Encrypted solid state disk-based exception handling method and system

Abstract

The invention relates to the technical field of solid state disks, in particular to an encryption-based solid state disk exception handling method and system. The method comprises the steps of obtaining an access request sequence and an encryption state identifier, analyzing a request based on a state conversion rule to obtain a feature set, matching a target logic address to determine a physical storage area and an encryption domain identifier, judging whether an encryption domain consistency constraint is met or not, and if not, generating an abnormal mark and executing corresponding processing. Meanwhile, the state conversion rule is dynamically adjusted through feedback information. The access safety of the encrypted solid state disk can be improved, the abnormity recognition accuracy is adaptively optimized, and the reliability of a storage system is enhanced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of solid state disks, in particular to an abnormality processing method and system based on an encrypted solid state disk. BACKGROUND

[0002] With the increasing demand for information security, encrypted solid state disks, as key devices for data security protection, are widely used in important fields such as government, finance, and medical care. Encrypted solid state disks protect stored data through hardware-level encryption technology, ensuring data security even in the event of device loss or theft. Current encrypted solid state disks usually adopt a multi-encryption domain architecture, with different data regions corresponding to different keys and security policies, thereby achieving more refined access control and data isolation.

[0003] In actual application, encrypted solid state disks need to handle a large number of complex access requests, which involve data interaction between different encryption domains and need to ensure that access behaviors of various data comply with predetermined security policies. Traditional encrypted solid state disks manage data security through static security policies and fixed access control mechanisms, but as application scenarios diversify and attack methods become more complex, these static security mechanisms exhibit obvious deficiencies in abnormality processing.

[0004] The existing encrypted solid state disk technology has the following defects in abnormality processing: lack of dynamic analysis capability for access request sequences, unable to effectively identify attack patterns that are normal in single access but abnormal in sequence behavior, leading to some carefully designed unauthorized access being undetected; the existing technology uses a simple access denial strategy to handle abnormalities, lacks a hierarchical response mechanism, and cannot take corresponding differentiated processing measures according to the severity and type of abnormalities, affecting system usability and user experience; the abnormality processing mechanism of the existing encrypted solid state disk lacks adaptive learning capability and cannot dynamically adjust security policies according to historical processing results, resulting in limited protection capability when facing new attack methods and difficulty in adapting to changing security threat environment. SUMMARY

[0005] The embodiments of the present application provide an abnormality processing method and system based on an encrypted solid state disk, which can at least solve some problems in the prior art.

[0006] In a first aspect, the embodiments of the present application provide an abnormality processing method based on an encrypted solid state disk, comprising: obtaining an access request sequence and a corresponding encryption state identifier generated by the encrypted solid state disk during operation; analyzing each access request in the access request sequence based on a preset state transition rule to obtain a request feature set; According to the target logical address in the request feature set and the address mapping relationship maintained inside the encrypted solid state disk, a physical storage area corresponding to the target logical address and an encryption domain identifier associated with the physical storage area are determined, and a region mapping result is obtained; According to the region mapping result, the encryption state identifier, and the key index information in the access request, it is judged whether the current access request satisfies the encryption domain consistency constraint. If not, an exception marker is generated, and the corresponding processing strategy is determined based on the exception type of the exception marker, and an exception processing instruction is obtained; Based on the exception processing instruction, the access request is executed to reject, redirect or key renegotiation operation, and the processing result is used as feedback information. The state transition rule is dynamically adjusted using the feedback information to adaptively optimize the accuracy of exception identification.

[0007] According to the preset state transition rule, each access request in the access request sequence is parsed to obtain a request feature set, including: According to the access request structure template defined in the preset state transition rule, each access request in the access request sequence is field segmented to identify the command field, address field and additional information field in the access request, and a field combination is obtained; For the command field in the field combination, the command field is converted into a standardized operation type identifier by querying the command type mapping table maintained in the preset state transition rule, and an operation type is obtained. For the address field in the field combination, the logical address information carried in the address field is extracted, and the logical address information is taken as a target logical address. At the same time, the key index identifier is parsed from the additional information field to obtain address and key association information. Based on the request validity verification condition defined in the preset state transition rule, the operation type, the target logical address and the key index identifier are integrity verified, and the operation type, the target logical address and the key index identifier that pass the integrity verification are combined to form the request feature set.

[0008] According to the target logical address in the request feature set and the address mapping relationship maintained inside the encrypted solid state disk, a physical storage area corresponding to the target logical address and an encryption domain identifier associated with the physical storage area are determined, and a region mapping result is obtained, including: The target logical address is extracted from the request feature set, and a corresponding mapping item set is found in the address mapping relationship maintained inside the encrypted solid state disk according to the target logical address; In the mapping table item set, by interval matching the target logical address with logical address segments in each mapping table item, a target mapping table item containing the target logical address is determined, and a physical storage area identifier to which the target logical address is mapped is read from the target mapping table item to obtain a physical region positioning result; Based on the physical storage area identifier in the physical region positioning result, an encryption domain management structure maintained inside the encrypted solid state disk is accessed, and an encryption domain identifier associated with the physical storage area identifier and key version information corresponding to the encryption domain identifier are queried from the encryption domain management structure to obtain encryption domain association information. The physical storage area identifier in the physical region positioning result and the encryption domain identifier and key version information in the encryption domain association information are structurally combined to obtain the region mapping result.

[0009] Based on the physical storage area identifier in the physical region positioning result, an encryption domain management structure maintained inside the encrypted solid state disk is accessed, and an encryption domain identifier associated with the physical storage area identifier and key version information corresponding to the encryption domain identifier are queried from the encryption domain management structure to obtain encryption domain association information, including: According to the region coding attribute of the physical storage area identifier, a physical grouping identifier to which the physical storage area belongs is determined to obtain grouping attribution information; Based on the physical grouping identifier in the grouping attribution information, an encryption domain configuration table corresponding to the physical grouping identifier is located in the encryption domain management structure; In the encryption domain configuration table, by matching the physical storage area identifier with physical storage area identifier ranges recorded in each entry of the encryption domain configuration table, a target encryption domain entry to which the physical storage area identifier belongs is determined, and a corresponding encryption domain identifier is read from the target encryption domain entry to obtain a domain identifier query result; Based on the encryption domain identifier in the domain identifier query result, a key version index table maintained in the encryption domain management structure is accessed, and a currently valid key version identifier associated with the encryption domain identifier and a key life cycle state corresponding to the key version identifier are retrieved from the key version index table to obtain a key version query result; The encryption domain identifier in the domain identifier query result and the currently valid key version identifier and key life cycle state in the key version query result are associated and integrated to obtain the encryption domain association information.

[0010] determining whether the current access request satisfies the consistency constraint of the encryption domain according to the region mapping result, the encryption state identifier, and the key index information in the access request, generating an exception marker if the consistency constraint is not satisfied, and determining a corresponding processing strategy based on an exception type of the exception marker to obtain an exception processing instruction, including: comparing a request key identifier indicated in the key index information with a current valid key version identifier recorded in the key version information associated with the encryption domain identifier to obtain a key consistency determination result; checking a key lifecycle state in the key version information based on the key consistency determination result to determine whether the key corresponding to the request key identifier is in an invalid state or a rotation state, and determining whether the encryption solid state disk is in a key migration process in combination with a global encryption state to obtain an exception cause analysis result; based on the exception cause analysis result, if it is determined that the current access request does not satisfy the consistency constraint of the encryption domain, generating an exception marker containing an exception type identifier, and the exception type identifier generates a classified exception marker according to the inconsistent reason identified in the exception cause analysis result; based on the exception type identifier in the classified exception marker, querying a processing strategy template corresponding to the exception type identifier in a preset exception processing strategy mapping table; generating an exception processing instruction according to the processing strategy template and the physical storage region identifier in the region mapping result.

