. A data processing device in a solid state hard disk, characterized in that: The data processing device in the solid state hard disk includes: an identity authentication module, configured to receive an authentication request from a host, verify the identity information of the host based on the authentication request, send the identity information of the solid-state drive to the host, and establish a secure communication session between the solid-state drive and the host if both the host and the solid-state drive are authenticated; The permission control module is used to determine whether the host has the permission to access the target data according to the preset access control policy; a key management module, configured to decrypt the target data based on a first key; wherein the first key is in an encrypted stored state and is decrypted based on a second key, wherein the second key is generated based on a user's personal identification number (PIN) and a system random number; and decrypt the target data based on the second key to obtain plaintext data corresponding to the target data; The data processing module is used to encapsulate the plaintext data and return the encapsulated plaintext data to the host.

11. The data processing device in a solid state drive according to claim 10, wherein: The identity authentication module is further configured to receive first identity information sent by the host; compare the first identity information with first pre-stored identity information in the solid state drive; and determine that the host identity authentication is passed if the comparison results are consistent.

12. The data processing device in a solid state drive according to claim 10, wherein: The authority control module is further configured to, when the access control policy is a user role, determine whether the user role to which the sender of the authentication request belongs has the authority to access the target data; when the access control policy is a user group, determine whether the user group to which the sender of the authentication request belongs has the authority to access the target data; In a case where the access control policy is data classification, it is determined whether the target data requested by the sender of the authentication request has open access rights.

13. The data processing device in a solid state drive according to claim 12, wherein: The authority control module includes: The permission allocation module is used to allocate differentiated access permissions to different data for different hosts.

14. The data processing device in a solid state drive according to claim 10, wherein: The key management module includes: A key generation module is configured to generate a first random number using a true random number generator built into the solid-state drive, and to generate a first key based on the first random number, where the first key is used to encrypt the target data; obtain the user's PIN, generate a second random number using the true random number generator, and combine the user's PIN with the second random number to generate the second key; and encrypt and store the first key based on the second key so that the first key can be decrypted using the second key before decrypting the target data.

15. The data processing device in a solid state drive according to claim 10, wherein: The data processing module is further used to encrypt the plaintext data in segments based on a secure transmission protocol, and add a sequence identifier and a timestamp to each encrypted segment; and encapsulate multiple data segments carrying the sequence identifier and timestamp.

16. The data processing device in a solid state drive according to claim 15, wherein: If the plaintext data contains key information, the data processing module is further used to add the hash value of the key information to the data packet header; after the host receives the encapsulated decryption result, it verifies the hash value in the data packet header to verify the integrity of the key information.

17. The data processing device in a solid state drive according to claim 16, wherein: The data processing module is further configured to extract a hash value of the key information from the data packet header; perform a hash calculation on the received key information to obtain a calculated hash value; compare the extracted hash value with the calculated hash value; and if the two values ​​are consistent, determine that the key information is complete; If the two are inconsistent, it is determined that the key information is incomplete, and a key information retransmission request is sent to the solid state drive.

18. The data processing device in a solid state drive according to claim 10, wherein: The data processing module is further used to divide the encapsulated plaintext data into multiple data packets, each data packet containing part of the plaintext data and control information, and return the multiple data packets to the host.

19. An electronic device, characterized in that: include: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data processing method in the solid state drive according to any one of claims 1 to 9.

20. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to enable a computer to execute the data processing method in a solid state drive according to any one of claims 1 to 9.

Images