[0011] checking a key lifecycle state in the key version information based on the key consistency determination result to determine whether the key corresponding to the request key identifier is in an invalid state or a rotation state, and determining whether the encryption solid state disk is in a key migration process in combination with a global encryption state to obtain an exception cause analysis result, including: based on the key consistency determination result, if it is determined that the request key identifier is inconsistent with the current valid key version identifier, extracting a key lifecycle state identifier associated with the request key identifier from the key version information, and extracting a system-level key management state identifier of the encryption solid state disk from the global encryption state to obtain a state information set; based on the key lifecycle state identifier in the state information set, determining the current lifecycle phase of the key corresponding to the request key identifier, and determining whether the key is in an invalid state or a rotation transition state to obtain a key state determination result; based on the system-level key management state identifier in the state information set, determining whether the encryption solid state disk is performing a key migration operation across encryption domains to obtain a system state determination result; According to the key state judgment result and the system state judgment result, an abnormal reason is classified into a key invalidation type abnormal reason, a key version mismatch type abnormal reason or a key migration conflict type abnormal reason, and an abnormal reason analysis result including the abnormal reason category and corresponding state basis is obtained.

[0012] Based on the abnormal processing instruction, a rejection, redirection or key renegotiation operation is performed on the access request, and a processing result is taken as feedback information, and the state transition rule is dynamically adjusted by using the feedback information to adaptively optimize the abnormal identification accuracy, including: A processing action type and a target physical storage area identifier are extracted from the abnormal processing instruction, and a target operation type of access rejection operation, request redirection operation or key renegotiation operation is determined according to the processing action type, and an operation type determination result is obtained; Based on the operation type determination result, if the target operation type is the access rejection operation, a rejection response is returned to a request source initiating the access request, and an abnormal type identifier in the abnormal processing instruction is carried in the rejection response; If the target operation type is the request redirection operation, the access request is redirected to a backup physical storage area according to the target physical storage area identifier; If the target operation type is the key renegotiation operation, a key negotiation process with the request source is started based on a key negotiation parameter in the abnormal processing instruction; The processing result is taken as feedback information, the feedback information is written into an abnormal processing log, and a request feature set of the access request and an abnormal type identifier in the abnormal processing instruction are associated and recorded in the abnormal processing log, an abnormal processing tracing record is obtained to adaptively update the state transition rule.

[0013] In a second aspect of the embodiment of the application, an abnormal processing system based on an encrypted solid state disk is provided, including: A first unit is configured to obtain an access request sequence and corresponding encryption state identifiers generated by an encrypted solid state disk during running; A second unit is configured to analyze each access request in the access request sequence based on a preset state transition rule to obtain a request feature set; A third unit is configured to match a target logical address in the request feature set with an address mapping relationship maintained inside an encrypted solid state disk to determine a physical storage area corresponding to the target logical address and an encryption domain identifier associated with the physical storage area, and obtain a region mapping result; The fourth unit is configured to determine whether the current access request meets the consistency constraint of the encryption domain according to the region mapping result, the encryption state identifier, and the key index information in the access request, generate an exception marker if the consistency constraint is not met, determine a corresponding processing strategy based on an exception type of the exception marker, and obtain an exception processing instruction. The fifth unit is configured to perform rejection, redirection, or key renegotiation operation on the access request based on the exception processing instruction, and use a processing result as feedback information to dynamically adjust the state conversion rule to adaptively optimize the accuracy of exception identification.

[0014] In a third aspect, the embodiment of the present application provides an electronic device, comprising: a processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method described above.

[0015] In a fourth aspect, the embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon, and the computer program instructions are executed by a processor to implement the method described above.

[0016] The present application can accurately determine whether the access request meets the consistency constraint of the encryption domain by obtaining the access request sequence of the solid state disk and the encryption state identifier, analyzing the request feature set based on the preset state conversion rule, and determining the physical storage area and the encryption domain identifier through the address mapping relationship matching.

[0017] The present application generates an exception marker and formulates a corresponding processing strategy for the case of not meeting the consistency constraint of the encryption domain, realizes the differentiated processing mechanism of rejection, redirection, or key renegotiation, significantly improves the flexibility and adaptability of the system in processing abnormal conditions, and guarantees the stable operation and data security of the encryption storage system.

[0018] The present application dynamically adjusts the state conversion rule by taking the processing result as feedback information, forms a self-adaptive optimization closed-loop control mechanism, can continuously optimize the accuracy of exception identification according to the actual operation condition, reduces the misjudgment rate, and improves the security performance and user experience of the encryption solid state disk in complex application scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 The figure is a flowchart of the encryption solid state disk exception processing method according to the embodiment of the present application.

[0020] Figure 2 The figure is a flowchart of generating an exception processing instruction according to the embodiment of the present application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0023] Figure 1 This is a flowchart illustrating the anomaly handling method based on encrypted solid-state drives according to an embodiment of the present invention. Figure 1 As shown, the method includes: Obtain the sequence of access requests generated by the encrypted solid-state drive during operation and the corresponding encryption status identifiers; Each access request in the access request sequence is parsed based on preset state transition rules to obtain a set of request features; The target logical address in the request feature set is matched with the address mapping relationship maintained internally by the encrypted solid-state drive to determine the physical storage area corresponding to the target logical address and the encrypted domain identifier associated with the physical storage area, thus obtaining the area mapping result; Based on the region mapping result, the encryption status identifier, and the key index information in the access request, it is determined whether the current access request satisfies the encryption domain consistency constraint. If it does not, an exception flag is generated, and the corresponding processing strategy is determined based on the exception type of the exception flag to obtain the exception handling instruction. Based on the anomaly handling instructions, the access request is denied, redirected, or key renegotiation is performed, and the processing result is used as feedback information. The state transition rules are dynamically adjusted using the feedback information to adaptively optimize the anomaly identification accuracy.

[0024] This embodiment addresses the security vulnerability of existing encrypted solid-state drives in multi-tenant environments, where encrypted domain out-of-bounds access is a common issue.

[0025] In this embodiment, the encrypted solid-state drive (SSD) can be equipped with multiple encryption domains, each with its own encryption key. When the system is running, the encrypted SSD receives access requests from different applications or users. To ensure data security, the legitimacy of these requests needs to be monitored and verified in real time.

[0026] First, the access request sequence generated by the encrypted solid state disk during operation and the corresponding encryption state identifier are acquired. The access request sequence includes multiple access requests, and each access request includes at least operation type, target logical address, data length, key index information, etc. For example, a typical access request can be represented as {READ, LBA:0x8000, Length:4KB, KeyIndex:2}, which means reading 4KB data starting from logical address 0x8000 using key index 2. The encryption state identifier records the current encryption running state of the solid state disk, including the list of activated encryption domains, the key state of each encryption domain, etc. For example, the encryption state identifier can be represented as {ActiveDomains:[1,2,3], DomainKeyStatus:{1:valid, 2:valid, 3:pending}}, which means there are three activated encryption domains, and the keys of domains 1 and 2 are valid, and the key of domain 3 is in a pending state.

[0027] The specific implementation of acquiring the access request sequence can be achieved by setting a listening point in the command queue management module of the solid state disk controller, and capturing all access commands entering the command queue in real time. The encryption state identifier can be acquired by querying the state register of the internal security management unit of the solid state disk.

[0028] Based on the preset state transition rule, each access request in the access request sequence is parsed to obtain a request feature set. The state transition rule defines the parsing logic of different access command types, such as the processing flow of read commands, write commands, and erase commands. For each access request, the operation type, target logical address range, data length, key index, etc. contained therein are extracted to form a request feature set. For complex commands such as atomic write or read with conditional judgment, the state transition rule will define more complex parsing logic. For example, for the request {WRITE, LBA:0x10000, Length:8KB, KeyIndex:1}, the parsed request feature set is {Operation:WRITE, LogicalAddressRange:[0x10000,0x12000], DataSize:8KB, KeyIndex:1, AccessPattern:Sequential}.

[0029] The state transition rule can be predefined by a configuration file, or dynamically adjusted according to the actual working mode of the solid state disk. For example, for high-performance computing scenarios, the parsing efficiency of sequential read and write can be optimized; for database applications, the recognition ability of random small IO can be enhanced.

[0030] According to the target logical address in the request feature set and the address mapping relationship maintained inside the encrypted solid state disk, the physical storage area corresponding to the target logical address and the encryption domain identifier associated with the physical storage area are determined, a region mapping result is obtained, and the address mapping relationship is usually maintained by the flash translation layer (FTL) of the solid state disk, which records the correspondence between the logical address and the physical page. In addition, it is necessary to extend the record of the encryption domain identifier to which each physical storage area belongs. For example, logical address 0x8000 can be mapped to physical page 0x2000, and the physical page belongs to encryption domain 2. In specific implementation, an encryption domain identifier field can be added to the FTL mapping table of the solid state disk, such as {LogicalAddress: 0x8000, PhysicalAddress: 0x2000, EncryptionDomainID: 2, BlockStatus: valid}.

[0031] For access requests across multiple physical pages, it is necessary to confirm whether all the involved physical pages belong to the same encryption domain. If cross-domain access is found, it is marked as a potential exception. For example, if the request accesses the logical address range [0x8000, 0x9000], the mapping result shows that the physical pages corresponding to the range belong to encryption domain 2 and encryption domain 3 respectively, and the region mapping result {AddressRange: [0x8000, 0x9000], PhysicalBlocks: [{PBA: 0x2000, Domain: 2}, {PBA: 0x3000, Domain: 3}], CrossDomain: true} is generated.

[0032] According to the region mapping result, the encryption state identifier, and the key index information in the access request, it is judged whether the current access request satisfies the encryption domain consistency constraint, wherein the encryption domain consistency constraint requires that the key index used by the access request must match the encryption domain associated with the target physical storage area; the access request should not cross different encryption domains; and the key of the access request must be in a valid state. If these constraints are not met, an exception flag is generated, and a corresponding processing strategy is determined based on the exception type of the exception flag to obtain an exception handling instruction.

[0033] The abnormality types can be classified into key mismatch, cross-domain access, invalid key state, and the like. For example, when it is detected that a request uses key index 2 to access data belonging to encryption domain 3, an abnormality label {ErrorType: KeyMismatch, RequestKeyIndex: 2, DomainRequired: 3, Severity: High} is generated. For different abnormality types, corresponding processing strategies are formulated: for high-risk abnormality such as key mismatch, the strategy is to directly reject access and record a security log; for medium-risk such as key about to expire, the strategy is to allow access but trigger a key renegotiation process; for low-risk such as access mode abnormality but correct key, the strategy is to allow access but increase monitoring frequency.

[0034] The access request is executed based on the abnormality processing instruction to perform rejection, redirection, or key renegotiation operation, and the processing result is taken as feedback information, and the state transition rule is dynamically adjusted using the feedback information to adaptively optimize the abnormality identification accuracy. The rejection operation returns an access-rejected error code to the request initiator; the redirection operation re-routes the request to the correct encryption domain; and the key renegotiation operation triggers a key update process between the encryption module and the security manager. For example, for the abnormality processing instruction {Action: Reject, LogEvent: true, NotifyAdmin: true}, the access request is rejected, detailed security logs are recorded, and the system administrator is notified. The processing result is {Status: Rejected, ErrorCode: 403, EventLogID: SEC20211025001}.

[0035] The feedback adjustment mechanism updates the parameters of the state transition rule using the processing result. For example, if a certain type of request mode frequently triggers false positives, the abnormality threshold of the mode is automatically adjusted; and if a certain type of abnormality continues to increase, the sensitivity of the corresponding rule is increased. In a specific implementation, a counter can be used to record the frequency of occurrence of each type of abnormality, and when a preset threshold is reached, the update of the rule parameters is triggered. For example, when the false positive rate of key mismatch abnormality in a specific application scenario exceeds 10%, the determination logic is adjusted to increase the consideration of application program behavior mode.

[0036] By monitoring the access requests of the encrypted solid state disk in real time, combining encryption state management and adaptive rule optimization, the problems of encryption domain boundary access and key misuse are effectively prevented, and the security of the encrypted storage system is improved. This method is particularly suitable for multi-tenant scenarios in cloud computing environments, and can effectively isolate the data of different users and prevent unauthorized access.

[0037] In an optional implementation, each access request in the access request sequence is parsed based on a preset state transition rule to obtain a request feature set, including: According to the access request structure template defined in the preset state transition rule, field segmentation is performed on each access request in the access request sequence, to identify the command field, address field and additional information field in the access request, and obtain a field combination; For the command field in the field combination, the command field is converted into a standardized operation type identifier by querying the command type mapping table maintained in the preset state transition rule, to obtain an operation type; For the address field in the field combination, logical address information carried in the address field is extracted, and the logical address information is taken as a target logical address, and a key index identifier is parsed from the additional information field, to obtain address and key association information; Based on the request validity verification condition defined in the preset state transition rule, integrity verification is performed on the operation type, the target logical address and the key index identifier, and the operation type, the target logical address and the key index identifier that pass the integrity verification are combined to form the request feature set.

[0038] In this embodiment, the preset state transition rule includes an access request structure template, a command type mapping table and a request validity verification condition. The access request structure template defines the basic structure of the access request, including the arrangement and combination mode of the command field, the address field and the additional information field. The command type mapping table maintains the corresponding relationship between various command fields and standardized operation type identifiers. The request validity verification condition specifies the standard for judging whether the request is valid.

[0039] When the access request sequence is received, each request is parsed and processed in turn. Taking a typical storage access request sequence as an example, it contains multiple access requests, such as “READ 0x4000 KEY_ID=5”, “WRITE 0x5000 DATA=0x12345 KEY_ID=8” and “ERASE 0x6000-0x7000 KEY_ID=3”.

[0040] For the first access request “READ 0x4000 KEY_ID=5”, field segmentation is first performed according to the access request structure template in the preset state transition rule. Through template matching, it is identified that the command field is “READ”, the address field is “0x4000”, and the additional information field is “KEY_ID=5”, forming a field combination.

[0041] For the command field "READ", the command type mapping table maintained in the preset state transition rule is queried. The mapping table contains the mapping relationship between various commands and standardized operation type identifiers, for example, "READ" is mapped to "OP_READ", "WRITE" is mapped to "OP_WRITE", "ERASE" is mapped to "OP_ERASE", and the like. Through table lookup, "READ" is converted into the standardized operation type identifier "OP_READ".

[0042] For the address field "0x4000", the logical address information "0x4000" carried therein is extracted as the target logical address. At the same time, the key index identifier is parsed from the additional information field "KEY_ID=5" as "5". The target logical address "0x4000" is associated with the key index identifier "5", and the address and key association information is obtained.

[0043] Subsequently, based on the request validity verification conditions defined in the preset state transition rule, the integrity of the operation type "OP_READ", the target logical address "0x4000" and the key index identifier "5" is verified. Assuming that the validity verification condition stipulates that the read operation must have a valid address and the key index is within the range of 1-10, it is checked whether the target logical address is valid (for example, whether it is within the legal address range) and whether the key index "5" is within the range of 1-10.

[0044] After verification, the operation type "OP_READ", the target logical address "0x4000" and the key index identifier "5" are combined to form the request feature set {operation type: OP_READ, target logical address: 0x4000, key index identifier: 5}.

[0045] For the second access request "WRITE 0x5000 DATA=0x12345 KEY_ID=8", the above-mentioned process is also performed. First, the fields are segmented, and it is identified that the command field is "WRITE", the address field is "0x5000", and the additional information field is "DATA=0x12345 KEY_ID=8". Through the command type mapping table, "WRITE" is converted into "OP_WRITE". The target logical address "0x5000" is extracted from the address field, and the key index identifier "8" is parsed from the additional information field. After integrity verification, the request feature set {operation type: OP_WRITE, target logical address: 0x5000, key index identifier: 8} is formed.

[0046] For the third access request "ERASE 0x6000-0x7000 KEY_ID=3", the processing process is similar. After field segmentation, the command field "ERASE", the address field "0x6000-0x7000", and the additional information field "KEY_ID=3" are obtained. "ERASE" is converted to "OP_ERASE". The address field contains an address range, and the start address "0x6000" and the end address "0x7000" are extracted as components of the target logical address. The key index identifier is "3". After integrity verification, the request feature set {operation type: OP_ERASE, target logical address: {start: 0x6000, end: 0x7000}, key index identifier: 3} is formed.

[0047] Through the above processing, the feature set of each request is successfully extracted from the access request sequence, including the operation type, the target logical address, and the key index identifier. These feature sets can be used in subsequent access control, security verification, and other processing links, improving the security and reliability of the system.

[0048] The present embodiment standardizes the access request through the preset state transition rule, so that different forms of access requests can be uniformly managed; through integrity verification, invalid requests that do not meet the rules are filtered out, improving the stability of the system; and by extracting key features to form a feature set, a basis is provided for subsequent refined access control.

[0049] In an optional embodiment, according to the target logical address in the request feature set and the address mapping relationship maintained inside the encrypted solid state disk, the physical storage area corresponding to the target logical address and the encryption domain identifier associated with the physical storage area are determined, and a region mapping result is obtained, including: The target logical address is extracted from the request feature set, and a corresponding mapping entry set is searched in the address mapping relationship maintained inside the encrypted solid state disk according to the target logical address; In the mapping entry set, the target mapping entry containing the target logical address is determined by interval matching the target logical address with the logical address segment in each mapping entry, and the physical storage area identifier to which the target logical address is mapped is read from the target mapping entry, and a physical region positioning result is obtained; Based on the physical storage area identifier in the physical region positioning result, the encryption domain management structure maintained inside the encrypted solid state disk is accessed, and the encryption domain identifier associated with the physical storage area identifier and the key version information corresponding to the encryption domain identifier are queried from the encryption domain management structure, and encryption domain association information is obtained; The physical storage area identifier in the physical area positioning result is structurally combined with the encryption domain identifier and the key version information in the encryption domain association information to obtain the area mapping result.

[0050] When the encrypted solid state disk receives a data access request from the host, the request contains a request feature set, which includes target logical address information. In order to correctly process the request, it is necessary to convert the logical address in the request to the actual physical storage location and determine the corresponding encryption domain information. Extract the target logical address information from the request feature set, for example, when the host sends a read request, the logical address 0x8000 is included in the request feature set, indicating that the data starting from this address is expected to be read. Extract this logical address 0x8000 as the target logical address. After extraction, it is necessary to find the corresponding mapping table item set in the address mapping relationship maintained inside the encrypted solid state disk. These mapping table item sets are usually stored in the DRAM cache or flash memory of the solid state disk, and are organized in a tree structure or hash table structure to improve the lookup efficiency.

[0051] The organization mode of the address mapping relationship is a multi-level mapping table structure, for example, a three-level mapping structure: directory table, page table and mapping table item. First, the high bit of the target logical address is used to determine the index in the directory table, and the corresponding page table pointer is found; then the middle bit of the logical address is used to determine the index in the page table, and the starting address of the mapping table item set is found. For example, for the target logical address 0x8000, the high 8 bits (0x80) are extracted as the directory table index to obtain the address 0x10000 of the corresponding page table; then the next 8 bits (0x00) are used as the page table index to locate the address 0x20000 of the mapping table item set.

[0052] After obtaining the mapping table item set, it is necessary to find the specific mapping table item containing the target logical address in the set, and each mapping table item contains a logical address segment range and a corresponding physical storage area identifier. The target mapping table item is determined by interval matching the target logical address with the logical address segment in each mapping table item. The interval matching method is to check whether the target logical address is greater than or equal to the starting logical address of the mapping table item and less than or equal to the ending logical address.

[0053] For example, the mapping table item set contains the following three table items: Table 1: logical address segment [0x5000-0x6FFF], physical storage area identifier 0xA1000; Table 2: logical address segment [0x7000-0x8FFF], physical storage area identifier 0xB2000; Table 3: logical address segment [0x9000-0xAFFF], physical storage area identifier 0xC3000.

[0054] For the target logical address 0x8000, it is found that it falls within the logical address segment range of entry 2, so entry 2 is determined as the target mapping entry. Then the physical storage area identifier 0xB2000 is read from the entry to obtain the physical area positioning result. If there is an offset for the target logical address, the exact position of the target logical address in the physical storage area is also calculated. For example, the offset of the target logical address 0x8000 relative to the starting logical address 0x7000 of entry 2 is 0x1000, so the exact physical address corresponding to the target logical address is 0xB2000+0x1000=0xB3000.

[0055] After obtaining the physical area positioning result, the encryption domain information associated with the physical storage area needs to be determined. The encryption domain management structure maintained inside the encrypted solid state disk is accessed, and the structure stores the association between the physical storage area and the encryption domain. The encryption domain management structure usually adopts a hash table or a balanced tree structure, taking the physical storage area identifier as the key and the associated encryption domain identifier and key version information as the value.

[0056] The physical storage area identifier 0xB2000 in the physical area positioning result is used as the query key to search the encryption domain management structure. Assume that the query result shows that the physical storage area 0xB2000 is associated with an encryption domain identifier 0x03, and the corresponding key version information is 0x05, indicating that the 5th edition of the encryption key of the 3rd encryption domain is used for data encryption and decryption operations. These information constitute the encryption domain association information.

[0057] Finally, the physical storage area identifier in the physical area positioning result and the encryption domain identifier and key version information in the encryption domain association information are structurally combined to generate the area mapping result. The structurally combined way is to create a data structure containing three fields: physical storage area identifier, encryption domain identifier, and key version information. For this example, the final area mapping result obtained is: {physical storage area identifier: 0xB2000, encryption domain identifier: 0x03, key version information: 0x05}.

[0058] This complete area mapping result will be used for subsequent data access operations, including selection of encryption keys, data encryption and decryption processing, etc., to ensure the security and correctness of data access. The entire matching process efficiently and accurately completes the conversion from logical address to physical address and encryption information, providing basic support for secure data access of the encrypted solid state disk.

[0059] In an alternative embodiment, based on the physical storage area identifier in the physical area positioning result, the encryption domain management structure maintained internally in the encrypted solid state disk is accessed, the encryption domain identifier associated with the physical storage area identifier and the key version information corresponding to the encryption domain identifier are queried from the encryption domain management structure, and the encryption domain association information is obtained, including: The physical group identifier to which the physical storage area belongs is determined according to the region coding attribute of the physical storage area identifier, and the group attribution information is obtained; Based on the physical group identifier in the group attribution information, the encryption domain configuration table corresponding to the physical group identifier is located in the encryption domain management structure; In the encryption domain configuration table, the target encryption domain entry to which the physical storage area identifier belongs is determined by matching the physical storage area identifier with the physical storage area identifier range recorded in each entry of the encryption domain configuration table, and the corresponding encryption domain identifier is read from the target encryption domain entry, and the domain identifier query result is obtained; Based on the encryption domain identifier in the domain identifier query result, the key version index table maintained in the encryption domain management structure is accessed, the current valid key version identifier associated with the encryption domain identifier and the key lifecycle state corresponding to the key version identifier are retrieved from the key version index table, and the key version query result is obtained; The encryption domain identifier in the domain identifier query result is associated and integrated with the current valid key version identifier and the key lifecycle state in the key version query result, and the encryption domain association information is obtained.

[0060] In the encryption domain management of the encrypted solid state disk, in order to realize the access to the internally maintained encryption domain management structure based on the physical storage area identifier in the physical area positioning result, the following methods can be used.

[0061] After obtaining the physical area positioning result, first, the physical group identifier to which the physical storage area belongs is determined according to the region coding attribute of the physical storage area identifier, and the group attribution information is obtained. For example, assuming that the physical storage area identifier is "P2048", by analyzing the coding rule of the identifier, it can be determined that it belongs to the physical group "PG16". In specific implementation, the group information bit in the physical storage area identifier can be extracted through bit operation, such as taking the high 8 bits of the identifier as the group index, and mapping "P2048" to "PG16" group.

[0062] After obtaining the grouping attribution information, the corresponding encryption domain configuration table is located in the encryption domain management structure based on the physical grouping identifier "PG16". The encryption domain management structure can be designed as a hierarchical structure, including a grouping index table and the encryption domain configuration table corresponding to each grouping. By searching the entry with the key value "PG16" in the grouping index table, the pointer or offset pointing to the corresponding encryption domain configuration table is obtained. For example, the configuration table position corresponding to "PG16" is stored in the grouping index table as 0x4A000.

[0063] Next, in the located encryption domain configuration table, the target encryption domain entry to which the physical storage area identifier belongs is determined by matching the physical storage area identifier with the physical storage area identifier range recorded in each entry of the table. The encryption domain configuration table structure can include multiple entries, and each entry includes a starting physical area identifier, an ending physical area identifier, and a corresponding encryption domain identifier field. For the physical storage area identifier "P2048", each entry in the encryption domain configuration table is checked, and when the area range of an entry contains "P2048", such as the range recorded in the entry is "P2000-P3000", it is determined that the entry is the target encryption domain entry. The corresponding encryption domain identifier, such as "ED_35", is read from the entry to obtain the domain identifier query result.

[0064] When the domain identifier query result is obtained, the key version index table maintained in the encryption domain management structure is accessed based on the encryption domain identifier "ED_35". The key version index table stores the key version information currently used by each encryption domain and its lifecycle state. The structure design of the table includes an encryption domain identifier field, a currently valid key version identifier field, and a key lifecycle state field. The entry with the encryption domain identifier "ED_35" is searched in the key version index table, and its currently valid key version identifier such as "KV_102" and the corresponding key lifecycle state such as "ACTIVE" are read to form the key version query result.

[0065] Finally, the encryption domain identifier "ED_35" in the domain identifier query result is associated and integrated with the currently valid key version identifier "KV_102" and the key lifecycle state "ACTIVE" in the key version query result to generate the encryption domain association information. The integrated information can be represented as a structure body including a triple: {encryption domain identifier: ED_35, key version identifier: KV_102, lifecycle state: ACTIVE}. This association information will be used for subsequent data encryption and decryption operations.

[0066] In actual implementation, in order to improve the query efficiency, the encryption domain configuration table can adopt interval tree or ordered array and the like data structure to support fast positioning of an interval containing the specified physical area identifier. For example, the binary search algorithm is used to locate the interval in which P2048 is located in the ordered interval boundary array, and the search complexity is optimized from linear to logarithmic level.

[0067] The key version index table can be implemented as a hash table structure, taking the encryption domain identifier as the key and the key version and life cycle information as the value, to realize constant time complexity search. For example, a hash table with a capacity of 256 is constructed, and "ED_35" is mapped to table index 87 through a hash function, and the corresponding key version information is directly accessed at this position.

[0068] The data access in the entire query process can be performed through the security channel built in the hard disk controller, to ensure that the encryption domain management structure itself is not accessed by unauthorized access. The controller can implement an access control list to allow only authorized processing units to access these sensitive data structures.

[0069] Through the above, the corresponding encryption domain identifier and key version information can be efficiently queried according to the physical storage area identifier, necessary key management support is provided for secure data access of the encrypted solid state disk, and secure isolation of data between storage areas is realized.

[0070] In an optional implementation, according to the region mapping result, the encryption state identifier and the key index information in the access request, it is judged whether the current access request satisfies the encryption domain consistency constraint, if not, an exception marker is generated, and a corresponding processing strategy is determined based on the exception type of the exception marker, to obtain an exception processing instruction, including: The request key identifier indicated in the key index information is compared with the current valid key version identifier recorded in the key version information associated with the encryption domain identifier, to obtain a key consistency determination result; Based on the key consistency determination result, the key life cycle state in the key version information is checked to judge whether the key corresponding to the request key identifier is in an invalid state or a rotation state, and the global encryption state is combined to judge whether the encrypted solid state disk is in a key migration process, to obtain an exception cause analysis result; Based on the exception cause analysis result, if it is determined that the current access request does not satisfy the encryption domain consistency constraint, an exception marker containing an exception type identifier is generated, and the exception type identifier is generated according to the inconsistent reason identified in the exception cause analysis result to generate a classified exception marker; Based on the exception type identifier in the classified exception marker, a processing strategy template corresponding to the exception type identifier is queried in a preset exception processing strategy mapping table; An exception handling instruction is generated based on the processing strategy template and the physical storage area identifier in the area mapping result.

[0071] Figure 2 This is a flowchart illustrating the generation of exception handling instructions according to an embodiment of the present invention. Figure 2 As shown, in the process of implementing encryption domain consistency verification and anomaly handling, a comprehensive judgment is made based on the region mapping result, encryption status identifier, and key index information in the access request to ensure the security and consistency of data access. When the encrypted solid-state drive receives an access request, the controller first obtains the key index information contained in the request, and at the same time reads the current encryption status identifier and encryption domain configuration information from the secure region.

[0072] Extract the request key identifier, such as "KEY_ID_123", from the access request, and then compare it with the key version information associated with the current encryption domain identifier stored in the secure area. For example, if the current valid key version identifier is "KEY_ID_123_V2", but the request uses "KEY_ID_123_V1", a key consistency determination result of mismatch will be generated.

[0073] The key consistency determination result is further examined by checking the key lifecycle status recorded in the key version information. In the key version information data structure, each key identifier is associated with a lifecycle status field; for example, the status of "KEY_ID_123_V1" is marked as expired or in rotation. The global encryption status identifier is also checked to determine whether the entire encrypted SSD is in the process of key migration. For example, a global status of "KEY_MIGRATION_IN_PROGRESS" indicates that key migration is in progress.

[0074] By comprehensively analyzing this information, an anomaly cause analysis result is generated. For example, if the requested key identifier is "KEY_ID_123_V1", while the currently valid version is "KEY_ID_123_V2", and the status of "KEY_ID_123_V1" is expired, and the global encryption status is "KEY_MIGRATION_COMPLETED", then the anomaly cause analysis result is "The requested key version has expired, and the key migration has been completed".

[0075] Based on the anomaly cause analysis results, anomaly markers containing anomaly type identifiers are generated. The anomaly type identifiers are classified according to the inconsistency cause. For example, "TYPE_EXPIRED_KEY_ACCESS" indicates that an expired key was attempted, "TYPE_KEY_ROTATION_IN_PROGRESS" indicates that the key is being rotated, or "TYPE_DOMAIN_MISMATCH" indicates that the encryption fields do not match.

[0076] The abnormality processing strategy mapping table is stored in the security area of the controller, containing preset processing strategy templates, and the table structure includes an abnormality type identification field and a corresponding processing strategy template field. For example, for an abnormality of the "TYPE_EXPIRED_KEY_ACCESS" type, the corresponding processing strategy template is "TEMPLATE_REJECT_WITH_ERROR", indicating directly rejecting the request and returning an error; for an abnormality of the "TYPE_KEY_ROTATION_IN_PROGRESS" type, the corresponding processing strategy template is "TEMPLATE_RETRY_WITH_NEW_KEY", indicating attempting to retry using a new key.

[0077] According to the queried processing strategy template and the physical storage area identification in the region mapping result, a final abnormality processing instruction is generated. For example, for an access request with a physical block address range of "PBA_10000-PBA_20000", if the strategy template is "TEMPLATE_REJECT_WITH_ERROR", the generated abnormality processing instruction is {command: REJECT, error_code: 0x0503, physical_address_range: PBA_10000-PBA_20000}; if the strategy template is "TEMPLATE_RETRY_WITH_NEW_KEY", the generated abnormality processing instruction is {command: RETRY, new_key_id: KEY_ID_123_V2, physical_address_range: PBA_10000-PBA_20000}.

[0078] These abnormality processing instructions are passed to the execution engine of the solid state disk, and the execution engine performs corresponding operations according to the instruction content, such as rejecting an access request, retrying using a new key, recording a security log, etc. For example, when executing a rejection access instruction, the controller returns a corresponding error code to the host, and records an abnormal access event in the security log; when executing a retry using a new key instruction, the controller re-encrypts or decrypts data using the current valid key version, and completes the access request.

[0079] Through this fine-grained abnormality processing mechanism, the encrypted solid state disk can ensure the security and consistency of data access in the scenarios of key rotation, key invalidation, and encryption domain change. At the same time, the differentiated processing strategies for different types of abnormalities also improve the flexibility and user experience of the system, for example, automatically retrying using a valid key for recoverable abnormalities, and directly rejecting and alarming for serious security risk abnormalities, thereby maximizing system availability while ensuring security.

[0080] In an optional implementation, a key lifecycle state in the key version information is checked based on the key consistency determination result to determine whether the key corresponding to the requested key identifier is in an invalid state or a rotation state, and a global encryption state is combined to determine whether the encrypted solid state disk is in a key migration process, to obtain an abnormal reason analysis result, including: Based on the key consistency determination result, if it is determined that the requested key identifier is inconsistent with the current valid key version identifier, the key lifecycle state identifier associated with the requested key identifier is extracted from the key version information, and the system-level key management state identifier of the encrypted solid state disk is extracted from the global encryption state, to obtain a state information set; Based on the key lifecycle state identifier in the state information set, the current lifecycle phase of the key corresponding to the requested key identifier is determined, and it is determined whether the key is in an invalid state or a rotation transition state, to obtain a key state determination result; Based on the system-level key management state identifier in the state information set, it is determined whether the encrypted solid state disk is performing a key migration operation across encryption domains, to obtain a system state determination result; According to the key state determination result and the system state determination result, the abnormal reason is classified into a key invalidity class exception, a key version mismatch class exception, or a key migration conflict class exception, to obtain an abnormal reason analysis result including the abnormal reason category and the corresponding state basis.

[0081] When key verification fails, the abnormal reason needs to be further analyzed to take corresponding processing measures. For the key verification failure case, by checking the key lifecycle state in the key version information, it is determined whether the key corresponding to the requested key identifier is in an invalid state or a rotation state, and the global encryption state is combined to determine whether the encrypted solid state disk is in a key migration process, to obtain an abnormal reason analysis result.

[0082] In specific implementation, first, based on the key consistency determination result, if it is determined that the requested key identifier is inconsistent with the current valid key version identifier, an abnormal reason analysis process is performed. The process extracts the key lifecycle state identifier associated with the requested key identifier from the key version information, and extracts the system-level key management state identifier of the encrypted solid state disk from the global encryption state, to obtain a state information set.

[0083] With a specific case, assume that the storage device receives a data decryption request, the request key identifier is "KEY ID 0x5A3F", and the current record valid key version identifier is "KEY ID 0x7B2D". After detecting the key inconsistency, the record of "KEY ID 0x5A3F" is queried from the key version information table, and its lifecycle state identifier is extracted as "DEPRECATED". At the same time, the system-level key management state identifier is extracted from the global encryption state as "NORMAL". In this way, the state information set containing the key lifecycle state and the system key management state is obtained.

[0084] Next, based on the key lifecycle state identifier in the state information set, it is judged that the key corresponding to the request key identifier is currently in the lifecycle phase, whether the key is in the invalid state or the rotation transition state, and the key state determination result is obtained. In the above case, the "DEPRECATED" state is checked, and it is determined that the key has entered the invalid phase and is no longer the current valid encryption key.

[0085] The key lifecycle state usually includes "ACTIVE" (active state), "ROTATING" (in rotation transition), "DEPRECATED" (deprecated), "REVOKED" (revoked), etc. According to the preset state mapping rule, "DEPRECATED" and "REVOKED" are determined as the invalid state, "ROTATING" is determined as the rotation transition state, and "ACTIVE" is the normal state.

[0086] Based on the system-level key management state identifier in the state information set, it is judged whether the encrypted solid state disk is performing cross-encryption domain key migration operation, and the system state determination result is obtained. The system-level key management state includes "NORMAL" (normal state), "MIGRATING" (key migration), "RECOVERY" (recovery mode), etc. In the example, the system state is "NORMAL", indicating that the device is not currently performing key migration operation.

[0087] Finally, according to the key state determination result and the system state determination result, the abnormal reason is classified into a specific type. In this example, since the key state determination result shows that the key has been in the invalid state (DEPRECATED), and the system state determination result shows that the device is in the normal state (NORMAL), the abnormality is classified as a key invalidity class abnormality, and the abnormal reason is recorded as "The request key KEY ID 0x5A3F has been deprecated, and the current valid key is KEY ID 0x7B2D".

[0088] In another case, if the request key identifier is "KEY ID 0x6C1E", the lifecycle state is "ROTATING", and the system-level key management state is "NORMAL", it is determined as a "key version mismatch type exception", indicating that the request uses an old version of the key in the rotation process.

[0089] For example, if the request key identifier is "KEY ID 0x8D4F", the lifecycle state is "ACTIVE", but the system-level key management state is "MIGRATING", it is determined as a "key migration conflict type exception", indicating that the key migration operation across the encryption domain is currently being performed, and the requested key cannot be used temporarily.

[0090] The complete exception cause analysis result includes the exception cause category and the corresponding state basis, for example: "exception type: key invalidation type exception; state basis: the lifecycle state of the request key (KEY ID 0x5A3F) is DEPRECATED, and the system key management state is NORMAL; recommended operation: use the current valid key (KEY ID 0x7B2D) to re-encrypt the data." Through the above detailed exception cause analysis, accurate problem diagnosis can be provided for different types of key verification failure situations, helping the storage device management system to automatically select an appropriate recovery strategy, such as for key invalidation type exceptions, prompting the user to use a new key to re-encrypt the data; for key version mismatch type exceptions, automatically attempting to use the current valid key version; for key migration conflict type exceptions, waiting for the migration to complete and then retrying the operation.

[0091] In an optional implementation, the access request is executed based on the exception handling instruction to perform a rejection, redirection, or key renegotiation operation, and a processing result is obtained as feedback information, and the state transition rule is dynamically adjusted using the feedback information to adaptively optimize the accuracy of exception identification, including: The processing action type and the target physical storage area identifier are extracted from the exception handling instruction, and the target operation type in the access rejection operation, the request redirection operation, or the key renegotiation operation is determined according to the processing action type, and an operation type determination result is obtained; Based on the operation type determination result, if the target operation type is the access rejection operation, a rejection response is returned to the request source that initiates the access request, and the exception type identifier in the exception handling instruction is carried in the rejection response; If the target operation type is the request redirection operation, the access request is redirected to a backup physical storage area according to the target physical storage area identifier; If the target operation type is a key renegotiation operation, a key negotiation process with the request source is started based on a key negotiation parameter in the exception handling instruction. The processing result is taken as feedback information, the feedback information is written into an exception handling log, and a request feature set of the access request and an exception type identifier in the exception handling instruction are recorded in association in the exception handling log to obtain an exception handling trace record, so as to adaptively update the state conversion rule.

[0092] When an abnormal access request is detected, a corresponding exception handling instruction is generated, wherein the execution of the exception handling instruction realizes the rejection, redirection or key renegotiation of the access request, and the processing result is taken as feedback information for dynamically adjusting the state conversion rule to optimize the accuracy of the exception identification.

[0093] In the specific implementation process, first, the processing action type and the target physical storage area identifier are extracted from the exception handling instruction. The processing action type is one of the rejection access, request redirection or key renegotiation. For example, when the instruction content is {action type: reject access, exception type: unauthorized access, target area: null}, the action type is extracted as reject access, and the exception type is extracted as unauthorized access; when the instruction content is {action type: request redirection, exception type: temporary congestion, target area: STOR-B32}, the action type is extracted as request redirection, and the target area is extracted as STOR-B32; when the instruction content is {action type: key renegotiation, exception type: key expiration, negotiation parameter: {encryption algorithm: AES-256, key length: 256}}, the action type is extracted as key renegotiation and the related parameters.

[0094] The target operation type is determined according to the extracted processing action type, and in the specific implementation, an action mapping table is maintained to map the processing action type to a specific operation execution function. For example, “reject access” is mapped to the rejectAccess() function, “request redirection” is mapped to the redirectRequest() function, and “key renegotiation” is mapped to the renegotiateKey() function. The target operation type to be executed is quickly determined through table lookup.

[0095] When the target operation type is determined to be access denial operation, a denial response is returned to the request source that initiated the access request, and an exception type identifier is carried in the response. For example, when a user ID "user_123" attempts to access a file "secure_document.pdf" from an IP address "192.168.1.100", if it is detected that this is an unauthorized access, a denial response message will be generated: "Access denied: unauthorized access attempt detected. Please contact the system administrator for appropriate permissions." The response is returned to the request source through the HTTP status code 403 Forbidden, and the rejection event is recorded, including the timestamp "2023-05-15 14:23:07", request source information, target resource and rejection reason.

[0096] When the target operation type is determined to be request redirection operation, the access request is redirected to the backup physical storage area according to the target physical storage area identifier, for example, when it is detected that the main storage area "STOR-A15" is overloaded, the original access request " / storage / STOR-A15 / data.bin" is redirected to the backup storage area "STOR-B32", and the actual access path becomes " / storage / STOR-B32 / data.bin". A 307 Temporary Redirect response is generated, and the Location field in the response header is set to the new access path. At the same time, the redirection operation is recorded, including the original request path, the redirection target path, the redirection reason and the timestamp.

[0097] When the target operation type is determined to be key re-negotiation operation, the key negotiation process with the request source is started based on the key negotiation parameters in the exception handling instruction. For example, when it is detected that the encryption key used by user "user_456" has expired, the re-negotiation process is started. The negotiation process includes: generating a temporary session identifier "session_78912", sending a negotiation request message to the request source, including the list of supported encryption algorithms [AES-256, ChaCha20] and the recommended key length [256, 512]; waiting for the request source to select specific parameters and reply; after verifying the identity of the request source, generating a new key using the negotiated parameters; securely transmitting the new key to the request source; updating the key record in the system, marking the old key as invalid and the new key as valid. The entire negotiation process is completed through a TLS encrypted channel to ensure the security of key exchange.

[0098] After the above operations are completed, the processing result is written as feedback information into an exception handling log, and the request feature set and the exception type identifier of the access request are recorded in the log, forming an exception handling trace record. For example, the log content of the access rejection operation can include: {time: 2023-05-15 14:23:07, operation: access rejection, request source: user_123@192.168.1.100, request resource: secure_document.pdf, exception type: unauthorized access, result: 403 rejection response has been returned to the user}. The log content of the redirection operation can include: {time: 2023-05-15 15:30:22, operation: request redirection, original path: / storage / STOR-A15 / data.bin, redirection path: / storage / STOR-B32 / data.bin, exception type: temporary congestion, result: redirection is successful, and 307 status code is returned}. The log content of the key renegotiation operation can include: {time: 2023-05-15 16:45:33, operation: key renegotiation, request source: user_456, original key ID: key_98765, new key ID: key_98766, exception type: key expiration, negotiation algorithm: AES-256, key length: 256, result: negotiation is successful, and the new key is deployed}.

[0099] Periodically analyze these exception handling trace records for adaptive updating of state transition rules. For example, if it is found that a large number of normal accesses are misjudged as exceptions in a certain time period (such as 9:00-10:00 every day), resulting in frequent rejection operations, the state transition rules can be adjusted to increase the exception determination threshold for that time period. For another example, if it is found that a certain type of redirection operation can always successfully solve the access problem, the weight of selecting the redirection operation in this case can be increased. Through this feedback mechanism based on actual processing results, the accuracy of exception identification is continuously optimized, and the efficiency and user experience of storage access security management are improved.

[0100] The encryption solid state disk exception handling system based on the encryption solid state disk according to the embodiments of the present application comprises: A first unit is configured to obtain an access request sequence and a corresponding encryption state identifier generated by an encryption solid state disk during operation. A second unit is configured to parse each access request in the access request sequence based on a preset state transition rule to obtain a request feature set. A third unit is configured to match a target logical address in the request feature set with an address mapping relationship maintained internally by the encryption solid state disk to determine a physical storage area corresponding to the target logical address and an encryption domain identifier associated with the physical storage area, and obtain a region mapping result. The fourth unit is configured to determine whether the current access request satisfies the encryption domain consistency constraint according to the region mapping result, the encryption state identifier, and the key index information in the access request, generate an exception marker if the current access request does not satisfy the encryption domain consistency constraint, and determine a corresponding processing strategy based on an exception type of the exception marker to obtain an exception processing instruction. The fifth unit is configured to perform rejection, redirection, or key re-negotiation operation on the access request based on the exception processing instruction, and use a processing result as feedback information to dynamically adjust the state conversion rule to adaptively optimize the exception identification accuracy.

[0101] In a third aspect, an electronic device is provided, including: a processor; a memory for storing processor-executable instructions; The processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0102] In a fourth aspect, a computer-readable storage medium is provided, which stores computer program instructions, and the computer program instructions are executed by a processor to implement the method described above.

[0103] The present application can be a method, device, system and / or computer program product. The computer program product can include a computer-readable storage medium having stored thereon computer-readable program instructions that, when executed by a computer, cause the computer to carry out various aspects of the present application.

[0104] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for handling anomalies in encrypted solid-state drives, characterized in that: include: Obtain the sequence of access requests generated by the encrypted solid-state drive during operation and the corresponding encryption status identifiers; Each access request in the access request sequence is parsed based on preset state transition rules to obtain a set of request features; Based on the target logical address in the request feature set and the address mapping relationship maintained internally by the encrypted solid-state drive, the physical storage area corresponding to the target logical address and the encrypted domain identifier associated with the physical storage area are determined to obtain the area mapping result; Based on the region mapping result, the encryption status identifier, and the key index information in the access request, it is determined whether the current access request satisfies the encryption domain consistency constraint. If it does not, an exception flag is generated, and the corresponding processing strategy is determined based on the exception type of the exception flag to obtain the exception handling instruction. Based on the anomaly handling instructions, the access request is denied, redirected, or key renegotiation is performed, and the processing result is used as feedback information. The state transition rules are dynamically adjusted using the feedback information to adaptively optimize the anomaly identification accuracy.

2. The method according to claim 1, characterized in that, Each access request in the access request sequence is parsed based on preset state transition rules to obtain a set of request features, including: Based on the access request structure template defined in the preset state transition rules, each access request in the access request sequence is segmented by field, and the command field, address field, and additional information field in the access request are identified to obtain the field combination; For the command field in the field combination, the command field is converted into a standardized operation type identifier by querying the command type mapping table maintained in the preset state transition rules, thereby obtaining the operation type; For the address field in the field combination, extract the logical address information carried in the address field, and use the logical address information as the target logical address. At the same time, parse the key index identifier from the additional information field to obtain the address and key association information. Based on the request validity verification conditions defined in the preset state transition rules, the operation type, the target logical address, and the key index identifier are verified for integrity. The operation type, target logical address, and key index identifier that pass the integrity verification are combined to form the request feature set.

3. The method according to claim 1, characterized in that, Based on the target logical address in the request feature set and the address mapping relationship maintained internally by the encrypted solid-state drive, the physical storage area corresponding to the target logical address and the encrypted domain identifier associated with the physical storage area are determined to obtain the area mapping result, including: Extract the target logical address from the request feature set, and search for the corresponding mapping table entry set in the address mapping relationship maintained inside the encrypted solid-state drive according to the target logical address; In the set of mapping entries, by performing interval matching between the target logical address and the logical address segments in each mapping entry, a target mapping entry containing the target logical address is determined, and the physical storage area identifier mapped to the target logical address is read from the target mapping entry to obtain the physical area location result; Based on the physical storage area identifier in the physical area location result, the encryption domain management structure maintained inside the encrypted solid-state drive is accessed. The encryption domain identifier associated with the physical storage area identifier and the key version information corresponding to the encryption domain identifier are queried from the encryption domain management structure to obtain the encryption domain association information. The physical storage area identifier in the physical area location result is structurally combined with the encryption domain identifier and key version information in the encryption domain association information to obtain the area mapping result.

4. The method according to claim 3, characterized in that, Based on the physical storage area identifier in the physical area location result, the encryption domain management structure maintained internally by the encrypted solid-state drive is accessed. The encryption domain identifier associated with the physical storage area identifier and the key version information corresponding to that encryption domain identifier are queried from the encryption domain management structure to obtain encryption domain association information, including: Based on the region coding attribute of the physical storage region identifier, the physical group identifier to which the physical storage region belongs is determined, and the group affiliation information is obtained; Based on the physical packet identifier in the packet attribution information, locate the encryption domain configuration table corresponding to the physical packet identifier in the encryption domain management structure; In the encrypted domain configuration table, by matching the physical storage area identifier with the range of physical storage area identifiers recorded in each entry of the encrypted domain configuration table, the target encrypted domain entry to which the physical storage area identifier belongs is determined, and the corresponding encrypted domain identifier is read from the target encrypted domain entry to obtain the domain identifier query result; Based on the encrypted domain identifier in the domain identifier query result, the key version index table maintained in the encrypted domain management structure is accessed, and the currently valid key version identifier associated with the encrypted domain identifier and the key lifecycle status corresponding to the key version identifier are retrieved from the key version index table to obtain the key version query result; The encrypted domain identifier in the domain identifier query result is associated and integrated with the current valid key version identifier and key lifecycle status in the key version query result to obtain the encrypted domain association information.

5. The method according to claim 1, characterized in that, Based on the region mapping result, the encryption status identifier, and the key index information in the access request, it is determined whether the current access request satisfies the encryption domain consistency constraint. If it does not, an exception flag is generated, and the corresponding processing strategy is determined based on the exception type of the exception flag, resulting in exception handling instructions, including: The request key identifier indicated in the key index information is compared with the currently valid key version identifier recorded in the key version information associated with the encryption field identifier to obtain the key consistency determination result; Based on the key consistency determination result, the key lifecycle status in the key version information is checked to determine whether the key corresponding to the requested key identifier is in an invalid or rotated state. Combined with the global encryption status, it is determined whether the encrypted solid-state drive is in a key migration process, and the result of the anomaly analysis is obtained. Based on the anomaly cause analysis results, if it is determined that the current access request does not meet the encryption domain consistency constraint, an anomaly tag containing an anomaly type identifier is generated. The anomaly type identifier generates a classification anomaly tag based on the inconsistency causes identified in the anomaly cause analysis results. Based on the anomaly type identifier in the anomaly classification marker, the processing strategy template corresponding to the anomaly type identifier is queried in the preset anomaly handling strategy mapping table; An exception handling instruction is generated based on the processing strategy template and the physical storage area identifier in the area mapping result.

6. The method according to claim 5, characterized in that, Based on the key consistency determination result, the key lifecycle status in the key version information is checked to determine whether the key corresponding to the requested key identifier is in an expired or rotated state. Combined with the global encryption status, it is determined whether the encrypted solid-state drive is in a key migration process, resulting in an anomaly analysis, including: Based on the key consistency determination result, if it is determined that the requested key identifier is inconsistent with the current valid key version identifier, then the key lifecycle status identifier associated with the requested key identifier is extracted from the key version information, and the system-level key management status identifier of the encrypted solid-state drive is extracted from the global encryption status to obtain a set of status information; Based on the key lifecycle status identifier in the status information set, determine the current lifecycle stage of the key corresponding to the request key identifier, and determine whether the key is in an expired state or a transitional state, thus obtaining the key status determination result; Based on the system-level key management status identifier in the status information set, it is determined whether the encrypted solid-state drive is performing a key migration operation across encryption domains, and a system status determination result is obtained; Based on the key status determination result and the system status determination result, the abnormal causes are classified into key failure anomalies, key version mismatch anomalies, or key migration conflict anomalies, resulting in an anomaly cause analysis result that includes the anomaly cause category and the corresponding status basis.

7. The method according to claim 1, characterized in that, Based on the anomaly handling instructions, the access request is denied, redirected, or key renegotiation is performed, and the processing result is used as feedback information. The state transition rules are dynamically adjusted using this feedback information to adaptively optimize the anomaly identification accuracy, including: Extract the processing action type and target physical storage area identifier from the exception handling instruction, and determine the target operation type among access denial operation, request redirection operation, or key renegotiation operation for the access request based on the processing action type, to obtain the operation type determination result; Based on the operation type determination result, if the target operation type is an access denial operation, a denial response is returned to the request source that initiated the access request, and the denial response carries the exception type identifier in the exception handling instruction. If the target operation type is a request redirection operation, then the access request is redirected to the backup physical storage area according to the target physical storage area identifier; If the target operation type is a key renegotiation operation, then the key negotiation process with the requesting source is initiated based on the key negotiation parameters in the exception handling instruction; The processing result is used as feedback information and written into the exception handling log. The exception handling log is associated with the request feature set of the access request and the exception type identifier in the exception handling instruction to obtain the exception handling traceability record, so as to adaptively update the state transition rules.

8. A system for handling anomalies in encrypted solid-state drives, used to implement the method as described in any one of claims 1-7, characterized in that, include: The first unit is used to obtain the access request sequence and corresponding encryption status identifier generated by the encrypted solid-state drive during operation; The second unit is used to parse each access request in the access request sequence based on preset state transition rules to obtain a set of request features; The third unit is used to match the target logical address in the request feature set with the address mapping relationship maintained internally by the encrypted solid-state drive, determine the physical storage area corresponding to the target logical address and the encrypted domain identifier associated with the physical storage area, and obtain the area mapping result; The fourth unit is used to determine whether the current access request meets the encryption domain consistency constraint based on the region mapping result, the encryption status identifier, and the key index information in the access request. If it does not meet the constraint, an exception flag is generated, and the corresponding processing strategy is determined based on the exception type of the exception flag to obtain the exception handling instruction. The fifth unit is used to perform rejection, redirection, or key renegotiation operations on the access request based on the exception handling instruction, and use the processing result as feedback information to dynamically adjust the state transition rules in order to adaptively optimize the accuracy of exception identification.

9. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 7.

Images